Alex Stamos: Security Decisions in the Public Eye

Alex Stamos has held the top security job at two of the biggest names on the internet, and both times his exit made the news.

At Yahoo he was the executive who asked the director of the NSA, in public, whether backdoors built for the US government should be built for China and Russia too. At Facebook he was the one who put a dollar figure on Russia's 2016 ad campaign and signed his name to it.

Both jobs showed that the hardest part of security work is rarely the hacking. It's what happens when you say out loud what you found.

Alex Stamos at a Glance

• Raised in the Sacramento suburb of Fair Oaks, Stamos came up through music, mock trial and a championship-winning Academic Decathlon team, then studied electrical engineering and computer science at UC Berkeley.
• After early jobs at LoudCloud and the hacker-heavy consultancy @stake, he co-founded iSEC Partners in 2004. NCC Group bought the firm in 2010.
• Yahoo hired him in 2014 to run its security team, the Paranoids. In February 2015 he publicly challenged NSA Director Mike Rogers over encryption backdoors, and he left that June.
• As Facebook's chief security officer, he led the investigation that found roughly $100,000 of Russian-linked ads. He left in August 2018 after clashing with other executives over how much to disclose.
• At Stanford he founded the Internet Observatory in 2019 to study abuse of the internet. Lawsuits and congressional pressure followed, and by 2024 it'd lost most of its staff.
• With former CISA director Chris Krebs he started the Krebs Stamos Group in 2021, with SolarWinds as its first client. SentinelOne bought the firm in 2023 and later made him its CISO.
• In 2025 he joined Corridor, a startup securing code written by AI agents, and in September 2026 he became chief information security officer at Cognition, the company behind the Devin coding agent.

The Life of Alex Stamos

Stamos's Early Years

Stamos grew up in Fair Oaks, a suburb of Sacramento, and went through the local public schools: Cambridge Heights Elementary, Arcade Middle and Bella Vista High.

He wasn't only a computer kid. When the San Juan Education Foundation put him in its hall of fame, it credited "inspiring teachers, music and mock trial mentors, and a championship-winning Academic Decathlon team" with shaping his path, and he still supports Bella Vista's Academic Decathlon team.

From there he went to UC Berkeley for a degree in electrical engineering and computer science, then into the dot-com security trenches. He was a senior security engineer at LoudCloud, the company that became Opsware, then a managing security architect at @stake, a consultancy stacked with famous hackers.

Building iSEC Partners

In 2004, Stamos and four colleagues founded iSEC Partners, a security consultancy.

The firm became known for research as much as consulting, with papers on breaking forensics software and on Mac security in the age of nation-state hackers. When Google and other companies were hit by Operation Aurora, a hacking campaign that Google traced to China and disclosed in January 2010, Stamos helped coordinate the response.

He also took on expert-witness work. "I was the expert witness on Aaron's side of US vs Swartz," he wrote in January 2013, after the internet activist's death ended the case before it reached trial.

NCC Group, the British security company, bought iSEC in October 2010. Stamos went on to become chief technology officer of Artemis Internet, an NCC venture pitching a locked-down ".secure" top-level domain.

The Paranoids

In March 2014, Yahoo hired Stamos as vice president of information security, putting him in charge of the team the company calls the Paranoids. He arrived with a reputation: weeks earlier he'd helped organize TrustyCon, a counter-conference protesting RSA's relationship with the NSA, and he was an outspoken critic of the agency's surveillance programs.

Then came February 23, 2015. At a cybersecurity conference hosted by the New America Foundation, NSA Director Admiral Mike Rogers was taking questions on encryption, and Stamos asked whether Yahoo, with "about 1.3 billion users around the world," should also build "golden master keys" for the Chinese, Russian, Saudi, Israeli and French governments.

When Rogers sidestepped, Stamos pressed: "So you do believe then, that we should build those for other countries if they pass laws?" Rogers's answer, which he repeated more than once, was "I think we can work our way through this." The full transcript is still worth reading.

Stamos left Yahoo in June 2015, and the reason surfaced only in October 2016. Reuters reported that Yahoo had secretly built a program to search all incoming email for a set of characters supplied by US intelligence, and that the security team had discovered it within weeks, at first thinking hackers had broken in.

When Stamos learned that CEO Marissa Mayer had authorized the program, the sources said, he resigned and told his team he'd been left out of a decision that hurt users' security. As the Guardian noted, his June 2015 announcement that he was joining Facebook hadn't mentioned any problems with Yahoo.

Facebook and the Russian Ads

By then he was Facebook's chief security officer, having joined in June 2015.

In June 2016, the month the Democratic National Committee announced it'd been hacked by Russians, Stamos put a group of engineers to work scouring Facebook for Russian activity. They kept finding more.

According to the New York Times, a detailed memo he wrote in early 2017 about Russian interference was scrubbed of mentions of Russia and winnowed into an April post that described, in hypothetical terms, how a foreign adversary could manipulate Facebook. Russia appeared only in a vague footnote.

That July he used his Black Hat keynote to urge the security community to refocus on defense and on making security work for everyone. Then, on September 6, 2017, he published the numbers himself in an update on Facebook's newsroom: about $100,000 in ad spending between June 2015 and May 2017, roughly 3,000 ads, tied to about 470 inauthentic accounts and Pages that "likely operated out of Russia."

Stamos Leaves Facebook

Meanwhile his own job was shrinking. In December 2017 his day-to-day responsibilities were reassigned, and by March 2018 his security group, once 120 people, was down to three as its members were moved into Facebook's product and infrastructure divisions.

That month the New York Times reported that Stamos planned to leave by August after clashing with other executives over how much to disclose. "I've had some disagreements with all of my colleagues, including other executives," he said in a statement.

He left that August and joined Stanford as an adjunct professor.

The Stanford Internet Observatory

In 2019 Stamos founded the Stanford Internet Observatory to study abuse of the internet, from disinformation to child safety.

When Zoom's pandemic boom exposed its security problems in the spring of 2020, he signed on as an outside adviser to the company. That year the Observatory also helped launch the Election Integrity Partnership, a coalition with the University of Washington and others that tracked attempts to suppress voting or delegitimize election results without evidence.

The election work drew fire. In 2023 Rep. Jim Jordan sent sweeping information requests to universities studying disinformation, and that May a lawsuit from Stephen Miller's America First Legal accused the Observatory of taking part in a government censorship program. Stanford's legal bills ran into the millions.

Stamos stepped down as director in November 2023 and moved to an advisory role. By June 2024 the Observatory had lost most of its staff, research manager Renée DiResta's contract hadn't been renewed, and Stanford said the remaining work would continue under new leadership.

Stamos called the attacks on its election and vaccine research "politically motivated" and said they "have no merit." Today the Observatory's old web address redirects to a different Stanford center.

From SolarWinds to SentinelOne

In January 2021, with the SolarWinds breach still unfolding, Stamos and Chris Krebs, the former director of CISA, launched the Krebs Stamos Group. Its first client was SolarWinds itself.

SentinelOne bought the firm in November 2023 and folded it into a new advisory arm called PinnacleOne. Krebs became chief intelligence and public policy officer and Stamos chief trust officer.

On August 1, 2024, SentinelOne named him chief information security officer. "Organizations must be able to trust that their providers are focused on chasing adversaries, not dollars," he said at the time.

Corridor and Cognition

Stamos's next bet was on artificial intelligence. In August 2025 he joined Corridor, a startup that two CISA alumni, Jack Cable and Ashwin Ramaswami, had launched that year to catch security flaws in code as AI agents write it.

Axios reported that he came aboard as chief security officer alongside a $5.4 million funding round. By March 2026 Corridor had raised $25 million more in a round led by Felicis at a $200 million valuation.

Then, on September 29, 2026, Stamos announced he was joining Cognition, the company behind the Devin coding agent, as CISO. In a post explaining the move, he warned that AI-armed ransomware gangs would soon turn Patch Tuesday into "Ransom Wednesday."

He summed up his attitude in one line: "There are real safety and security issues raised by AI, but they can be fixed. It's time to get to work instead of freaking out."

Stanford still lists him as a lecturer in computer science and in its international policy master's program.

Alex Stamos: The Insider Who Says It Out Loud

Very few security executives have made a habit of saying, in public, what the room didn't want to hear. Stamos walked out of Yahoo over a secret surveillance program, left Facebook after clashing over what to disclose and watched the research center he founded get buried in subpoenas. Along the way he put a number on Russia's Facebook ads and a face on the encryption debate.

Today he runs security at Cognition, a company whose AI writes code for a living.

Expect him to keep saying it out loud.