Chris Hadnagy: Social Engineering and a DEF CON Split

Chris Hadnagy made a career out of the oldest hack there is: talking people into things.

Over fifteen years the self-described human hacker built a company around social engineering, wrote the books that trained a generation of penetration testers and created a DEF CON contest in which strangers in a soundproof booth sweet-talk employees of major companies into giving up their secrets.

Then, in 2022, the conference that'd been his stage banned him for life. What followed played out in federal court for three years.

Chris Hadnagy at a Glance

• In 2009 Hadnagy and a small crew launched social-engineer.org, a site devoted to "the art, science and psychology of the Human Operating System."
• In 2010, while working as operations manager at Offensive Security, he ran the first Social Engineering Capture the Flag at DEF CON 18, a contest that drew a call from the FBI before it began.
• By 2011 he'd published Social Engineering: The Art of Human Hacking (Wiley), the first of several books; a rewritten edition, The Science of Human Hacking, followed in 2018 and Human Hacking in 2021.
• His company, Social-Engineer LLC, sells social engineering penetration tests and training, and for years he ran the SE Village and its contest at DEF CON.
• In 2017 he founded the Innocent Lives Foundation, a nonprofit that uses open-source intelligence to unmask online child predators and hand cases to police.
• In February 2022 DEF CON permanently banned him for code of conduct violations; he said nobody had told him what he was accused of.
• He sued DEF CON and its founder Jeff Moss for defamation in August 2022. A Pennsylvania judge dismissed the case for lack of jurisdiction in January 2023, and he refiled in Washington state.
• In May 2025 a federal judge dismissed the suit with prejudice, ruling that Hadnagy hadn't shown the statements about him were false.

The Life of Chris Hadnagy

Hadnagy's Human Operating System

Christopher James Hadnagy found his subject in the late 2000s, when social engineering was still a phrase most of the security industry treated as a footnote. By July 2009 he'd launched social-engineer.org, a site that promised to go deep into "the art, science and psychology of the Human Operating System."

The early team page lists him as Chris "loganWHD" Hadnagy, Chief Human Hacker, alongside Michele Fincher, a former US Air Force Academy professor, and David Kennedy, the TrustedSec founder who built the Social-Engineer Toolkit and supplied "comedic relief" on the group's podcast.

The site published a framework describing how social engineers actually operate, and the podcast became a fixture of the industry.

The Contest That Made the FBI Call

In 2010 Hadnagy, then operations manager at the training firm Offensive Security, brought something new to DEF CON: a Social Engineering Capture the Flag. Contestants would sit in a soundproof booth and spend 20 minutes on the phone with employees of roughly 30 American companies, extracting harmless details like who hauled the dumpsters and who shredded the paper.

Passwords and sensitive data were off limits, and so were banks, hospitals, schools and governments. "We thought 'How can we showcase social engineering skills and not go over that line of what is ethical and moral?'" Hadnagy told CSO.

The idea still rattled people. Before the contest began, the FBI's cyber division called the organizers to ask what they were really up to. After reading the rules, the agents were satisfied, and the winner got an iPad.

Writing the Handbook

The contest gave Hadnagy a platform, and his first book gave him a field. Social Engineering: The Art of Human Hacking, published by Wiley, laid out pretexting, elicitation and influence as teachable skills rather than con-man tricks, and became a standard text for penetration testers.

Two more Wiley titles followed: Unmasking the Social Engineer: The Human Element of Security in 2014 and Phishing Dark Waters, written with Michele Fincher, in 2015.

He rewrote it as Social Engineering: The Science of Human Hacking in 2018 and, with co-author Seth Schulman, turned the same ideas toward everyday life in Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You, published by HarperCollins in 2021.

The Village Years

Through the 2010s Social-Engineer LLC grew into a consultancy selling social engineering penetration tests, vishing and phishing simulations and training. At DEF CON the contest grew into the SE Village, and Hadnagy's own talks drew crowds: "7 Jedi Mind Tricks: Influence Your Target Without a Word" in 2016, and a 2017 talk on using social engineering against predators that hinted at where he was headed next.

By 2015 he'd run the contest for five straight years, and he was careful about whom it embarrassed. "Nobody gets embarrassed," he told the Christian Science Monitor. "If Jane answered the phone, we didn't get Jane's personal info, or her credit card number."

The point, he argued, was the companies, not the people. "This is not about stupidity. This is about opportunity, and the [attack] vectors getting better."

The Innocent Lives Foundation

In 2017 Hadnagy founded the Innocent Lives Foundation, a nonprofit that hires researchers to comb the open and dark web for people who produce or trade child sexual abuse material and hands what it finds to law enforcement.

"We use open-source skills to find people on the dark web, and the open web, that are hurting kids around the globe," he told WGCU in December 2024. By then the foundation had turned over 554 cases to authorities, about 70 percent of them in the United States, and Hadnagy served as its unpaid chief executive.

Banned From DEF CON

On February 10, 2022, DEF CON's transparency report delivered a blow. "We received multiple CoC violation reports about a DEF CON Village leader, Chris Hadnagy of the SE Village," it read. "After conversations with the reporting parties and Chris, we are confident the severity of the transgressions merits a ban from DEF CON."

Hadnagy said he'd been given neither the accusations nor the evidence. "I can say with 100% certainty that no one has ever come to me with accusations of harassment or discrimination -- not a single person," he wrote. Black Hat removed him from its review board after its own investigation, and his unannounced appearance at BSides Cleveland that June drew criticism of the organizers.

Hadnagy v. Moss

In August 2022 Hadnagy sued DEF CON and Jeff Moss for defamation in federal court in Pennsylvania. Judge Wendy Beetlestone dismissed the case in January 2023 for lack of personal jurisdiction, and Hadnagy refiled in the Western District of Washington, noting that a jurisdiction dismissal "is not uncommon for cases based on online communications."

The Washington court dismissed six of his seven claims in March 2024 but let the defamation claim proceed. Filings made public in February 2025 contained allegations from former colleagues describing angry outbursts and harassment of female coworkers, which Hadnagy disputed.

On May 13, 2025, Magistrate Judge Brian Tsuchida dismissed the suit with prejudice. Truth is a complete defense to defamation, and Hadnagy, who bore the burden of proof, hadn't shown the statements were false.

DEF CON thanked "everyone who came forward to help keep our community safe." Hadnagy called the dispute "a workplace conflict that escalated far beyond what anyone intended."

Chris Hadnagy: The Human Element

Hadnagy's great insight was that the softest part of any system is the person holding the phone, and that the fix is training rather than shame. That idea now sits inside every security awareness program on earth.

He still runs Social-Engineer LLC, still leads the Innocent Lives Foundation from Orlando and still teaches the craft, though no longer at the conference that made him famous.

The human hacker taught the world that trust can be engineered. His own story is a reminder that it can also be lost.