Chris Wysopal: From L0pht's Senate Warning to Veracode

On the morning of May 19, 1998, seven men took their seats in room 342 of the Dirksen Senate Office Building. The witness list didn't give their names. It read Brian Oblivion, Kingpin, Mudge, Space Rogue, Stefan Von Neumann, Tan and Weld Pond.

They were the L0pht, a Boston hacker collective with day jobs, and they'd come to tell the Senate that the internet was a house of cards. Weld Pond was Chris Wysopal, and the warning he helped deliver that day has shaped his entire career.

He spent the next quarter century trying to make it less true, first by finding the holes himself and then by building a company that'd find them for everyone else. The company sold for hundreds of millions of dollars. The warning, he says, still stands.

Chris Wysopal at a Glance

• A Rensselaer Polytechnic Institute graduate in computer and systems engineering, Wysopal spent the 1990s as one of the original vulnerability researchers at the L0pht, a Boston "hacker think tank," under the handle Weld Pond.
• On May 19, 1998 the L0pht testified to the Senate Governmental Affairs Committee under their handles, the first witnesses outside witness protection to do so; Mudge's line that they could take the internet down in 30 minutes made headlines.
• The L0pht became the consultancy @stake, where Wysopal rose to vice president of research and development and was part of the "dream team" sent to Microsoft; Symantec later bought the firm.
• He helped write the industry's responsible-disclosure guidelines and in 2006 co-wrote The Art of Software Security Testing.
• In 2006 he co-founded Veracode, the Massachusetts application-security company, and was its longtime chief technology officer.
• CA Technologies bought Veracode for $614 million in cash in March 2017; Broadcom, after buying CA, sold it to Thoma Bravo for $950 million in 2018, and TA Associates took a majority stake in 2022.
• In August 2024 he handed the CTO job to Jens Wessling and became Veracode's founder and chief security evangelist.
• He still writes and speaks about software security, lately warning that AI-generated code could unleash a "tidal wave" of vulnerable software.

The Life of Chris Wysopal

Weld Pond

Chris Wysopal came out of Rensselaer Polytechnic Institute with a bachelor's degree in computer and systems engineering and, by the 1990s, a second identity. As Weld Pond he was one of the original vulnerability researchers at the L0pht, the Boston loft where a handful of hackers took apart commercial software and published what they found.

The group called itself a hacker think tank, and its members kept their real names to themselves for a practical reason: they had day jobs, and feared their employers would fire them over their after-hours hacking. Wysopal, in Veracode's telling, "was one of the first to publicize the risks of insecure software," at a time when vendors preferred that such risks stay quiet.

Seven Hackers Go to Washington

The Senate Governmental Affairs Committee, chaired by Fred Thompson, called the hearing "Weak Computer Security in Government: Is the Public at Risk?" and scheduled it for 10 a.m. on May 19, 1998. The agenda listed seven witnesses from "L0pht Heavy Industries," each by handle.

It was, as CyberScoop later put it, the first time anyone outside a federal witness protection program had gone before Congress under a pseudonym. The hackers explained, in plain language, how fragile the networks the government depended on really were. Mudge, Peiter Zatko, delivered the line that followed them for decades: they could take down the internet in about 30 minutes.

Wysopal sat third from the right in the famous photograph of the seven. "Nobody listened," as The Washington Post later summed up the aftermath.

The @stake Dream Team

The L0pht did what many hacker crews of the era did: it became a company. Folded into the consultancy @stake, its members found themselves selling the skills they'd honed for fun. Wysopal became vice president of research and development.

One of @stake's most important customers was Microsoft, then the biggest software maker in the world. Wysopal recalled that whenever Redmond called, the response inside @stake was "let's send in the dream team," a group that included Window Snyder, who'd go on to lead security at Mozilla and Fastly.

"Back then, I feel like we were both learning how to take our interest in hacking and sort of adversarial ways of looking at things, and professionalizing that as pen testers and threat modelers," he said. Symantec eventually acquired @stake, and Wysopal turned to a new question: how do you find the flaws before software ships, at scale?

Founding Veracode

His answer, in 2006, was Veracode, which he co-founded and served as chief technology officer. The pitch was application security as a service: upload your software, get back a list of the vulnerabilities an attacker would find, without hiring a room full of Weld Ponds.

The same year he co-wrote The Art of Software Security Testing with Lucas Nelson, Dino Dai Zovi and Elfriede Dustin. He'd also been instrumental in developing the industry's guidelines for responsible disclosure, which turned the hacker habit of publishing first into a process vendors could live with.

Veracode grew quietly for a decade, and in early 2017 Cloudflare chose it to audit its code after a high-profile data leak.

The $614 Million Hacker

On March 6, 2017 CA Technologies announced a deal for Veracode worth $614 million in cash. CyberScoop's headline summed up the arc: "Once hacker punks with day jobs, Veracode sells to CA Technologies for $614 million."

The ownership didn't settle there. Broadcom bought CA the following year and, on completing the deal in November 2018, sold Veracode to the private-equity firm Thoma Bravo for $950 million.

In March 2022 TA Associates took a majority stake. Wysopal stayed CTO through all of it.

Twenty Years Later

In June 2018, two decades after the Senate hearing, The Register's headline on its interview with Wysopal read: "Internet security hasn't improved in 20 years." He'd become, as the paper put it, a "'90s hacker collective man turned infosec VIP," and he wasn't inclined to declare victory.

MIT Technology Review wrote in 2019 that he "has worked for decades to demand secure technologies from influential tech companies," which is a polite way of describing a man who's been telling the same people the same thing since 1998.

Chief Security Evangelist

On August 28, 2024 Veracode announced that Wysopal would become its founder and chief security evangelist, promoting Jens Wessling to chief technology officer. The new job is the old job minus the engineering org chart: industry presence, security advocacy, customers and peers.

His current warning concerns AI. In 2024 he predicted a "tidal wave" of vulnerable software from AI-generated code, and Veracode's 2026 State of Software Security report found four out of five organizations drowning in security debt.

Over the years he's also kept up the L0pht's tradition of speaking to power, testifying to Congress on government security and on how vulnerabilities are discovered in software.

Away from the keyboard he photographs and hikes the conservation trails near his home outside Boston.

Chris Wysopal: The Warning Still Stands

The L0pht's 1998 testimony is remembered as a prophecy. Wysopal's career is what it looks like when one of the prophets decides to do something about it: professionalize the craft, write the disclosure rules, build the scanner and then spend 20 years explaining why the problem keeps growing anyway.

He's still at Veracode, still giving interviews and still, in 2026, telling anyone who'll listen that the software isn't as safe as they think.

Seven hackers walked into the Senate in 1998. One of them never really left the witness table.