Dave Kennedy: From Marine Intelligence to the Social-Engineer Toolkit

Dave Kennedy breaks into companies for a living, and he usually walks in through the front door. On one job he walked back out with two iPads and a cash register.

He wrote the Social-Engineer Toolkit, the open-source program that turned phishing emails and fake login pages into a menu, then built two security companies from a basement in Ohio. He co-founded DerbyCon, co-wrote the standard book on Metasploit and told Congress that Healthcare.gov had skipped basic security.

The writers of Mr. Robot even slipped his name into a scene. But before any of that, Kennedy was a kid who nearly failed high school, and a Marine who came home from Iraq with a promise to keep.

Dave Kennedy at a Glance

• Kennedy grew up moving between Ohio towns and nearly failed high school, but found a home in text-based online games, where he taught himself C under the handle ReL1K.
• After graduating from Bedford High School in 2000, he joined the Marine Corps, scored his way into military intelligence and deployed twice to Iraq, with cyber-warfare work at Fort Meade along the way.
• At 27 he became chief security officer of Diebold, the Ohio ATM maker, running a global security program for a Fortune 1000 company.
• By 2010 he'd written the Social-Engineer Toolkit, which "just blew up" and became a standard tool in Kali Linux; in 2011 he co-wrote Metasploit: The Penetration Tester's Guide.
• With Martin Bos, Adrian Crenshaw and Alex Kah he launched DerbyCon in Louisville in 2011; it ran for nine years and raised more than $700,000 for charity.
• In 2012 he left Diebold to start TrustedSec from his basement, and in 2014 he co-founded Binary Defense, a round-the-clock managed security provider.
• On November 19, 2013, he told the House Science Committee that Healthcare.gov lacked even basic security, and returned in January 2014 to report that only one of his 18 findings had been fixed.
• He consulted on Mr. Robot, which used "Dave Kennedy" as Elliot's fake name in a social-engineering scene, and today runs TrustedSec as CEO while serving as Binary Defense's chief hacking officer.

The Life of Dave Kennedy

Kennedy's Early Years

Kennedy's family moved a lot: Willowick, Wickliffe, Perrysburg, Lyndhurst, Bedford. New towns meant new schools and not many lasting friendships.

School itself was a struggle. He has ADHD, and he's said he simply can't learn from books. He nearly failed out of high school and only graduated from Bedford High in 2000 after summer school.

Computers were different. His first teardown was his Teddy Ruxpin, taken apart to see how the talking bear worked, and by his teens he'd found MUDs, the text-based multiplayer games that came before World of Warcraft.

"I found my home on computers," he told SecurityWeek years later. He rose to moderator and admin on the bigger MUDs, started coding expansions for them and picked up C programming along the way, under the handle ReL1K.

From MUDs to Military Intelligence

College was never the plan. Kennedy took the ASVAB, the military's aptitude test, and scored high enough in the intelligence, cryptography and computer sections to pick his own job in the Marine Corps.

He chose military intelligence. Over five years in the Marines he held a top-secret clearance, deployed twice to Iraq and spent time attached to special forces units, gathering intelligence that helped disrupt the triggers on roadside bombs. He also worked at Fort Meade, alongside the NSA, on cyber-warfare operations.

Iraq nearly killed him. Kennedy has described a close call that left him determined to use what he knew to make the world a better place. He still calls joining the Marines "one of the best decisions I ever made."

The Youngest VP at Diebold

Back in civilian life, Kennedy worked for a Cleveland consulting firm as a penetration tester, breaking into clients' networks with permission. Then came Diebold, the Ohio-based ATM maker, a Fortune 1000 company with operations in more than 80 countries.

Diebold made him its chief security officer at 27, one of the youngest vice presidents in the company's history. He built a global security program and managed a staff of 55.

But Kennedy kept hacking on the side. He'd already written Fast-Track, a tool that automated chunks of a penetration test, and had contributed modules and exploits to the Metasploit Framework. His next project would be bigger.

Two Months That Blew Up

While pentesting, Kennedy and his friend Chris Hadnagy noticed that attackers were shifting from breaking software to tricking people, and almost nobody tested for it. "No one was doing it as part of their pen testing," Kennedy said.

So he spent about two months writing a tool that did. The Social-Engineer Toolkit, or SET, gave testers a menu of human-focused attacks: spear-phishing emails carrying booby-trapped PDFs, cloned websites that harvest passwords, infected USB sticks, even tiny Teensy boards that type commands the moment they're plugged in.

"When it became available, it just blew up," Kennedy recalled. Version 1.0 landed in November 2010, and within two years the 1,000-line script had grown to roughly 300,000 lines. Today SET ships with Kali Linux and lives on GitHub as a TrustedSec project.

In July 2011, No Starch Press published Metasploit: The Penetration Tester's Guide, which Kennedy co-wrote with Jim O'Gorman, Devon Kearns and Kali creator Mati Aharoni. It became the standard introduction to the framework, and a second edition arrived in December 2024. Kennedy also helped found the Penetration Testing Execution Standard, a guide to how a pentest should be run.

A Hacker Con in Horse Country

The same year the book came out, Kennedy, Martin Bos, Adrian Crenshaw and Alex Kah launched a conference of their own. DerbyCon 1.0 ran from September 30 to October 2, 2011, at the Hyatt Regency in Louisville, Kentucky, and Kennedy shared the stage with Kevin Mitnick for a talk on adaptive penetration testing.

DerbyCon became one of the best-loved hacker cons in the United States, and over nine years its attendees gave more than $700,000 to charity.

Kennedy shut it down on his own terms. Announcing that DerbyCon 9, in September 2019, would be the last, he said the con had "got too big" and that a small group of people had created a "toxic environment" that was wearing the organizers out. He wanted it to end the way it started: on positivity, knowledge sharing and charity.

Starting Over in the Basement

In 2012, Kennedy walked away from a comfortable executive job at Diebold and started TrustedSec in the basement of his house, with newborn twins upstairs.

TrustedSec sells what Kennedy does best: attack simulations, red teaming and consulting. He figured it might reach 30 employees. It blew past that and now works from a 40,000-square-foot headquarters in Fairlawn, Ohio.

Once TrustedSec had about a dozen people, Kennedy started a second company. Binary Defense, announced in September 2014 and co-founded with Mike Valentine, was a round-the-clock security operations center "built by hackers and secured by hackers," watching clients' networks for intrusions. In November 2022 it raised $36 million from Invictus Growth Partners, and Kennedy serves as its chief hacking officer.

Kennedy Goes to Washington

In the fall of 2013, Healthcare.gov launched and promptly fell over. Kennedy's firm examined the site from the outside and didn't like what it saw.

On November 19, 2013, he sat before the House Committee on Science, Space and Technology and told lawmakers there were "clear indicators that even basic security was not built into the HealthCare.gov website." He gave a live demonstration of how an attacker could use information exposed by the site to go after the people who'd signed up.

Kennedy stressed that the testimony was about security, not politics, and that his firm had reported its findings through responsible disclosure, holding back the worst ones because they were still exploitable. He was back in January 2014 with an update: of the 18 issues he'd reported, only one had been fixed, and he'd already found a way around the fix.

The Name in Mr. Robot

Kennedy's tools had been showing up in films and TV for years, and when USA Network made Mr. Robot, he helped the show get its hacking right.

The writers returned the favor. In one scene, Elliot slips into a meeting he has no business attending and introduces himself as "Dave Kennedy." Social engineers everywhere got the joke.

Television kept calling. Kennedy has explained breaches and ransomware on CNN, CNBC, Fox News and the BBC, and he keynoted Microsoft's BlueHat in 2016 with a talk called "The Security Monty Python and the Holy Grail."

Kennedy Today

Kennedy still runs TrustedSec as CEO and still writes code, keeping SET current for the latest Python releases and turning up on CNBC whenever a geopolitical crisis raises the odds of a cyberattack.

He's also gone home. TrustedSec funded a gaming and career center at Bedford High School that bears his name, and in October 2023 it pledged $115,000 to launch a cybersecurity program there, only the second at an Ohio high school.

In a February 2025 interview he said he'd never once been tempted to use his skills for personal gain: "Never. Not once. Not even a little bit." He calls his ADHD his superpower.

Dave Kennedy: Hacking the Human Layer

Most of the famous names in this field broke into things they shouldn't have. Kennedy's story runs the other way: a Marine who came home and decided the best use of his skills was breaking into companies that asked him to.

His toolkit made the point that the easiest way into a network is usually a person, and the industry built a whole discipline around testing for it. His conference proved that hackers could raise hundreds of thousands of dollars for charity while they were at it.

And if someone walks into your next meeting and introduces himself as Dave Kennedy, check his badge.