Georgia Weidman: Hacking Phones and Teaching Pentesters

Ask a room of penetration testers which book first made the Metasploit console make sense, and a good share of them will name the same one: Georgia Weidman's Penetration Testing: A Hands-On Introduction to Hacking.

Weidman is a researcher, trainer and serial founder who turned a DARPA grant into an open-source toolkit for hacking phones, built two companies around mobile security and taught at Black Hat, Brucon and CanSecWest.

Her favorite question was always the oldest one in security: who watches the watchers? She spent years testing the vendors' claims from the outside. Then one of them hired her.

Georgia Weidman at a Glance

• Weidman holds a master's degree in computer science along with CISSP, CEH and OSCP certifications.
• Her early research into smartphone exploitation was featured internationally in print and on television, including TV interviews at Hacker Halted in 2011.
• A DARPA Cyber Fast Track grant funded her Smartphone Pentest Framework, an open-source tool for testing mobile devices built in 2011 and 2012.
• She founded Bulb Security LLC, a consultancy for penetration testing, training and research, and taught classes at Black Hat USA, Brucon and CanSecWest.
• Her book Penetration Testing: A Hands-On Introduction to Hacking (No Starch Press, June 2014) became a standard starting point for the field.
• In 2015 she founded Shevirah to productize mobile risk testing, graduated from the Mach37 accelerator in Virginia and won the Women's Society of Cyberjutsu's Pentest Ninja award.
• In spring 2023 she joined Zimperium, a mobile security vendor she'd spent years testing from the outside.
• In 2026 she launched a candid YouTube series, Open Tabs: Unfiltered with Georgia, while working on a new edition of her book.

The Life of Georgia Weidman

Weidman's Early Research

Georgia Weidman arrived in the security world with a master's degree in computer science and a stack of certifications: CISSP, CEH and the hands-on OSCP from Offensive Security.

What set her apart was her target. While most researchers were still focused on servers and desktops, she went after smartphones, and her work on smartphone exploitation was soon being featured in print and on television around the world. At Hacker Halted in 2011 a local Fox crew put her on air to explain it.

The DARPA Grant

In 2011 the Pentagon's research agency, DARPA, was running Cyber Fast Track, a program that handed small, quick grants to independent hackers rather than big contractors. Weidman won one to continue her work on mobile device security.

The result, built in 2011 and 2012, was the Smartphone Pentest Framework, or SPF: an open-source tool that let penetration testers do to phones what Metasploit had long done to computers, assessing devices, delivering payloads and measuring what an attacker could reach.

It made her name in a niche that was about to become everybody's problem, as companies let employees bring their own devices onto corporate networks.

Bulb Security

Weidman founded Bulb Security LLC, a consultancy built around three things she was already doing: security assessments and penetration testing, training and research and development.

The training side took her around the world. She taught classes at Black Hat USA, Brucon in Belgium and CanSecWest in Vancouver, and spoke at conferences including ShmooCon and DerbyCon. Students in the Netherlands and Maryland left testimonials about an instructor who "knows what she preaches."

She also sat on the advisory boards of the security training start-up Cybrary and the nonprofit Digital Citizens Alliance.

Writing the Book Everyone Starts With

In June 2014 No Starch Press published Penetration Testing: A Hands-On Introduction to Hacking, 528 pages that walk a beginner from setting up a lab through information gathering, exploitation, password attacks, web application testing and, naturally, mobile hacking.

The book's trick was that it never assumed the reader already knew. Every tool was installed, every command typed out, every result explained, and it became the volume countless newcomers used to study for their first certification or land their first job.

More than a decade later, No Starch notes that Weidman is working on a new version.

Shevirah and Dagah

In 2015 Weidman founded Shevirah Inc. to turn her mobile testing work into a product. The company's patent-pending Dagah software lets organizations test mobile risk across users, devices, applications and infrastructure, and check whether their enterprise mobility management tools actually stop anything.

Shevirah was one of five start-ups chosen that year for Mach37, the Northern Virginia cybersecurity accelerator, and Weidman graduated from the program. The same year the Women's Society of Cyberjutsu gave her its Pentest Ninja award.

The company set up in Ashburn, Virginia, in the data center corridor outside Washington, offering penetration testing, awareness training and mobile pentest courses led by Weidman herself.

Who Watches the Watchers

For years Weidman's consulting work included "bake-offs" for Fortune 500 companies: head-to-head tests of mobile security products to see whether they caught what the vendors said they caught. Her marketing borrowed a Latin tag, "Quis custodiet ipsos custodes?", who watches the watchers, to describe the gap between claims and performance.

In spring 2023 one of the watched hired the watcher. What began as consulting conversations with the mobile security vendor Zimperium turned into a full-time job, the company announced that July.

It was a natural fit for someone whose whole career had been spent asking whether mobile threat detection actually detected anything.

Weidman Today

Weidman's voice has always been part of her appeal: direct, funny and allergic to hype. In 2020 she gave the keynote at HackerOne's h@cktivitycon, and in 2026 she started a YouTube series, Open Tabs: Unfiltered with Georgia, with candid episodes about the awkward and painful moments of a career in security, including a job she didn't get and a shirt that, as she tells it, once ruined one.

The second edition of the book everyone starts with is still in the works.

Georgia Weidman: Hands-On

Weidman's career is a reminder that the people who teach a field often shape it more than the people who merely practice it.

She hacked phones before it was fashionable, wrote the book that got thousands of people their first shell, and kept asking vendors to back up their security claims.

Who watches the watchers? For a long time, the answer was her.