Graham Cluley: From Floppy-Disk Games to Smashing Security

Before Graham Cluley was the voice explaining the latest hack on the BBC, he was a computing student sending out shareware text adventures on floppy disk.

The games had homicidal armchairs, a scheming dentist and a Tetris clone with a boss key that threw up a fake spreadsheet when a lecturer walked in. Then he took a job writing antivirus software, and the jokes moved into his day job.

Three decades later, Cluley is one of the most recognizable people in British security: the programmer behind the first Windows version of Dr Solomon's Anti-Virus Toolkit, a Sophos veteran, a Hall of Famer, the host of the award-winning Smashing Security and a co-founder of The AI Fix. One virus writer disliked him enough to mock him in code.

Graham Cluley at a Glance

• As a computing student at Guildford College of Technology in the late 1980s, Cluley wrote the shareware text adventure Jacaranda Jim; Humbug, Blox and Wibbling Wilf followed.
• In the early 1990s he joined S&S International and programmed the first ever Windows version of Dr Solomon's Anti-Virus Toolkit.
• He joined Sophos in 1999, became its best-known spokesman, and helped establish its Naked Security blog, writing more than 2,500 articles before leaving in June 2013 to go independent.
• His blunt descriptions of virus writers drew a running feud with the Belgian virus writer Gigabyte, who wrote code mocking him; Belgian police arrested a suspect in 2004.
• Infosecurity Europe inducted him into its Hall of Fame in 2011.
• In 2016 he launched the Smashing Security podcast with Carole Theriault; it's won best cybersecurity podcast awards in 2018, 2019, 2022, 2023 and 2024.
• In April 2024 he co-founded a second show, The AI Fix, with Mark Stockley, which reached 100 episodes in May 2026.
• Today he's an independent keynote speaker who's given more than 300 talks across six continents, and he still writes regularly about security threats, including for Bitdefender.

The Life of Graham Cluley

Jacaranda Jim

Cluley was a computing student at Guildford College of Technology in the late 1980s when he came across a PRIME computer and started writing a game on it in his spare time. The result was Jacaranda Jim, a comic science-fiction text adventure he ported to DOS and sent out as shareware in 1987.

The plot set the tone for everything after it. Jim's cargo ship is attacked by "an army of homicidal beechwood armchairs," and he crash-lands on Ibberspleen IV, where he's rescued by "the mysteriously smug Alan the Gribbley" and has to battle "manic-depressive deckchair attendants."

Humbug and Blox

By the time he reached graduate school in Bristol, Cluley wanted something more polished, so he set up his own label, Humbug Software. Humbug sent young Sidney Widdershins to his grandad's manor for the holidays, where Jasper the dentist is desperate to make Grandad sell and a time machine waits in the cellar. It went out with PC Plus magazine in its February 1991 issue.

Registration cost £9 and bought you the solution to a maze you needed to finish the game. By 1994 he reported at least 2,000 copies sold.

In between came Blox, a Tetris clone he wrote in a couple of days after seeing the original once at a friend's house. It spread through his college's computer labs, helped by a boss key that replaced the game with a fake spreadsheet when a lecturer walked in. In 2009 a Twitter follower found Blox running on an Amstrad PC in the computer museum at Bletchley Park.

Dr Solomon's

Games paid pocket money. Antivirus paid rent. In the early 1990s Cluley joined S&S International, the British company behind Dr Solomon's Anti-Virus Toolkit, and programmed the first ever version of the product for Windows.

For a while his web page described him as an "adventure game author and anti-virus expert." The second job won, and after Dr Solomon's he held senior roles at McAfee and then at Sophos, the Oxfordshire antivirus firm he joined in 1999.

Spotty Teenage Nerds

At Sophos, Cluley became the spokesman the press called when a new worm hit, and he didn't spare the authors. In The Register's memorable summary, he once said they only wrote malicious code because they were spotty teenage nerds who couldn't pull.

One of them took it personally. Gigabyte, a Belgian teenager credited with the first virus written in C#, had what The Register called frequent run-ins with Cluley over his analysis of her peers, and went as far as writing viral code that mocked him.

In February 2004 Belgian police arrested a 19-year-old technology student suspected of being Gigabyte. Gigabyte had always maintained that she wrote worms only for research and never released them herself.

Naked Security

Naked Security began as what Carole Theriault called "an untested approach to corporate comms." She founded the site, and the name came to Cluley, she later wrote, while the two were being body-scanned at Boston's Logan Airport. It went on to publish more than 100 articles a month to 800,000 readers.

Cluley wrote over 2,500 of them. Along the way Infosecurity Europe inducted him into its Hall of Fame in 2011, and in June 2013 he and Theriault announced they were both leaving Sophos. After 14 years at the company, he said he fancied "doing something different," and planned to fill his time writing on grahamcluley.com ("yes, that's a vanity domain name"), speaking, and "generally enjoying being my own boss."

Theriault, he added, had founded the site, managed him in recent years, and been the best man at his wedding.

Going Solo

The vanity domain became his news site, and the speaking became a career. Cluley has now given more than 300 talks across six continents, to audiences including NATO, the RSA Conference, Black Hat and FTSE 100 companies, and has made thousands of appearances on outlets from the BBC and Sky News to NPR and CNN.

He also kept writing for other people's sites, filing a steady stream of stories about ransomware gangs, data breaches and the occasional hacked crosswalk for Bitdefender's blog.

Smashing Security

In 2016 Cluley and Theriault launched Smashing Security, a weekly podcast serving "tales of cybercrime, hacking horror stories, privacy blunders, and tech mishaps." Vanja Švajcer co-hosted 19 episodes in its first two years.

The show won best or most entertaining cybersecurity podcast awards in 2018, 2019, 2022, 2023 and 2024, and new episodes still land every Wednesday evening. By 2026 Cluley had hosted 486 of them. Theriault, after 426 episodes, stepped back from the show in 2025.

The AI Fix

On April 15, 2024, Cluley and Mark Stockley released episode 1 of The AI Fix, titled "AI doesn't exist," a weekly tour of "the bizarre, and sometimes mind-boggling world of artificial intelligence" that went on to win a best new podcast award.

Cluley co-hosted the show for nearly two years and posted its notes on his own site. By the spring of 2026 Stockley was fronting it with a rotating cast of guests, and in May 2026 it reached episode 100 with the question of whether AI will keep us as pets or use us as batteries.

Graham Cluley: Still Wibbling

The student who mailed out Jacaranda Jim as shareware turned out to have found his real talent early: making a dry subject funny enough that people pay attention.

He's still at it from his own domain, still hosting Smashing Security every week, and still writing it up whenever a crosswalk, a football club or a Pentagon database gets hacked.

Gigabyte's viruses are long gone. The games, now free on his site, still run.