Jeremiah Grossman: A Yahoo Mail Flaw Opens a Career

Jeremiah Grossman got his start in security the way a lot of great stories start: with a hobby that got out of hand.

In 1999 he was a Unix administrator at a biotech company who liked to break software in his spare time. One evening he picked Yahoo Mail apart in about 15 minutes, told the company anonymously and braced for trouble. Instead he got a job, a nickname that stuck and a front-row seat at the birth of web application security.

What he did with that seat is the fun part: a company started from Maui with every last dollar, a browser trick that could literally watch you through your webcam, and a decades-long argument that security vendors should put real money behind their promises. In 2025 he finally built a company to prove it.

Jeremiah Grossman at a Glance

• Grossman grew up on Maui, started tinkering with a Commodore 64 around age 10 and pranked online chat users with a high school friend who'd later become his co-founder.
• In 1999 he anonymously hacked Yahoo Mail and reported it. Yahoo sent a T-shirt and a thank-you note, then hired him; his business card read "The Hacker Yahoo."
• He founded WhiteHat Security in 2001, a company Synopsys later credited with helping "pioneer SaaS delivery of application security testing," and co-founded the Web Application Security Consortium.
• With Robert "RSnake" Hansen he put clickjacking on the map in 2008, after Adobe asked them to postpone a conference talk showing how a web page could switch on a visitor's webcam.
• At Black Hat 2013 he and Matt Johansen demonstrated a "Million Browser Botnet" assembled for pennies through online ad networks; that fall WhiteHat shipped Aviator, its own hardened browser.
• He left WhiteHat in 2016 after 15 years, joined SentinelOne as chief of security strategy and became the industry's loudest advocate for security guarantees.
• WhiteHat was bought by NTT Security in 2019 and resold to Synopsys for $330 million in 2022; his next startup, Bit Discovery, went to Tenable the same year for about $44 million.
• In July 2025 he launched Root Evidence in Boise, Idaho, with $12.5 million in seed funding and a vulnerability platform that backs its findings with a warranty.

The Life of Jeremiah Grossman

Grossman's Maui Childhood

Jeremiah Grossman grew up on Maui and graduated from Maui High School. He started tinkering with old machines around age 10: a Commodore 64, a few x286 and x386 boxes, a Power Macintosh 6100.

Long before either of them had a job title, Grossman and his high school pal Lex Arquette amused themselves by injecting code into online chat systems to rename other users, rewrite their messages and occasionally knock their accounts offline. Call it an early, unauthorized form of product testing.

After graduation he left the island for an electronics engineering program at ITT Technical Institute in San Diego, lasted about a year and landed an entry-level Unix job at the biotech company Amgen. The résumé line says Solaris administration. The hobby says otherwise.

The Hacker Yahoo

Just before the summer of 1999, Grossman decided to poke at Yahoo Mail. He later told The Maui News the whole thing, from break-in to proposed fix, took about 15 minutes. He emailed Yahoo anonymously, fully aware that hacking a giant could end badly.

It ended with a T-shirt and a thank-you note from Yahoo co-founder David Filo. "Then they said to let them know if I find anything else," Grossman recalled, "so I took that as permission to hack Yahoo and I found a half-dozen more ways to break in."

A recruiter called. From December 1999 to July 2001 Grossman was the information security officer for Yahoo's engineering department, responsible for more than 10,000 public-facing web servers, with a business card that read "The Hacker Yahoo."

"Everybody has hobbies," he told the paper years later. "Some people play sports, play video games... I break software."

Starting WhiteHat With Every Last Dollar

In 2001 Grossman went home to Maui and founded WhiteHat Security. The idea, as Arquette put it, was to turn their automated hacking software into a service companies could pay for: continuous scanning of live websites for the kinds of holes Grossman had found at Yahoo, sold as a subscription called Sentinel.

He was employee one. When he got too busy, his wife Llana, another Maui High grad, took over the website, marketing and PR, and when he got busier still, Arquette joined.

"We spent every last dollar," Grossman said. None of the three had a college degree.

The timing was brutal: a startup born the year of the September 11 attacks, selling a product many customers didn't know they needed. "In many cases, companies didn't even know they could be hacked," Arquette said. Competing with HP and IBM, Grossman admitted, "there was never a point of smooth sailing."

It worked anyway. WhiteHat raised roughly $52 million over the years and grew into one of the largest professional hacking teams in the business, publicly thanked by Microsoft, Mozilla, Google and Facebook for reporting flaws. Along the way Grossman co-founded the Web Application Security Consortium and co-wrote the 2007 book XSS Attacks with Hansen, Petko Petkov, Anton Rager and Seth Fogie.

The Talk Adobe Asked Them to Cancel

In September 2008 Grossman and Hansen were scheduled to present new research at OWASP's AppSec conference in New York. On short notice, Adobe asked for more time, and they postponed the talk.

The research had a catchy name, clickjacking: trick a user into clicking an invisible page element layered over something harmless. The part Adobe wanted held back was the demo, in which a hidden Adobe Flash dialog let a web page switch on a visitor's webcam and microphone.

On October 7, 2008 the two went public, Grossman with a post titled Clickjacking: Web pages can see and hear you. The word has been in every web developer's vocabulary since, and browsers now carry defenses built specifically to stop it.

A Million-Browser Botnet

Grossman took the stage at TEDxMaui in January 2012 with a talk called "Hack Yourself First," the same advice he gave every customer: find your own holes before someone else does.

At Black Hat 2013 he and Matt Johansen presented "Million Browser Botnet." Online ad networks, they showed, will happily distribute arbitrary JavaScript for pennies per thousand impressions. Spend $10 or $100 and you can quietly recruit an enormous crowd of browsers to hammer a website, with no malware, no zero-day and no patch, because the web is supposed to work that way.

That October WhiteHat released Aviator, a hardened browser built from the open source Chromium code with privacy-first defaults the big vendors wouldn't ship. Grossman's blog post explaining it answered a question he said friends and family kept asking: what browser should my kids use?

Grossman Leaves the Company He Built

Grossman had handed the CEO job to others years earlier, but he stepped back in as interim chief until WhiteHat named Craig Hinkley CEO in April 2015. On March 7, 2016 he announced his last days at the company after 15 years.

That June he joined SentinelOne as chief of security strategy. His pet cause there was a radical one for the industry: guarantees. If a vendor claims to stop ransomware, Grossman argued, it should pay out when it fails, and by his own account he built the first ransomware warranty.

His 2016 Black Hat talk was titled "An Insider's Guide to Cyber-Insurance and Security Guarantees."

WhiteHat, meanwhile, found new owners. NTT Security bought it in March 2019 and renamed it NTT Application Security in 2021; in June 2022 Synopsys bought it from NTT for $330 million in cash.

Bit Discovery and Tenable

Grossman's next company, Bit Discovery, started in 2018 with Hansen and Arquette and a blunt premise: most organizations can't even list what they own on the internet, let alone secure it. The company built an inventory of internet-facing assets, a category the industry now calls external attack surface management.

Tenable closed its acquisition of Bit Discovery on June 6, 2022, paying $44 million in cash net of cash acquired, according to its quarterly filing. Grossman stayed on in a security strategy role, and along the way started Grossman Ventures to invest in other founders' security companies.

Root Evidence

In July 2025 the old band got back together in Boise, Idaho. Grossman is CEO of Root Evidence, Hansen is CTO, Arquette runs product and Heather Konold, who steered both earlier companies through their acquisitions, is COO. The launch came with a $12.5 million oversubscribed seed round led by Ballistic Ventures, with Grossman Ventures chipping in.

The pitch is the same argument Grossman has been making for a decade. Security teams drown in hundreds of thousands of CVEs, yet the company's 2026 research found that only about 1.4% of vulnerabilities are known to be exploited in real attacks. Its Evidence Platform, launched in July 2026, scans for the flaws that insurance claims and forensics show actually cause losses, and backs its findings with a warranty of up to $5 million.

In August 2026 Grossman and Hansen published a book, The End of Guessing, and the following month Root Evidence released "The Vulnpocalypse Report," which set 253,912 CVEs against 3,769 confirmed exploitations to argue that the AI-driven exploit apocalypse isn't showing up in the data.

Jeremiah Grossman: Put Your Money Where Your Scanner Is

Grossman's career is a 25-year argument that security should be measured in outcomes, not activity. Hack yourself first, count the flaws that matter, and if you sell protection, stake your own money on it.

Today he runs Boise-based Root Evidence, still trains as a Brazilian jiu-jitsu black belt, and by his own count has given more than 400 talks on six continents and more Black Hat briefings than anyone else. His YouTube channel even carries footage of Brazilian jiu-jitsu "smackdowns" at Black Hat.

Not bad for a kid who, one night in 1999, just wanted to see whether he could break into Yahoo Mail.