Steve Gibson: From SpinRite to Security Now!

Every week for more than two decades, Steve Gibson has sat down with Leo Laporte to explain the week's security news to anyone who'll listen. The show is called Security Now!, and in September 2026 it reached episode 1,098.

That'd be a career on its own. For Gibson it's a late chapter. He was writing software at Stanford's artificial intelligence lab at 15, built a light pen for the Apple II in the early 1980s, and wrote SpinRite, a hard-drive repair tool that first shipped in 1988 and is still for sale today.

Along the way he launched ShieldsUP, a free online firewall test, wrote what's credited as the first anti-spyware program, and got knocked off the internet for 17 hours by a 13-year-old. He went looking for the kid.

Steve Gibson at a Glance

• Born in 1955, Gibson was taking apart everything in reach as a child and working on timesharing systems by 13. From 15 to 17 he worked at Stanford's AI lab, then studied electrical engineering and computer science at Berkeley.
• In 1981 he founded Gibson Laboratories, maker of the Light Pen System for the Apple II, which he sold to Atari when the home computer market softened.
• He founded Gibson Research Corporation in 1985, wrote InfoWorld's weekly TechTalk column from 1986 to 1993, and released SpinRite in 1988.
• By 1999 his ShieldsUP service was probing visitors' PCs for open ports, and after finding adware on his own PC that year he wrote OptOut, credited as the first anti-spyware program and downloaded more than 2.5 million times.
• In May 2001 a 13-year-old calling himself Wicked took grc.com offline with a denial-of-service attack. Gibson tracked him down and published the whole story.
• Security Now! debuted on August 18, 2005. In 2006 Gibson used it to argue that a Windows flaw was a deliberate backdoor, and Mark Russinovich, soon to join Microsoft, publicly took the theory apart.
• In 2013 he proposed SQRL, a password replacement, and over the years shipped free tools like Never10, InSpectre and ValiDrive.
• SpinRite 6.1 arrived in 2024, the same year Security Now! hit episode 1,000. Gibson is still recording every week.

The Life of Steve Gibson

The Kid at the AI Lab

Gibson was born in 1955. "My parents say I spent most of my time walking around and disassembling everything within reach," he writes on his company's site, and the habit turned into a career unusually early.

His résumé lists a job designing timesharing systems at 13, and from 1970 to 1972, between the ages of 15 and 17, he was employed by Stanford University's Artificial Intelligence Laboratory, working on speech recognition and image processing alongside graduate students.

He went on to study electrical engineering and computer sciences at the University of California, Berkeley, with a 4.0 average. By 20 he was a vice president at a minicomputer company doing more than $2 million a year in sales.

The Light Pen

In 1981 Gibson founded Gibson Laboratories to build the LPS II, a high-resolution light pen that let Apple II users point and draw directly on the screen.

The company grew entirely from its own profits and, by his account, "attained a high profile as a leading designer and producer in the personal computer industry." When the low-end computer market softened, he sold the company and all its products to Atari.

After management changes at Atari, Gibson recovered the rights and designed a successor, the Gibson Light Pen for Apple II, under contract to Koala Technologies.

SpinRite and the Column

Gibson Research Corporation, GRC, was founded in 1985. The next year Gibson began writing TechTalk, a weekly column in InfoWorld, and kept it up for eight years.

In 1988 he released SpinRite, which he still calls his "MS-DOS programming masterpiece." The program works through a drive sector by sector to verify, recover and refresh what's stored there, and because drives cost thousands of dollars then, it was designed to recover data in place, since there was nowhere else to put it.

It never went away. SpinRite 6.0 was finished in the early 2000s, and in 2024 Gibson shipped SpinRite 6.1, still a DOS program that boots from a USB stick, now with support for solid-state drives. It sells for $89.

ShieldsUP and OptOut

As home PCs went online, Gibson noticed he could check whether visitors had left Windows file and printer sharing exposed to the internet. The result was ShieldsUP, a free service that "benignly probes the target computer at your location" and reports what an attacker would see. The Internet Archive first captured it in October 1999.

That same year he found advertising software quietly phoning home from his own computer. According to a history published by Lavasoft, the maker of Ad-Aware, he responded by writing OptOut, "the first ever anti-spyware program."

OptOut was downloaded more than 2,544,000 times. Gibson's definition of spyware was blunt: any software that uses your internet connection in the background without your knowledge and explicit permission "is guilty of information theft."

Wicked

On the evening of May 4, 2001, grc.com disappeared from the internet for 17 hours. Someone was flooding the site with bogus requests from a network of hijacked PCs, and the attacks kept coming for two weeks.

The FBI couldn't help, so Gibson helped himself. On May 15 a message appeared on one of GRC's newsgroups: "Hi, it's me wicked, im the one nailing the server with udp and icmp packets ... btw im 13 ... we are better than you, plain and simple."

Gibson wrote back politely and invited the attacker to talk. As the Guardian reported, Wicked turned out to be a teenager from Kenosha, Wisconsin, and Gibson's account of infiltrating his world gave the public its first close look at script kiddies. "Nothing more than the whim of a 13-year-old hacker is required to knock any user, site or server right off the internet," he wrote.

Security Now!

On August 18, 2005, Leo Laporte introduced "a brand-new podcast to the TWiT lineup, Security Now! with Steve Gibson." Episode 1 was called "As the Worm Turns." Laporte had first noticed Gibson years earlier over the Click of Death, the Iomega Zip drive failure Gibson investigated.

The show found trouble fast. In episode 22, in January 2006, Gibson argued that the Windows Metafile vulnerability then making headlines was no accident. "This was not a mistake. This is not buggy code. This was put into Windows by someone," he said.

Mark Russinovich, the Winternals co-founder who'd join Microsoft that summer, analyzed Gibson's own test program and published a rebuttal. "I'm convinced that this behavior, while intentional, is not a secret backdoor," he wrote, calling it poor design rather than subterfuge.

Free Tools and SQRL

Gibson kept shipping small, free utilities. In 2013 he unveiled SQRL, "Secure Quick Reliable Login," on episode 424 as a practical replacement for usernames and passwords, and clients for it now exist for Windows, Linux, macOS, Android, iOS and the major browsers.

In March 2016 came Never10, a tiny app that stopped Microsoft from pushing Windows 10 onto PCs whose owners didn't want it. In January 2018, within weeks of the Meltdown and Spectre disclosures, he released InSpectre, a 122-kilobyte program that checked whether a PC was patched and how much speed the patches cost.

In 2023 he bought a dozen USB drives on Amazon and wrote ValiDrive to test whether flash drives actually hold the capacity they claim. He's also, by his own admission on the show, happy to be driving a 19-year-old car.

One Thousand

On November 12, 2024, Security Now! reached episode 1,000, titled simply "One Thousand." The listener mailbag that week included a note that captured the mood: "Congratulations on reaching 999 and thank you for going past it."

Gibson is still at it. Episode 1,098 aired on September 29, 2026, and recent shows have dug into AI agents, AI-generated code and a leak of 153 million driver's licenses, with TWiT posting a new episode every Tuesday.

Steve Gibson: The Last DOS Programmer Standing

Gibson's story is a reminder that security didn't start with the cloud. One man with an assembler and a website spent the 1990s and 2000s teaching home users what a port was, why spyware mattered and how a 13-year-old could take down a server.

He still writes code the old way, still sells the program he wrote in 1988, and still explains the news every week to an audience that's grown old alongside him.

Listeners expected him to stop at 999. He didn't.