Ted Harrington has spent more than a decade leading people who are paid to break things, and his conclusion is that the skill was never really about computers.
“And how I arrived at the title Inner Hacker is that I believe there’s a hacker inside everyone. And my job with that book is to help the reader find and then unleash their own inner hacker that already exists with inside them.”
Ted Harrington, at 1:06
Ted is the executive partner at Independent Security Evaluators, or ISE, the Baltimore firm of ethical hackers that Steve Bono founded in 2005 and Ted joined in February 2012 (ISE, LinkedIn). ISE grew out of an academic team doing security research, and it was the first, or among a small group of pioneers, to find exploits in medical devices, IoT devices, cars, phones, password managers and blockchain (ISE). Its clients include Google, Amazon and Netflix, and Ted has been featured in more than 100 media outlets, The Wall Street Journal, the Financial Times and Forbes among them (tedharrington.com). He co-founded IoT Village, the traveling hacking event whose contest has won the DEF CON Black Badge four times, and Start, a vendor risk management platform. He wrote Hackable: How to Do Application Security Right, which led to his TEDxFrankfurt talk, and a few months after we recorded this he published a second book, Inner Hacker: A New Way of Thinking (Amazon). He also hosts a podcast of his own, Tech Done Different.
We recorded this in 2025, when Ted expected Inner Hacker that summer, and it aired on October 21, 2025. Where we sit, so you can weigh what follows: YSecurity is in the same line of work as ISE, testing systems the way an attacker would, so I listened to Ted as a peer as much as a host. I opened with the question we ask ourselves on every engagement: what is the hacker actually doing differently?
“Is that about the inner journey of your hacking things and what is the internal motivation behind just breaking stuff?”
Jon McLachlan, at 0:40
His answer started with who the book is for. “What the book is about, it’s for everyone, for anyone, not just security professionals, but it teaches the hacker mindset.” Then the claim the whole conversation hangs on: “Because I think the hacker mindset is a superpower and I think it helps you find new ways, overlooked ways, to accomplish whatever you’re trying to accomplish.”
From event logistics to ethical hacking
Ted came to security from business, not the other way around, and it shows in how he talks about it. His LinkedIn lists a run of companies before ISE (LinkedIn). From 2001 to 2005 he founded and ran W.Harrington Ventures in Washington, D.C., a logistics platform for the entertainment events business with a mostly college-student customer base. From 2006 to 2012 he was a director and senior strategy executive at Wolfpack, a privately held manufacturer in Vista, California. Along the way he was president of y|GEN, a volunteer organization for young leaders in the building industry. In 2011 he became chief executive of NMG Technologies, a seed-stage water conservation startup whose patented technology cut irrigation water use, and which made it to the semi-finals of Shark Tank.
Then, in February 2012, he joined ISE as executive partner. ISE’s own page describes the job as working alongside Steve Bono, its founder and chief executive, to guide strategy and lead a team of ethical hackers, and translating what they learn into guidance for leaders through keynotes, writing and media (ISE). The same page adds that he holds a BA in psychology from Georgetown University and that, in his spare time, he skis without poles.
IoT Village is the part of that resume most security people know. It’s a traveling hacking event with talks, hands-on labs, live bug hunting and hacking contests, run at DEF CON, RSA Conference and elsewhere, and organized by ISE (IoT Village). Over the years it has served as a platform to uncover hundreds of new vulnerabilities, by its own count. Start is the other: software that pulls vendor risk management out of spreadsheets and email (Start), which IoT Village’s site says is trusted by Fortune 100 companies and the biggest studios in media and entertainment.
What does it mean to think like a hacker?
I asked him the simplest version of the question. “So, what’s the spirit behind hacking?”
“Hacking is about looking at a scenario, a situation, a problem, a goal, whatever, and being willing to think differently about it than maybe what most people do.”
Ted Harrington, at 1:24
He had been working toward that sentence for years, in three steps. “I lead a team of ethical hackers. I wrote the best-selling book called Hackable, which talks about practical implementations of this mindset. I gave a TED talk called Why You Need to Think Like a Hacker.” Hackable launched on December 8, 2020, after, in his words on X the day before, decades of research and almost two years of writing.
Decades of research. Thousands of vulnerabilities. Almost two years of writing. It all comes together TOMORROW: Hackable launches on Tues Dec 8! If you want to build more secure software, get this: https://buff.ly/3eeqAAZ
Ted Harrington (@SecurityTed) · December 7, 2020
#hackable #Security #author
The talk came next. He gave it at TEDxFrankfurt in October 2022, and TEDx posted it on YouTube in January 2023, where it has been watched more than 37,000 times. The talk’s own description says he sees security as a competitive advantage rather than a cost, the pursuit of a good thing rather than the avoidance of a bad one.
The talk, he said, raised a question he then spent years on. “And that, of course, begs the question: like, well, what does that even mean? What does it mean to think like a hacker?”
Four traits every kid already has
His answer is short enough to remember.
“And so I’ve sought to answer that and I’ve distilled it down to four attributes that hackers possess. And they are that hackers are curious. Hackers are non-conforming. Hackers are committed and hackers are creative.”
Ted Harrington, at 2:02
The proof that everyone has a hacker inside, he said, is in any playground. “And the way that I can demonstrate that everyone has a hacker inside them is simply by looking at children.” Kids are curious, “always asking questions.” They’re committed: “They’re gonna pursue that thing that they want you to give them no matter how many times you say no.” They’re non-conforming: tell them to do something and “they’re gonna be like, well, maybe I will, maybe I won’t.” And they’re creative, “just wildly imaginative.”
What changes is us. “Many adults are not like that. So, somewhere along the way, we learned to stop following those instincts and those traits. So it’s a choice.” The payoff of choosing differently, in his telling, is that you see what the crowd walks past: “that reveals these overlooked pathways or these missed opportunities that other people are kind of blinded to, because they’re all following along. Like the herd’s all going in the one direction.”
He tells a version of this on stage with his niece in the starring role.
Curiosity is table stakes
Sasha pulled on the first of the four threads. “It’s the curiosity, right? You have to be always curious about alternatives, about different paths to take.” Ted agreed, and told us what writing the book had turned up. He had been calling hackers he admired and asking each one what it means to think like a hacker.
“I think without exception, I’m pretty sure it was every single one of them, they said the first thing they said was that hackers are curious. And to me, that feels like table stakes.”
Ted Harrington, at 4:05
Table stakes inside security, that is. Step outside it and the trait gets rare. “But then you realize, in the grand scheme, the grand scope of the human population, a lot of people are not curious.” Hackers sit at the other end, asking “relentless, incessant questions,” and the same habit does two jobs: “That’s how you find these flaws, security flaws in systems, computer systems, but that’s also how you find these new ways of accomplishing whatever it is you’re trying to accomplish.”
That double use is the thing I’d underline for anyone hiring a tester. The person who asks why a login flow works the way it does is the same person who notices that a password reset skips a check. You can’t buy one without the other.
Entrepreneurs are hackers
Sasha took it one step further. “I was about to say that curiosity is also aligned with innovation.” Ted didn’t hesitate: “Absolutely, right? Like when you think about an entrepreneur, entrepreneurs are absolutely hackers, right?” People who aren’t entrepreneurs see the money and the business, he said, but “those are the byproducts of the curiosity.”
“What an entrepreneur does is they observe conditions, and they’re like, huh, I’ve heard people talk about this problem. Why isn’t that problem solved? Why do current or conventional approaches not solve that problem? Is there a better way? And then they start to explore that. And it’s through that curious exploration that you come up with a business that solves that problem for an audience. That’s innovation.”
Ted Harrington, at 5:26
It’s an easy idea to agree with and a hard one to live by. His own LinkedIn reads like that loop run several times, from event logistics for college students to a startup cutting the water lost at irrigation risers. I added my own version later in the conversation: “Maybe being an entrepreneur is just realizing like there’s a shorter path to a similar outcome with less bloat, with less rules, with less things to complicate the journey.” We’ll get to the bloat.
Which rules should you break?
The phrase “break the rules” came up next, from me, and Ted lit up, because he had just written a whole chapter on it. “Yeah, it’s interesting you bring up rule breaking, actually, because in this book that I’m working on, there’s an entire chapter that I write about rule breaking.” He started where a security person should, with what rules are for. “And it’s really interesting because rules serve a great purpose. Like rules should exist. Rules govern how a system behaves. They create order out of what otherwise might be chaos.”
“And in fact, most rules exist for a good reason and probably should be followed. But what we’re looking at, what you’re looking for with the hacker mindset is there’s a subset of rules that are better if they are not followed. It’s better if you bend the rule or you break the rule or you just straight up bypass it entirely.”
Ted Harrington, at 6:41
“And the trick is figuring out: well, which rule is which?” His method is to check a rule against every kind of line it might be protecting: “There’s legal boundaries and there’s moral boundaries, there’s ethical boundaries, there’s safety boundaries, there’s reputational boundaries.” Some rules carry significant implications, and hackers know those without thinking. Others protect nothing but habit. “But maybe I don’t need to wait in line to get into, I don’t know, like the conference. Everyone lines up in a line because they see this line. It’s like, is there another way in?”
This is, word for word, how a good penetration test is scoped. The rules of engagement are the boundaries you never cross: what’s out of scope, what could hurt someone, what the law forbids. Inside them, every assumption the system makes about how it will be used is fair game, and the most valuable findings are usually the line everyone waits in because everyone else does.
Rule bloat
Sasha brought an engineer’s word for the problem. “And maybe there is a concept of some rules are like technical debt. Things have changed. We’ve evolved. The laws have changed.” Layers of newer rules make some of the older ones meaningless, and they’re still followed “because they haven’t changed or they haven’t been removed.” Ted had a name for it.
“I refer to, there’s an associated idea called rule bloat, which is the idea that like rules get laid on top of rules because like now a new scenario happens and it’s like, oh, we didn’t think of that, so let’s add another rule for that.”
Ted Harrington, at 8:26
The fix isn’t fewer rules, it’s rules that move. “Like the only constant in the human existence is that things will change. And so we have to realize that like rules need to be adaptable, they shift over time.” His example was the starkest one available: laws that once allowed discrimination by gender or ethnicity, which “not even that long ago” were “literally enshrined in law.” The rule was wrong even then, he said. “But by the letter of the law, it was the way that it was.”
Sasha turned it back to software. “It’s almost like a supply chain in software. You have this bloated supply chain that you have no idea what’s beyond 10 layers of dependencies, but there is something there that you should be careful [of], potentially.” Ted’s reply: “That’s a good correlation.” Anyone who has run a dependency audit knows the feeling: the package nobody chose, pulled in by a package nobody remembers choosing, still shipping in every build.
The taxi and the zero to one
I told the story of the taxis before Uber, with cameras everywhere, a plastic shield, no seat belts in the back and the driver surrounded by regulated gadgets. “I’m looking at that and I’m going like, why do we need all of this stuff? Like, what is that? We’re just going from point A to point B, [give] some money and like, that’s that.” Some of those rules might be coming back for Uber, I allowed. “But it felt like ripe for disruption.”
Ted didn’t take the easy side. “So regulation is an interesting one because in some contexts, regulation improves things. And in a lot of contexts, it does the opposite. Slows down innovation.” Its real job, he said, is narrower: “regulation is useful when it protects groups who the market forces on their own aren’t going to protect those groups.” His example was a taxi ride in another country, where you’re left wondering how badly you’re being ripped off. Then he brought it home to security.
“I think if we bring it to security, like a cybersecurity context, regulation has proven to be effective for things like IoT devices, medical devices, things where the market forces aren’t actually incentivizing security in those cases.”
Ted Harrington, at 11:50
The early internet connected devices made the case for him. “It was like security is like hard, the passwords are hard-coded. You can’t even change the passwords, you know?” The market wasn’t going to fix that, so regulators did. And then he drew the line that makes this one of my favorite takes on the subject.
“And I’m not a proponent of regulation in almost all contexts, except for something like that, where it’s like it needs to take something from like zero to one in order to make that improvement. The problem comes from once you’re at one, and then it’s one to N is where all these layers of bureaucracy get added onto it.”
Ted Harrington, at 12:35
Past one, things become “less efficient, more expensive,” and “It no longer meets the spirit of the underlying purpose of the regulation.” Those are the rules worth breaking, he said, which ties the regulation back to the rule bloat.
The public record has three clean examples of the zero-to-one kind, all aimed at the problem he described. California’s SB-327, signed in September 2018 and in force from January 1, 2020, says that for a device you can log in to from outside the local network, security counts as reasonable if its preprogrammed password is unique to each device, or if the user must set a new one before first access (California Legislature). In the United States, the Consolidated Appropriations Act of 2023 added section 524B, Ensuring Cybersecurity of Devices, to the Food, Drug, and Cosmetic Act, effective March 29, 2023 (FDA). And the UK’s product security regime came into effect on April 29, 2024, requiring passwords that are unique per product or set by the user, and a published way to report security issues (GOV.UK).
ISE knows the medical device problem firsthand. In a segment for CBS News, Ted and his team demonstrated exploitable vulnerabilities in patient monitors, the kind that could harm a patient in the wrong hands.
For the devices nobody regulates yet, the forgotten printers, cameras and badge readers on a company network, our own guide to IoT device security walks through who should own them, and episode 94 is a whole hour on what one unsecured printer can reach.
Know when to stop digging
Sasha closed the regulation thread with a word that kept coming back. “Yeah, there is a healthy amount, just like there is a healthy amount of security in any business, there is a healthy amount of regulations in any space. And you just have to find the balance, hopefully.” I called it “a very Zen approach to security or to hacking or maybe just life in general,” and Ted, after allowing that all things are in balance, remembered a hacker angle on it after all.
The hackers he interviewed kept telling him stories they didn’t think were interesting. “They tell me, I’m like, that’s the most interesting story I’ve ever heard.” One of them, a colleague at ISE, gave him an idea about balance.
“he’s talking about this idea that hackers have to know when to stop [digging], because hacking is like, by nature, sort of uncertain, right? You look at a system and you’re like, I kind of think that there might be an exploitable security vulnerability in this area, so I’m gonna dig.”
Ted Harrington, at 14:06
A couple of findings that aren’t quite an exploit yet tell you that you may be on the right path. “But if you keep digging too far, like you only have so much time or energy or money or resources you can put into something, and if you burn them all on a dead end, then you kind of miss the other stuff that’s important.” At some point the right call is “all right, I’m butting my head against a wall. It’s time to divert and look towards something else.” Sasha summed it up in one line: “This is the effort versus the reward that you get in exchange for that effort.”
Every tester knows this one in their bones. A time-boxed engagement is a budget, and the best testers spend it the way a good investor does: enough on each lead to know if it’s real, and the rest on the leads that are.
Is it worth it?
I asked whether he had a tool for it, “a signal to be like, well, maybe I should start asking these questions about balance and pop the stack maybe sometime soon?” He did, from the same colleague: a sequence of questions. The first is the one that sorts everything else. “So I can’t remember exactly what all the questions are right now, but they were things like, is the path I’m going getting me closer to my goal? And the answers might be like, yes, maybe or no.”
Yes means keep going and no means divert. “But a lot of times it was that middle, like maybe.” That’s where the follow-ups come in: is it worth it, would the payoff be big enough, has something similar worked before, and if not, is this something never before seen that’s worth the effort anyway?
The point isn’t to always be right. “So he has this whole like sequence of questions that, the purpose of it is to just take a minute and ask yourself some clarifying questions.” Even when the call turns out wrong two weeks later, “He still did it intentionally,” and the miss teaches him the signals for next time. Ted said Inner Hacker would come with templates and worksheets for exactly this kind of exercise. Sasha’s verdict: “It sounds like a great system that maybe everyone should occasionally follow.” I said I ask myself a version every day: “Every morning I wake myself up and I’m asking myself, oh, what is it today?”
Safety is in the herd
Ted explained why most people don’t. Humans want patterns, and they learned a long time ago where safety was.
“we learned along the way that safety is in the herd. Safety is not being out on your own. You’re safe in the herd.”
Ted Harrington, at 17:23
That instinct now runs knowledge work. People get a routine, the gym, the office, dinner, bed, and he doesn’t knock it. “And it’s easy. And that’s a beautiful thing, like being able to have that comfortable life. So it takes someone intentionally to step out of that every day and say, what am I going to do today? And will that thing bring me closer or farther away from my goals?” Sasha’s reply was the same instruction in six words, “You just have to stay curious,” followed by a reminder of how lucky that routine is: nobody has to source food from the fields or wood for the fire. “But staying curious is the challenge.”
I said there’s nothing wrong with optimizing for comfort, “For the consistency, for the security,” and that I use it the other way around. “And actually, I will use comfort as an indicator to start questioning things.” When things get too comfortable, I ask whether I’m still learning and growing. Ted pointed out that comfort is also the goal: enough money, companionship, love, community and a sense that your life mattered are “all things that are measurements of comfort.”
I went back to the simple version, “Do I have shelter? Do I have food? Do I have water? Do I have companions?”, and Ted noted that for parts of the world, that’s still where life is. “Like, I don’t think cavemen would be producing a podcast, right? But it might be an interesting one to listen to.” What the rest of us have is room to think, and that, he said, is where the mindset reaches past security.
“And that’s where I think this mindset, the hacker mindset, is so much bigger than just computers. I mean, yes, this is how you build better, more secure systems. But this is also how you live a better life that’s more efficient.”
Ted Harrington, at 20:31
There’s no shortcut to sweat
One of the ideas inside the mindset, Ted said, is about a particular kind of advantage: “the hacker mindset helps you identify and then capitalize on things like shortcuts and loopholes.” He was writing exactly that chapter while traveling, and walked into a gym he’d never been to before.
“And I walk in, I’d like check in or whatever, and on the wall is this like massive mural with one of these like inspirational things that’s like painted on there with you know like an athlete sweating or whatever. And it said in huge text, it said, there’s no shortcut to sweat.”
Ted Harrington, at 21:11
“And it kind of like stopped me in my tracks.” Here he was, arguing that the mindset is valuable because it finds shortcuts, in front of a painting that said shortcuts are the problem. He stood there and asked the curious person’s question, are shortcuts a bad thing, and came out with an answer that depends on context. “And I realized that context, of course, matters because there is no shortcut to build muscle. But the way we live our lives, the way we approach our careers, the way we just go about everything that we’re doing, there’s all this wasted bureaucracy and bloat and inefficiencies. And that’s where shortcuts are great.”
Then he gave the rule that keeps a shortcut honest.
“Like, there’s definitely a code of conduct that needs to be followed to utilize the hacker mindset. But it’s basically, don’t violate anyone and make things better. Like, if you do those two things, you can use the hacker mindset, and then we should totally be using shortcuts.”
Ted Harrington, at 22:18
Those two tests are the ethics of ethical hacking in miniature: you have permission, so nobody is violated, and the point is to leave the system better than you found it. They also make a good filter for the exception requests every security team gets. Does the shortcut put anyone at risk, and does it make the work better? If the answers are no and yes, the rule it skips is probably bloat.
The hot buzzwords
Sasha connected the mindset to the technology everyone was talking about. “The life is evolving. Today we have this hot buzzwords, LLMs, AIs, that also meant to remove a lot of inefficiencies, a lot of bureaucracies, a lot of noise, and make our lives more efficient.” The hacker move, in Sasha’s telling, is the one some people make with the models themselves.
“But there are a lot of open source models that people choose to deploy locally, not only to save money, but also for the privacy concerns, et cetera. That ties into the hacker mindset.”
Sasha Sinkevich, at 23:22
ISE has since written up exactly that move. In September 2026, ISE security analyst Benjamin Wolf published a guide to building a local agentic AI rig for security research, for the cost and for privacy, because “sending raw source code and context to cloud providers is often a dealbreaker” (ISE). The same month the firm published a post on LLM prompt attacks and how to prevent them, framed as “a risk-management discipline” with defense in depth (ISE, LinkedIn). Running models yourself is one way to keep data in. For the tools people already use at work, our guide to governing shadow AI without blocking it is the other half.
Security is best done when it’s invisible
Ted picked up the thread from the user’s side of the screen.
“Security is best done when it’s either invisible or not very visible to the user. Like everyone’s used to logging a password to get into something. But then all the stuff that’s happening behind the scenes, they don’t necessarily suffer from.”
Ted Harrington, at 23:38
Make them suffer from it, he said, and “they might be like, I’m just not going to use that particular system.” Sasha put a name on it. “These are the barriers of entry. The more barriers of entry you introduce, the more likely people will look for alternatives.” I said the part I believe most strongly about our own job: “And I know a lot of security people that would put that on the user, but I, as a security person, I feel like responsible to take care of like the adoption of the security mechanisms.” Those mechanisms have to fit the culture and the workflows already in place, or nothing changes. “And if you’re asking people to change too much too quickly, it’s just not going to happen. You’re not going to have a more secure company.”
“And then if you have to invoke like a power dynamic to get things to happen, I also count that as a failure, right?”
Jon McLachlan, at 24:43
The alternative is to sell it: “maybe there’s a place where you can actually sell that idea so that it’s a win for everybody, including the folks out there that you’re asking to change.” People adopt what they see the value in.
Deepak Dutt made the same case for sign-in itself on episode 78, where authentication runs in the background instead of at a gate. A year after our recording, Ted posted the physical version from an airport: layers you barely notice, doing the work.
We love a good defense in depth. The Burbank airport abuts an active roadway so this layered approach to physical security is that much more important. It’s a great visual representation of how we should secure software too.
Ted Harrington · October 15, 2026
The user is not the weakest link
Ted answered my point by taking apart the most repeated line in security.
“Yeah, it’s an easy cop-out to say, like, oh, the user is the weakest link. And, you know, people say that kind of stuff all the time.”
Ted Harrington, at 25:08
Saying it, he said, doesn’t mean “that we should then just like give up and say, like, well, it’s on individual users to fix this problem.” His comparison was recycling.
“It’s like the way that recycling has been approached, at least in America, was rather than it being like we’re going to responsibly produce and recycle materials, there was this thing like maybe 20 years ago where it was like recycling programs, where now it’s like, it’s up to you, Mr. and Mrs. Consumer of products, to make sure you put your plastic bottles in the recycle bin.”
Ted Harrington, at 25:25
“And all of a sudden, it’s like the responsibility was shifted. And that’s not how we want to think about security. Like, well, it would be secure if the users would just listen.” What works instead, he said, comes from the psychology of engagement. He remembered a study, without remembering who ran it or when, so I’ll leave it at his summary: “And what the research demonstrated is that simply by engaging people in the mission, they want to be part of it.” People help when they feel it’s part of their job, without it being the whole company’s safety on their shoulders. “It’s like we’re all in this together. That has proven to be very, very effective.”
Sasha added the condition that makes it work. “But the mission needs to be clearly stated, right? Because if you’re not sure why do I have to do these things a certain way, it might seem as an overhead.”
The producer side of his analogy has a name in policy now. CISA’s Secure by Design principles, published in April 2023, shift the burden of security from customers to the companies that make software, and CISA’s page says every technology provider “must take ownership at the executive level” (CISA). Jack Cable, who led that work at CISA as a senior technical advisor, walked us through it on episode 84, and default passwords, the problem Ted described in IoT devices, are one of the goals in its pledge.
Why is the question
Sasha’s word, why, sent Ted straight back to rule breaking.
""Why” is such an important part of rule breaking.”
Ted Harrington, at 27:07
Smart people, he said, are always asking why they have to do a thing a certain way, and it isn’t defiance. “And it’s not that it’s because they don’t want to follow that process. It’s because they want to make sure that they align with the beliefs of why that process is that way.” So ask the questions out loud: “Why is it that way? Why was it built that way? Who’s it built for? What was that person or group like trying to accomplish?” Then make a choice, follow the rule because it makes sense, or deviate on purpose.
That landed close to home for me.
“I am obsessed with respecting people’s autonomy. And I believe 100 percent that everyone is smart and everyone wants to do the right thing.”
Jon McLachlan, at 28:05
Accept that as true and it changes how you lead. Someone doing something out of line with the company’s interest usually isn’t being nefarious or lazy. “Maybe they’re just trying to do the right thing from their perspective, from their understanding. Like, they’re missing the context. They don’t feel like they’re part of the mission, right?” And respecting their autonomy has a second effect that a hacker would like: “you’re also inviting them to challenge the way that things are done, too.”
This is the cheapest fix in all of security, and the most skipped. A rule with its reason attached gets followed by people who agree with it, and challenged by people who can see where it’s wrong. Both are what you want.
Unplugged from the Matrix
Ted said he doesn’t only believe that most people want to do the right thing. He has watched it hold up, which surprises even him, given the job.
“So, like, all day, every day, what hackers do is they think about the bad in the world. Like, how could someone attack this thing? Why would they attack it? What do they want to accomplish? How do they victimize, all that kind of stuff?”
Ted Harrington, at 29:36
“So you kind of, it’s like the classic movie The Matrix, right? Like we’re unplugged from the Matrix and we see the ugliness of the world, but like we at least see the world for what it is.” Most people stay plugged in and see the beauty. And still: “I still believe it to be true that most people, most of the time, want to behave ethically.” Self-preservation sometimes wins over treating someone else fairly, he allowed. “But for the most part, people given the choice would prefer to do the right thing.”
I offered the human footnote, “Yeah, yeah, there’s a lizard brain that sometimes will override things in the heat of a moment, perhaps. Welcome to being human, I guess,” and a guess about the movie: “Maybe we both saw that movie at a very impressionable age, and it stuck with us, the message of being able to challenge the way things are presented.” Ted said his reading of it has changed with time. “When I first saw The Matrix, I didn’t understand it as a hacker movie, but I now very much see it as a hacker movie.” It is one, literally: the 1999 film by the Wachowskis follows a disillusioned computer hacker named Neo (Wikipedia).
They both suck most of the time
Sasha picked the fourth trait, commitment, and asked about it the hard way. “You’ve built a lot of companies and you’ve also finished a Boston Marathon. What is the parallel between running a marathon and building a company?”
“They both suck most of the time. Like almost all the time it really sucks. But then you have these moments of just joy along the route.”
Ted Harrington, at 31:32
“You don’t know what the outcome’s gonna be, but you’re willing to put in the work anyway.” Sasha added the part about not quitting, and Ted turned it into gratitude: “Because you enjoy it, and because it’s the privilege that you get to do it.” Running, entrepreneurship and the hacker ethos are the same thing to him, “like the willingness to go do a thing over and over and over again, including a thing that’s physically uncomfortable, with no certainty of success, because it’s worth doing, because it’s hard to do.” Sasha’s verdict: “You have true grit.”
The difference between the two is the finish line. A marathon has a race day. “We’ve been doing this version of our hacking company, ISE, with my business partner Steve. He and I have been partnered up for like 13 years. There’s no proverbial race day in entrepreneurship.” The goalposts keep moving. Looking back over those years he sees “so much joy,” and he described the math of it like this.
“It’s like you get punched in the face 99 times and you’re like, there will be the 100th time that something good happens. And that’s what, you know, you get excited to go find that 100th time.”
Ted Harrington, at 33:16
Steve is Steve Bono, who formed ISE in 2005 and still runs it as chief executive (ISE). Sasha closed the loop on the trait: “And that’s the commitment, right? You commit to yourself that I’ve invested all of this time and effort. I’m curious to know what the outcome will be.” Commitment and curiosity, it turns out, are the same muscle pointed at different days.
Buy more Bitcoin
I asked my favorite closing question. “I mean, if you could, if you could travel back in time and meet your younger self, I’m super curious. Would you?” His first answer took about two seconds: “I would have told him to buy more Bitcoin.” I said that sounded like pretty good advice.
Then he took the question seriously, and talked himself out of it. Some opportunities he missed or fumbled might have gone better. “but all of those things, they also built me to where I am today, and I’m like just so grateful I get to live the experience I’m living right now.” The risk is the butterfly effect, “where like one little change changes everything and now maybe my life is different in a not as cool way?” He had never pondered it, he said. I told him he wouldn’t be the same person, and that the person he is today is worth keeping. If you want to find him, it’s simple. “It’s just my name, just tedharrington.com.”
What happened after the tape
Inner Hacker came out on September 16, 2025, a 278-page Kindle edition, a month before this episode aired (Amazon). Its own pitch is the line he gave us at the top of the episode, compressed: “There’s a hacker inside you. Unleash it.” The page for the book promises to teach “how to break the right rules to move forward” and how to amplify curiosity, non-conformity, commitment and creativity (tedharrington.com). The hard copy followed in December.
The hard copy of Inner Hacker is out NOW, just in time for the holidays!
Ted Harrington (@SecurityTed) · December 3, 2025
Grab your copy today:
In June 2026 he sat down with John Hammond for a 25-minute conversation on how hackers think, which has passed 14,000 views. A few minutes in, he tells the story of a buyer who collects three penetration testing quotes and buys the wrong thing, which we quoted in our post on what enterprise buyers expect from a pentest.
At the end of September 2026 he marked the book’s first year, and the stories readers had sent him about using the mindset.
One year ago 🤩. Wild to think that it’s already the first anniversary of Inner Hacker! I wrote this book to share the revolutionary mindset of how hackers think, and do so in a way that anyone, anywhere, can apply it to any goal.
Ted Harrington · September 29, 2026
The talk keeps traveling too. In October 2026 he gave the keynote plenary at the National Association of Development Organizations’ annual training conference, under the same title as the TEDx talk, “Why You Need to Think Like a Hacker” (LinkedIn). Two days later he marked four years since TEDxFrankfurt.
Four years ago today I took the stage at TEDxFrankfurt to share a revolutionary new way of thinking: the hacker mindset. It’s been a life changing journey since, including another bestselling book based on the ideas of this very talk.
Ted Harrington · October 22, 2026
And the hands-on work goes on alongside the stage. For the first week of November 2026, the Central Ohio chapter of ISSA scheduled a two-day threat modeling workshop led by Ted, from defining assets and threat actors to building threat models that change as the landscape does (LinkedIn).
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Ted, Sasha and I actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
What are the four traits Ted says hackers possess?
- Curious, non-conforming, committed and creative
- Technical, persistent, skeptical and fast
- Curious, careful, compliant and creative
a. "And they are that hackers are curious. Hackers are non-conforming. Hackers are committed and hackers are creative." Transcript, 1:24.
-
How does Ted show that everyone has a hacker inside them?
- By looking at criminals
- By looking at engineers
- By looking at children
c. "And the way that I can demonstrate that everyone has a hacker inside them is simply by looking at children." Transcript, 1:24.
-
What does Ted call it when rules get laid on top of rules?
- Rule creep
- Rule bloat
- Technical debt
b. "there's an associated idea called rule bloat, which is the idea that like rules get laid on top of rules." Technical debt was Sasha's word for it. Transcript, 8:23.
-
When is regulation useful, in Ted's view?
- When it protects groups the market won't protect on its own
- Whenever a new technology appears
- Only after a major breach
a. "regulation is useful when it protects groups who the market forces on their own aren't going to protect those groups." Transcript, 11:05.
-
What did the mural at the gym say?
- No pain, no gain
- There's no shortcut to sweat
- Think like a hacker
b. "And it said in huge text, it said, there's no shortcut to sweat." Transcript, 19:56.
-
What does Ted compare blaming the user to?
- Speed limits
- Airport security lines
- The way recycling has been approached
c. "It's like the way that recycling has been approached, at least in America." Transcript, 25:08.
Does your security program win people over?
Ted, Sasha and I kept coming back to the same idea from different sides: security works when people are on the mission, and fails when it’s a rulebook handed down. This scorecard asks eight questions about your program, from how a new rule arrives to when you last retired one.
Scorecard · eight questions
Does your security program win people over?
Answer for the security program you run or work inside. If two answers fit, pick the lower one.
-
When a new security rule arrives, how do people find out why?
- They don't, it just appears
- An announcement says what's changing
- The reason comes with the rule, and someone answers questions
"Why" is such an important part of rule breaking, in Ted's words, and of rule following. See Why is the question.
-
How much of your security happens without the user noticing?
- Most of it is a step they have to take
- Some checks run in the background
- The defaults do the work, and the visible steps are the ones that matter
"Security is best done when it's either invisible or not very visible to the user." See Security is best done when it's invisible.
-
When someone works around a control, what happens next?
- They get blamed
- The workaround gets blocked
- Someone asks why, and fixes the control if it was the problem
"The more barriers of entry you introduce, the more likely people will look for alternatives," in Sasha's words.
-
How do new controls get adopted?
- Because the security leader said so
- A deadline and reminders
- A pitch that shows each team what it gets out of the change
If you have to invoke a power dynamic, I count that as a failure. Sell the idea instead.
-
When did you last retire a security rule?
- Never, rules only get added
- When an audit forced it
- On a schedule, with each rule checked against what it still protects
Rules laid on top of rules are what Ted calls rule bloat. See Rule bloat.
-
Who is responsible for security, as your training describes it?
- The user, the weakest link
- The security team
- Everyone, with the mission stated plainly
"It's like we're all in this together." See The user is not the weakest link.
-
Can someone ask for an exception and get a straight answer?
- There's no way to ask
- A form that goes quiet
- A named owner, a deadline, and two questions: does it put anyone at risk, does it make the work better
Ted's code of conduct for shortcuts: don't violate anyone and make things better. See There's no shortcut to sweat.
-
Do you test your own controls the way an attacker would?
- No
- A scan once a year
- Curious, persistent people, with the time to dig and the questions to know when to stop
The four traits, and the questions for when to stop digging. See Is it worth it?
Rules arrive without reasons and leave never. Start with the cheapest fix there is: put the why next to every rule, ask the next person who works around a control what got in their way, and retire one rule this quarter that no longer protects anything.
People can see the reasons, and the next wins are in the friction. Move one visible step into the background, give exception requests an owner and a deadline, and stop describing your colleagues as the weakest link in training.
Your program explains itself, stays out of the way and invites challenge. Now test it the way Ted's team would: give curious people time to dig into your own controls, and let them tell you which rules are better broken.
What does security friction cost?
Every visible security step is a few seconds of someone’s day, and Ted’s point is that the ones protecting nothing are worth finding. This calculator estimates the time your team spends on security steps a year, and the share you could give back.
Calculator
What does security friction cost?
How many people, how many security steps each takes a day (sign-ins, prompts, approvals, waits), how long a step takes, what an hour of their time costs, and the share of steps you think protect nothing.
200 people taking 8 security steps a day, at 30 seconds each, spend about 3,067 hours a year on them, roughly $230,000 at $75 an hour. If 25% of those steps protect nothing, that's 767 hours and $57,500 a year you could give back.
Every default is a placeholder, not a number from the episode. A year here is 230 working days. The estimate counts only the seconds each step takes, not the context switch after it, which is usually the bigger cost, and it says nothing about which steps those are. Finding them is the work: ask the people who take them.
From Washington to Inner Hacker
Everything on this page sits on one timeline, from Ted’s first startup to the workshops of November 2026. Filter it by thread.
Timeline · 2001 to 2026
From Washington to Inner Hacker
Filter by thread. Dates are from the public record except where marked as part of this show.
- W.Harrington Ventures
His first startup, events logistics for a mostly college-student customer base, in Washington, D.C. (LinkedIn).
- ISE
Steve Bono forms Independent Security Evaluators in Baltimore (ISE).
- Wolfpack
Director and senior strategy executive at a manufacturer in Vista, California (LinkedIn).
- NMG Technologies
Chief executive of a seed-stage water conservation startup (LinkedIn).
- Executive partner
Ted joins ISE (LinkedIn).
- IoT Village
The traveling hacking event series, co-founded by Ted and organized by ISE (IoT Village).
- SB-327 signed
California's connected device security law (California Legislature).
- Patient monitors on CBS News
Ted and his team demonstrate exploitable vulnerabilities (YouTube).
- Unique passwords in California
SB-327 takes effect (California Legislature).
- Hackable
How to Do Application Security Right launches (X).
- Start
Ted co-founds the vendor risk management platform (LinkedIn).
- TEDxFrankfurt
Why You Need to Think Like a Hacker (LinkedIn).
- The 2023 omnibus
Signed into law, adding section 524B to the Food, Drug, and Cosmetic Act (FDA).
- The talk on YouTube
Posted by TEDx, now past 37,000 views (YouTube).
- Section 524B
Ensuring Cybersecurity of Devices takes effect (FDA).
- The UK's product security regime
Passwords unique per product or set by the user (GOV.UK).
- We record episode 80
"I believe there's a hacker inside everyone."
- Inner Hacker
A New Way of Thinking, the Kindle edition (Amazon).
- Episode 78
Deepak Dutt on invisible security (episode 78).
- Episode 80 airs
This conversation.
- The hard copy
Inner Hacker in print (X).
- Episode 84
Jack Cable on Secure by Design and the bugs that keep getting exploited (episode 84).
- Episode 94
Jim LaRoe on what one unsecured printer can reach (episode 94).
- A Hacker's Way of Thinking
A conversation on John Hammond's channel (YouTube).
- LLM prompt attacks
ISE on defending AI deployments in depth (ISE).
- A local agentic AI rig
Keeping security research off the cloud, on a budget (ISE).
- A year of Inner Hacker
The first anniversary (LinkedIn).
- Defense in depth
The Burbank airport, as a picture of how to secure software (LinkedIn).
- A NADO keynote
Why You Need to Think Like a Hacker, at the 2026 annual training conference (LinkedIn).
- Four years since TEDxFrankfurt
The talk that led to the second book (LinkedIn).
- A threat modeling workshop
Two days with the Central Ohio ISSA chapter (LinkedIn).
What to do this week
Five things, in the order Ted’s four traits suggest.
- Write the reason next to your next rule. One sentence on what it protects and who it’s for. If you can’t write it, that’s your first candidate for rule bloat.
- Ask the next person who works around a control what got in their way. Then fix the control if it was the problem. Every barrier is a reason to look for an alternative.
- Retire one rule. Check it against the boundaries Ted named, legal, moral, ethical, safety and reputational, and if it protects none of them anymore, take it out.
- Give your testers a stop-digging question. Is this path getting me closer to my goal? Ask it at every checkpoint of a time-boxed test, and spend what’s left of the budget on the leads that answer yes.
- Run the two tests on your next exception request. Does it put anyone at risk, and does it make the work better? If the answers are no and yes, say yes faster.