H. D. Moore

H. D. Moore was born in 1981 and, according to reliable biographical sources, was already writing security software utilities as a teenager. In the summer of 2003 he founded the Metasploit Project with the goal of building a public, freely available resource for exploit code and vulnerability research, at a time when many independent exploit developers had stopped publishing their work or moved into private industry. The project, originally written in Perl and later rewritten in Ruby, grew through word-of-mouth in the hacker and penetration-testing community into the Metasploit Framework, the best-known open-source exploitation platform in the security industry.

Early Career

Shortly after BreakingPoint Systems was founded in Austin, Texas in September 2005, Moore was hired as the company's Director of Security Research, where he worked on the security-testing features of BreakingPoint's network-testing products. In July 2006 he drew wide industry attention with the "Month of Browser Bugs," publishing a new, previously undisclosed browser vulnerability every day for a month, mostly affecting Internet Explorer but also Safari and Firefox, as a demonstration of the scale of unpatched browser flaws.

Rapid7 and Internet-Wide Scanning Research

In October 2009, the Metasploit Project was acquired by the Boston-based security firm Rapid7, and Moore joined the company, holding research-leadership titles including Chief Security Officer and Chief Research Officer while remaining chief architect of the Metasploit Framework. At Rapid7 he pushed into large-scale, internet-wide scanning research, first through the Critical.IO project, which scanned the public internet and identified tens of millions of network devices exposed to attack, and later through the successor effort Project Sonar. This scanning work drew both praise for exposing the poor security posture of internet-connected devices and pushback over the legality and ethics of unsolicited internet-wide probing. Moore left Rapid7 on January 29, 2016, after six years with the company, to join a venture-capital firm focused on early-stage security startups.

Rumble / runZero

In 2018 Moore founded Rumble, Inc., an IT asset-discovery and network-visibility company built around the premise, drawn from his years as a penetration tester, that most organizations cannot accurately inventory the devices on their own networks. The company raised a $5 million funding round in March 2021 followed by a $15 million Series A led by Decibel Partners in March 2022. In 2022 the company was renamed runZero, Inc., where Moore continues to serve as founder and chief executive, focusing on network discovery and exposure management across IT, OT, and IoT environments.

Legacy

Moore is widely credited within the security industry with helping professionalize penetration testing by giving practitioners a shared, extensible, and freely available exploitation framework, and with popularizing large-scale internet measurement as a vulnerability-research technique.

Timeline

• 2003Founded the Metasploit Project in the summer of 2003 as a public resource for exploit code and vulnerability research.
• 2005Hired as Director of Security Research at BreakingPoint Systems in Austin, Texas.
• 2006-07Ran the "Month of Browser Bugs," publishing a new browser vulnerability every day for the month of July.
• 2009-10Rapid7 acquired the Metasploit Project; Moore joined Rapid7 and remained chief architect of the Metasploit Framework.
• 2013Rapid7's Project Sonar, an internet-wide scanning research effort led by Moore, launched as a successor to the earlier Critical.IO scanning project.
• 2016-01-29Departed Rapid7 after six years to join a venture capital firm focused on early-stage security startups.
• 2018Founded Rumble, Inc., an IT asset-discovery and network-visibility company.
• 2022Rumble, Inc. renamed runZero, Inc., with Moore continuing as founder and CEO.