Jeremiah Grossman

Jeremiah Grossman is a computer security researcher and entrepreneur best known as the founder of WhiteHat Security, one of the first companies built specifically around website vulnerability assessment and web application security testing. In December 1999 he joined Yahoo! as an Information Security Officer, a role he took after informally testing his own Yahoo! Mail account's security and reporting what he found to the company. At Yahoo! he was responsible for web application security review across the company's engineering organization, an unusually large-scale, real-world laboratory for studying vulnerability classes, especially cross-site scripting (XSS).

Founding WhiteHat Security

In 2001, Grossman left Yahoo! and founded WhiteHat Security as its CTO and later CEO, initially a one-person operation that grew into a prominent web application security vendor built around the WhiteHat Sentinel scanning platform. Grossman announced his departure from WhiteHat in March 2016 after nearly fifteen years leading the company; it was later acquired by NTT Security in 2019.

Research and Industry Institution-Building

Alongside running WhiteHat, Grossman was an active researcher and public voice on web application security. He co-founded the Web Application Security Consortium (WASC) in 2004, an industry group that produced widely referenced resources such as the WASC Threat Classification. He co-authored the 2007 book "Cross Site Scripting Attacks: XSS Exploits and Defense," and in 2008 he and Robert Hansen publicized and named "clickjacking," a UI-redressing attack technique.

The 'Top 10 Web Hacking Techniques' List

In 2006, Grossman started the "Top 10 Web Hacking Techniques" list on his personal blog, an annual, community-nominated ranking of the year's most innovative web application security research. The list moved to WhiteHat Security's platform in 2011, later went dormant, and was revived by PortSwigger Research in 2017, which has maintained it since, crediting Grossman as its originator.

Later Career

After leaving WhiteHat, Grossman served as Chief of Security Strategy at SentinelOne from 2016 to 2018, then founded and served as CEO of Bit Discovery, an attack-surface-management startup, until its acquisition by Tenable in 2022. Across his career he has been widely credited within the industry for helping professionalize web application security as a distinct discipline.

Timeline

• 1999-12Joins Yahoo! as Information Security Officer.
• 2001Leaves Yahoo! and founds WhiteHat Security.
• 2004Co-founds the Web Application Security Consortium (WASC).
• 2006Starts the annual 'Top 10 Web Hacking Techniques' list.
• 2007Co-authors 'Cross Site Scripting Attacks: XSS Exploits and Defense.'
• 2008With Robert Hansen, publicizes and names the 'clickjacking' attack technique.
• 2016-03Announces his departure from WhiteHat Security after nearly fifteen years.
• 2018Founds Bit Discovery as founder and CEO.
• 2019WhiteHat Security is acquired by NTT Security.
• 2022-06Bit Discovery is acquired by Tenable.