Mark Curphey

Background

Mark Curphey is a software developer and security practitioner whose work has centred on application security: the discipline concerned with flaws in software itself rather than in the networks or operating systems that host it. He is best known for starting the Open Web Application Security Project, generally referred to as OWASP, and for subsequently founding companies focused on giving software developers security tooling suited to how they actually build and ship code.

Founding OWASP

According to accounts of the project's origins, Curphey started OWASP on 9 September 2001. The OWASP Foundation's own history records that the effort came online as a public website on 1 December 2001. At the time, published security guidance was dominated by network and infrastructure concerns, while the rapid growth of web applications was producing a class of defects—injection flaws, broken authentication, session handling errors and similar issues—that existing material addressed only indirectly.

OWASP was organised as an open community effort. Its documents, checklists, testing guides and tools were released for free reuse, and contributions came from volunteers working in consultancies, vendors, enterprises and academia rather than from a single sponsoring company. That structure allowed the project to expand into local chapters and independent sub-projects without central commercial control.

The OWASP Foundation

The community's growth was formalised when OWASP was established as a not-for-profit charitable organisation in the United States on 21 April 2004. The OWASP Foundation exists to support the project's infrastructure, chapters and individual projects, which in turn are maintained by volunteer leaders. Over the following two decades, OWASP material became a common reference point in secure development training, procurement requirements and compliance frameworks, and the organisation grew well beyond the scale of the effort Curphey originally launched.

SourceClear

In 2013, Curphey founded SourceClear in Seattle. The company built tooling in the area now generally called software composition analysis: identifying the open source libraries a codebase depends on and flagging known vulnerabilities and risky code paths within them. Curphey described the company as "the only company on the planet 100% dedicated to building security tools for software developers," a framing that reflected a broader shift in the field toward tools designed for engineers rather than for auditors.

SourceClear raised a seed round of roughly $1.5 million in June 2014 and a Series A of about $10 million in October 2015 from Index Ventures and Storm Ventures. In 2018 the company was acquired by CA Technologies and integrated into Veracode's application security product line, where its command line scanner continued to be offered as part of the larger platform.

Later work

Curphey later co-founded Crash Override with John Viega, another long-standing figure in application security and cryptography. The company's public material describes work on software engineering and open source problems at the level of the development pipeline, and identifies Curphey as the person who created OWASP and founded SourceClear. Outside of security work, he describes himself as a cyclist and sailor.

Significance

Curphey's principal contribution is organisational as much as technical. OWASP demonstrated that a body of security knowledge could be built and maintained as an open commons, updated by practitioners in the field, and adopted by industry without being owned by any single vendor. The model has been imitated repeatedly in security and adjacent fields, and the project he started remains one of the standard entry points for developers encountering application security for the first time.

Timeline

• 2001-09-09Curphey starts the Open Web Application Security Project (OWASP).
• 2001-12-01The OWASP Foundation website comes online.
• 2004-04-21OWASP is established as a not-for-profit charitable organisation in the United States.
• 2013Curphey founds SourceClear in Seattle, focused on security tooling for software developers.
• 2014-06SourceClear announces a seed round of approximately $1.5 million.
• 2015-10SourceClear raises an approximately $10 million Series A led by Index Ventures with Storm Ventures.
• 2018CA Technologies acquires SourceClear; the technology is integrated into Veracode.
• 2022Curphey co-founds Crash Override with John Viega.