Pedram Amini

Background

Pedram Amini is a computer security researcher and software developer whose career has centered on vulnerability research, fuzzing, and reverse engineering. He holds a computer science degree from Tulane University. He began his professional security career in 2002 at iDEFENSE Labs, a vulnerability intelligence firm later acquired by VeriSign in 2005, where he served as a founding member and assistant director and helped build the company's Vulnerability Contributor Program (VCP), a network coordinating disclosure work from independent researchers.

Zero Day Initiative

In 2005, Amini moved to Austin, Texas, to help start the Zero Day Initiative (ZDI) at TippingPoint, a network security company that was then a division of 3Com. Launched on July 25, 2005, and initially led together with David Endler, ZDI paid independent researchers for privately disclosed software vulnerabilities, which TippingPoint then used to protect its intrusion-prevention products while coordinating disclosure with the affected vendors. The program is widely credited as one of the first large-scale vendor bug-bounty and disclosure-brokering efforts of its kind and has continued to operate for decades under subsequent owners of TippingPoint, including Hewlett-Packard and Trend Micro, eventually crediting patches for well over a thousand vulnerabilities contributed by thousands of researchers.

Sulley and PaiMei

Alongside his work at TippingPoint, Amini developed open-source tools for vulnerability discovery and reverse engineering. He created PaiMei, a modular reverse-engineering framework built around components for process control, memory inspection, and code-coverage analysis, designed to speed up the prototyping of analysis tools for platforms such as IDA Pro and OllyDbg. In 2007, together with Aaron Portnoy, he released the Sulley fuzzing framework at Black Hat USA. Sulley was an open-source, extensible fuzzing framework notable for combining data generation with network monitoring, target health instrumentation, automated crash detection and categorization, and support for running fuzzing sessions in parallel; it became a widely used and studied tool in the fuzzing community. Amini also founded OpenRCE.org, a community site dedicated to reverse-engineering research, and co-authored the 2007 book "Fuzzing: Brute Force Vulnerability Discovery" with Michael Sutton and Adam Greene.

Later work

Amini and fellow TippingPoint researcher Cody Pierce drew industry attention in 2008 for reverse-engineering the encryption used by the Kraken botnet's trojan, work that sparked debate over the ethics of researchers infiltrating live botnet command-and-control infrastructure. In 2010, Amini founded Jumpshot, a malware-removal product later acquired by Avast and rebranded as GrimeFighter, and he subsequently held a director role at Avast. He went on to become chief technology officer at InQuest, a threat-detection company where he developed technologies including Deep File Inspection and a retrospective threat-hunting method he called RetroHunting. InQuest was acquired by OPSWAT in 2024, after which Amini took on the role of Chief Scientist at OPSWAT. He has spoken at conferences including Black Hat, DEF CON, ToorCon, and REcon, and has held advisory roles with organizations such as Exodus Intelligence and Mozilla's GenAI bug bounty program.

Significance

Amini's contributions span three areas of lasting influence in computer security: institutionalizing paid vulnerability disclosure through the Zero Day Initiative, advancing publicly available fuzzing and reverse-engineering tooling through Sulley and PaiMei, and documenting fuzzing methodology through a widely cited technical book. His work helped shape both the practice and the business model of vulnerability research in the 2000s and 2010s.

Timeline

• 2002Joins iDEFENSE Labs, becoming a founding member and later assistant director; helps build the Vulnerability Contributor Program.
• 2005-07-25Zero Day Initiative (ZDI) launches at TippingPoint, co-founded and initially led by Amini and David Endler.
• 2006Speaks at the REcon reverse-engineering conference on PaiMei and related tooling.
• 2007Releases the Sulley fuzzing framework with Aaron Portnoy at Black Hat USA; co-authors "Fuzzing: Brute Force Vulnerability Discovery" with Michael Sutton and Adam Greene.
• 2008With Cody Pierce, reverse-engineers the encryption routines used by the Kraken botnet trojan, prompting debate over botnet-infiltration ethics.
• 2010Founds Jumpshot, a malware-removal product later acquired by Avast and rebranded GrimeFighter.
• 2024InQuest, where Amini served as CTO, is acquired by OPSWAT; Amini becomes Chief Scientist at OPSWAT.