Advisory

In 1999, Niels Provos drove to Canada to strip the encumbered cryptography out of OpenSSH, because United States export law would not let him do the work at home. OpenBSD could then release the code worldwide. He and David Mazières published bcrypt the same year; it still hashes passwords at companies founded two decades later. Honeyd and libevent followed.

Google hired him into its security organization in 2003, where he defended the company against denial-of-service attacks and helped start Safe Browsing in 2006. He ran the team for seven years, which is why Chrome, Firefox and Safari warn you before you open a malicious page. As a Distinguished Engineer, he spoke at Google I/O on how Google secures its infrastructure. In 2018, Stripe made him Head of Security; from 2022 to 2024, he led security efficacy at Lacework.

Anthropic’s Mythos agent found a signed-integer comparison in OpenBSD’s TCP SACK code that could panic the kernel. It had survived twenty-seven years of review. Provos wrote it in 1998, while finishing his doctorate at Michigan, and confirmed the mistake was his. He reproduced the result independently with IronCurtain, his open-source agent runtime, on models anyone can rent, for tens to low hundreds of dollars an audit. Patching faster will not keep up with that. The controls that put a whole class of bug out of reach will.

Security Blueprints puts that argument on the record. 76 breaches taken down to root cause, scored against structural controls, answer a question the industry mostly guesses at: which controls prevent breaches, and by how much. He wrote PlanAI to run the analysis and is building CISO Challenge, a simulation of the funding decisions that produce breaches. Running security engineering teams for fifteen years taught him the rest. The hardest part of an invariant is rarely technical; it is getting an organization to adopt one.