Founder & CEO of runZero (@runZeroInc - https://runzero.com), previously the founder and lead developer of Metasploit, a CSO, a consultant, and the head of various security research teams.
My work is focused on #infosec, #security, #networking, #discovery, #osint, #postgresql, #aws, #engineering, #opensource, #devops, and #startup stuff. For fun I write #golang, build #IoT projects, and #run in circles.
| Home | https://hdm.io |
| Github | https://github.com/hdm |
| Work | https://www.runzero.com/ |
| https://twitter.com/hdmoore | |
| Bluesky | https://bsky.app/profile/hdm.bsky.social |
| Signal | hdm.01 |
The first rule of the Austin hacker scene? You have to talk 🤐
@hdm sits down with Elliot Fielding to talk about the culture of participation, early days of Metasploit, and his journey from Whataburger rejection to joining the Air Force at age 16.
Watch the full interview: 🔗 https://www.runzero.com/resources/keep-austin-secure-podcast-5/
Treating every CISA KEV entry equally is how security teams burn out.
@todb sat down with Sean Martin to talk smarter prioritization (and discuss our new KEVology report & KEV Collider tool!).
📺 Watch the full interview: https://www.runzero.com/resources/kev-vulnerabilities-itsp-magazine/
runZero users get a new feature today (including Community Edition) - recurring internet speed tests for all deployed Explorers! This (very optional) capability lets you identify backhaul/connectivity issues for sites that you can't physically get to, smoothing the path for tool deployment and exposure management processes: https://www.runzero.com/blog/internet-speed-tests/
Thanks to Pete C for the writeup, Jeremy B for the UX, and Iain P for the suggestion!
Handy for tracking ISP issues on your home network as well =D
It's time for our first ATX Gopher meetup of the year! If you are in Austin and write Go code (or would like to start), please join us at 6:30pm at Station Austin (co-located with Capital Factory). Charles and I will be providing pizza and drinks as usual, we have a guest speaker lined up for the main session, and a few smaller talks available as time permit (
I plan to cover two new projects: 1. & 2).
https://www.meetup.com/atxgolang/events/312781553/?_xtd=gqFyqDc2Njk0NTQyoXCjYXBp&from=ref
1. https://github.com/runZeroInc/go-rod
2. https://github.com/runZeroInc/conniver/
PSA: go.sum is not a lockfile.
You never need to look at go.sum.
go.mod has everything you need.
The annual wrap-up for Metasploit Framework is out now, and it includes the entirety of stats for 2025. This wrap-up and its contents would not be possible without the participation and dedication of our contributors and researchers, and all of our thanks goes to them! Metasploit Framework wouldn't be the same without you, thank you.
https://www.rapid7.com/blog/post/pt-metasploit-2025-annual-wrap-up/
Metasploit Framework's 2025 year in review: 139 new modules, major Active Directory improvements, enhanced Windows Meterpreter with ARM64 support, and critical exploits including SharePoint RCE. Discover persistence overhauls, SMB relay expansions, and contributions from 66 community members. This captures the key highlights (module count, AD/Meterpreter improvements, SharePoint vulnerability) while staying within the optimal 150-160 character range for search engine display and including relevant keywords for security professionals searching for Metasploit updates.
How do you manage exposure in OT environments without disrupting critical infrastructure? 🛡️
On January 22, runZero's @hdm joins Kris Beevers (NetBox Labs) and Bob Marx (Accenture) to discuss modern approaches to OT asset inventory and security.
Key topics:
⚙️ OT-specific data modeling
🤝 Combining NetBox and runZero for complete visibility
👁️ Moving beyond traditional passive analysis tools
🎟️ Register here: https://netboxlabs.com/webinars/operating-and-securing-the-next-generation-of-ot-environments/
Updated version of Debian Linux 13.2 has been released. You can simply run the `apt` command to get all upgrades. Those who frequently install updates using `apt` won't have to update many packages, and most such updates are included in the point release.
The CFP for SO-CON 2026 closes in about 12 hours (11:59 2025-11-15)! Have a cool approach to attack path management (or awesome connector for BloodHound OpenGraph)? Submit ASAP:
runZero, Inc
Filippo Valsorda
Metasploit
nixCraft 🐧