Andrew Morris and the art of paying less attention

Andrew Morris built a company around a question that takes a little of the glamour out of being attacked: is this happening to everyone else, too? It is an awkward question for an industry that sells vigilance. A flashing alert feels personal. A stranger trying the same thing against thousands of machines feels more like an unpleasant feature of the neighborhood. Understanding the difference became his work.

The company is GreyNoise Intelligence. Morris is its founder and Chief Architect, having passed the CEO job to Ash Devata in February 2024. He described that change with the delight of someone who had finally negotiated his way back to the interesting part of the assignment. The new position, he wrote, was his dream job. For a founder, stepping away from the chief executive's chair can look like an ending. His account reads like permission to get started again.

A computer without a hard drive

His route into computing began with a practical obstacle. At 13, he wanted to know how to use a computer without a hard drive. An internet search led him to Linux live CDs, which let a machine run an operating system from a disc. In his telling, a Linux magazine in a bookstore supplied the next step. He took the bundled Ubuntu disc without paying for it. He is frank about that detail when recounting the story.

The attraction was immediate. A missing component had become an invitation to learn how the whole machine worked. That is a useful early scene for understanding Morris: an ordinary frustration becomes a technical question, then a reason to start experimenting. It also lacks the tidy respectability that tends to arrive after a founder has acquired a communications department.

He left high school. His mother, he has written, prefers the formulation “finished early.” His education continued through coworkers, conversations at hacker conferences and people he met online. He describes learning through action, including getting things wrong in public and trying again. That willingness to risk embarrassment is something he explicitly connects to founding a company.

His early professional trade was offensive security. He went from teenage hacking to being paid to test other people's systems; his career also included research and development at Endgame. In a 2024 interview, the subjects ranged from hacking school infrastructure to meeting a penetration tester and landing his first penetration testing job. The report writing that accompanies such work received attention, too. Even a career in breaking into computers has paperwork.

▶ WATCH THE CONVERSATION

Ten servers, one awkward discovery

The experiments that led toward GreyNoise began around 2013. Morris bought roughly ten inexpensive virtual servers from a provider offering lifetime hosting and put honeypots in different data centers. These were decoys, waiting to record what strangers would try. Attacks arrived immediately. When he brought the logs together in Splunk, the overlap became visible: the same addresses were turning up against geographically scattered machines.

A single server had made the activity look intimate. Several servers made it look indiscriminate. The useful discovery lay in the comparison. A security team seeing only its own doorstep could mistake a campaign against the whole street for a visit arranged especially for it.

Morris's public GitHub profile puts him in Washington, D.C., and describes him simply as a computers and information security person. It also points to the GreyNoise public API project. That combination is fitting. The curious observer and the person making observations available to other people have remained in the same line of work.

A network of listening devices makes a different sort of map from a scanner that goes looking for exposed machines. Morris has acknowledged Shodan's influence on his thinking about how internet data should be presented. The collection method points the other way: “We don't scan the internet, we listen to the internet.” The distinction is easy to say and demanding to operate.

An alert needs a neighborhood

By 2021, when Morris introduced the GreyNoise blog, the company was operating passive collectors in hundreds of data centers. Its free interface and community API were already reaching thousands of security practitioners. He described a mission of using data to make security teams more efficient and to answer questions that otherwise went unanswered. The blog gave the team room for detail beyond the short bursts of social media.

The idea requires care. Widespread malicious activity can still compromise a vulnerable machine. Knowing that an attack is opportunistic does not make it harmless. It gives a defender another piece of evidence when deciding what to investigate, block or fix. A generic probe, a recognized legitimate service and a more specific intrusion attempt call for different judgments. Treating them as interchangeable makes the queue longer without necessarily improving the decisions.

In a September 2025 conversation with Sprocket Security, Morris returned to the analogy of noise canceling headphones. Measure the ambient activity well enough and a defender gains a way to distinguish it from the local signal. He also stressed that scanning has legitimate uses. Administrators and researchers do it; hostile operators do it as well. Reverse DNS, identifying user agents and respect for opt-out requests can help explain who is doing what.

The difficulty is getting that measurement across enough of the internet. Large cloud providers are only part of the picture. Regional hosting providers bring different interfaces and operational problems. Then an adversary may recognize a decoy, requiring the deployment to be replaced. Morris talks about sensors as things that must be rebuilt repeatedly. A listening post cannot be too precious about its furniture.

The pitch that needed an interruption

GreyNoise raised a $15 million Series A in June 2022, led by Radian Capital, with CRV, Inner Loop, Stone Mill Ventures and Paladin Capital participating. The announcement put total funding at $21 million. It also reported that the free Community plan served analysts at more than 10,000 organizations. Those figures describe the business at that moment, rather than a current census.

In 2021, the company had been selected for the SINET16 Innovator Awards from a field of 190 applicants across 18 countries. External recognition and financing gave the technical idea a business setting. Selling the idea, however, demanded a different skill from building it.

Morris has recounted an early pitch at Black Hat or DEF CON when a listener stopped him: “Stop telling me how it works. Tell me what problem you're solving”. He remembers being offended, then recognizing the advice was correct. A carefully built machine can be a source of personal pride while leaving its prospective customer with an entirely reasonable question about why it belongs in the budget.

He brought the anecdote back when discussing artificial intelligence. His restaurant analogy was pointed: a kitchen's use of woks does not make the restaurant a company selling woks. GreyNoise uses AI; the job remains security. His case for its relevance is that faster discovery and exploitation of vulnerabilities increase the need for timely observations, whether a person or an automated agent uses them. The tool earns its place through the problem it helps solve.

A promotion back to the data

In his February 2024 announcement, Morris described starting alone in an Arlington apartment in 2018. By the time of the CEO handover, GreyNoise had more than 50 employees and over 150 customers. Along the way, questions about filtering alerts had expanded into questions about exploitation: when a vulnerability becomes public, can defenders see whether attackers are actually using it?

He had begun looking for someone to run the business the previous year. Devata arrived from Cisco's Duo and Zero Trust business. Morris's new brief covered technical innovation, AI strategy, examining attacker behavior and being a demanding user of GreyNoise's own products. “It's literally my dream job.” The title changed; the appetite for looking closely remained.

The collaboration has a practical logic. A growing organization needs somebody attending to customers, employees and execution. A founder absorbed by the machinery needs time to work on it. Assigning those responsibilities deliberately is less romantic than the founder who does everything, and probably easier to put on a calendar.

“It's literally my dream job.”

Andrew Morris · on becoming Chief Architect, 2024

Two million packets and a reason to keep looking

The data still produces stories that refuse to behave like ordinary product demonstrations. In September 2024, Morris joined GreyNoise's Storm Watch podcast to discuss a hidden message buried in more than two million misdirected ICMP packets. The episode explored so-called noise storms and speculated about who might have sent the message. The mystery was part of the attraction; the episode's framing did not turn speculation about its author into an established answer.

There is also a continuing effort to make the observation work available to others. Morris and Bob Rudis coauthored the Honeypots Are Back report, addressing targeted attacks, first-party intelligence and the practical obstacles to running decoys. GreyNoise's Project Swarm now invites participants to deploy sensors, contribute device profiles and write detection rules. Participants can inspect captured traffic and compare it with a wider baseline. Morris discussed the project with security educator John Hammond.

The emphasis on first-party evidence gives the original experiment a new setting. Someone can examine a payload, study a session and ask what actually happened. A sensor produces material to work with, including surprises that a predefined list of questions might miss. The wider network makes the local observation more useful, while the local observation can contribute to the network.

In May 2026, Morris wrote about rebuilding the services behind devices on his home network. A smart outlet controlling outdoor lights now took commands through a local API, with no internet access required. A robot vacuum proved more complicated; he worked out how to control it over the local network as well. AI programming tools helped with both projects. His smart television was next on the list. Even the housekeeping, apparently, could become a research assignment.

He has also described a broader wish for security to be included in technology services by their providers. Until then, there are devices to inspect and dependencies to reconsider. Morris's story keeps circling back to the act of looking: at a machine that can run without its hard drive, at logs that change meaning when combined, at millions of packets carrying an unexpected message. Attention remains essential. His contribution has been to ask where it should go. When everything is knocking, deciding which door needs a closer look is a substantial job.