Benjamin Harris keeps an original poster for the 1995 film Hackers. It is the sort of prop that could feel painfully arranged in a founder's apartment, except that Harris had earned it the inconvenient way. Long before pitch decks and conference badges, he found a story about a teenager breaking into the Pentagon from a bedroom computer. Something clicked. He began teaching himself how systems worked, and how they failed. School proved less charmed by the experiment.
At seventeen, after warnings and an intrusion into the school network, he was told to leave. Harris later remembered the meeting with dry economy: it was not friendly, and his father concluded that education was probably not for him. The family offered a sharper curriculum. Find work within two weeks, or find somewhere else to live.
Within that fortnight he joined Portcullis Computer Security. He left school with two GCSE O Levels and entered an industry where curiosity, properly aimed and contractually authorized, could become a career. The same instinct that had closed one door opened a server room full of them.
“I have a genuine interest in cybersecurity and computers, and want to make a positive impact in the world through a career in these fields.”Benjamin Harris
The useful kind of trouble
It is tempting to polish this into destiny: the teenage hacker, naturally bound for the corner office. Harris's actual path was more practical. At Portcullis, then MWR InfoSecurity and F-Secure, he spent a decade doing offensive security. He tested systems, led consulting teams and watched large organizations wrestle with the gap between what they owned and what the public internet revealed.
A conventional penetration test was a photograph. A skilled team arrived, examined a defined slice of the estate, wrote a report and left. The photograph could be excellent. The landscape still changed the next morning. New cloud services appeared. Forgotten domains lingered. A vendor disclosed a flaw in an appliance facing the internet. Attackers did not wait for the next annual appointment.
At twenty, another unlikely door opened. An employer needed someone in Singapore. Harris raised his hand for a one-way ticket. He arrived with three suitcases, a hotel room and, in his own later telling, no real plan. The move lasted roughly a decade.
Offensive security
watchTowr founded
US expansion
Singapore became his operating school. He worked with banks, insurers and governments, built teams across Asia, served as an assessor and advisory-board member for CREST, and sat on an executive committee at Singapore's Association of Information Security Professionals. He learned the texture of enterprise security: technical brilliance meeting procurement, regulation, sprawling infrastructure and the stubborn physics of change windows.
Turn the consultant into software
By 2021, Harris had a thesis. Organizations did not need another inventory of possible problems. They needed a live view of how an attacker could get in today, with the questionable findings filtered out and the credible paths proved. The offensive consultant's workflow had to become continuous.
He founded watchTowr in Singapore that August. The early product grew from scripts assembled during his consulting years: discover an organization's exposed assets without installing agents, apply the reconnaissance and testing techniques an adversary would use, and validate the weaknesses that were genuinely exploitable. The company emerged from stealth in February 2022.
The name evokes a watchtower: a place from which to see trouble crossing the territory. The capitalization, watchTowr, looks as if a vowel failed a security check. Underneath the branding sat a serious proposition. If the outside of a company changes continuously, testing it should do the same.
“The reality is we need to build technology that will help us defend organisations at scale from a constantly evolving threat.”Benjamin Harris
Investors followed the argument. A $2.25 million seed round arrived in 2022 from Wavemaker Partners and Vulcan Capital, followed by an $8 million pre-Series A co-led by Prosus Ventures and Vulcan. Forbes placed Harris on its 2022 30 Under 30 Asia list for enterprise technology. In October 2024, watchTowr announced a $19 million Series A led by Peak XV Partners, with returning participation from Prosus and Cercano.
Funding is a useful mile marker, not a description of the road. Harris's more revealing measure is time. How quickly can a defender move from hearing about a new vulnerability to knowing whether it is exposed? How quickly can a research team reproduce the attack? How much of the panic between disclosure and patching can be replaced by a validated answer?
A $20 loose thread
watchTowr's research blog shows how the thesis behaves in the wild. During Black Hat in Las Vegas in 2024, Harris and colleague Aliz Hammond were avoiding the heat and the hotel's $20 bottles of water when they investigated an unregistered domain once used by the .MOBI registry. They bought it for $20.
Systems were still sending traffic to the forgotten domain. The pair found themselves able to affect domain-ownership verification and obtain trusted certificates in circumstances nobody wanted. The research traveled from a cheap purchase and an idle question to a broader debate about using WHOIS email addresses for certificate validation. A follow-up investigation found another expired domain tied to old infrastructure and another remarkable trail of requests.
There is a characteristic watchTowr rhythm here: notice the loose thread, pull it farther than polite software expects, disclose the consequences, then tell the story with technical detail and a joke about poor-quality memes. Harris's public voice is cheerfully self-deprecating. It makes the grave material readable without making it frivolous.
Fifteen years between two rooms
In 2025, Harris moved from Singapore to New York to focus on watchTowr's US expansion. His announcement included a joke about the complexity of securing a visa with “little to no education,” thanks for the character references, and a tease that APAC leader Elvina Liow had wasted no time making sure he would actually leave. The company by then had teams in Singapore, Britain, Australia and the United States.
That August, Harris sat for a short interview on NYSE TV. He noted the timing himself: almost exactly fifteen years earlier, he had been dragged into an office and kicked out of high school. Now he was in another institutional room, explaining why conventional defenses struggle when attackers exploit newly disclosed vulnerabilities within hours.
The neat reversal makes good social copy. The less cinematic continuity matters more. Harris kept doing the same kind of work: looking from the outside, doubting the official map, testing the seam, asking whether the problem was real. watchTowr turned that habit into a platform and attached a business model to the minutes it might save.
By 2026 his writing had moved further into the patching gap. AI, he argued, was accelerating a trend already underway. Exploitation timelines had shrunk from weeks to days and from days to hours. Patching remained essential, but large organizations could not always safely patch in minutes. His proposed sequence was to identify exposure rapidly, apply controlled network-layer mitigations where appropriate, retest, and then complete remediation without the same degree of panic.
“When exploitation happens in hours, watchTowr delivers what no one else can: time to respond.”Benjamin Harris
The aspiration is visible in that final word. Security products usually sell protection, certainty or control. Harris talks about time. Time to know which assets matter. Time to distinguish a theoretical warning from a reproducible route in. Time to fix the right thing before somebody less friendly arrives.
His own career has an odd relationship with time. Two weeks to find a job. A one-way move at twenty. Annual tests compressed into continuous work. Fifteen years from expulsion to the stock exchange's television studio. The biography resists a tidy lesson, but it offers a useful one: an unconventional beginning can still produce a remarkably consistent body of work.
The Hackers poster survives because the joke still works. A teenager stared at a myth of the curious outsider and caused trouble. The adult built guardrails, teams and software around the useful part of that impulse. He did not stop looking for the unlocked door. He changed who receives the report.