Bryson Bort likes a prop. Onstage, the cybersecurity founder has appeared in a unicorn headband and custom hoodies keyed to the old team colors of security: red for attack, blue for defense, purple for the productive collision between them. It is a useful trick in an industry inclined to bury urgency under acronyms. The costume earns attention. Then Bort asks the less decorative question: when an attacker behaves like an attacker, do the controls behave like controls?
That question sits beneath the three organizations most associated with him. GRIMM, the consultancy he founded in 2013, works from the offensive side of difficult security problems. ICS Village, the nonprofit he co-founded with industrial-security specialist Tom VanNorman, lets people encounter the machinery and systems that quietly run modern life. SCYTHE, where Bort is founder and CEO, turns attacker tactics into repeatable exercises that defenders can run against their own environments.
The shared idea is rehearsal. Fire drills do not predict the precise shape of a future emergency. They reveal whether an alarm carries, a door opens and a group of people can turn a plan into coordinated motion. Bort has spent much of his career arguing that cyber defense deserves the same courtesy.
“The starting point to any purple team is leadership.”Bryson Bort, Hacker Valley Blue
A Cold War childhood, taken apart
The first systems Bort tested were small enough to fit in his hands. He has recalled pulling electronics apart as a child, then putting them back together. In high school, graphing calculators became pocket-size game consoles of his own making. He programmed a version of a fighting game and elaborate role-playing games, getting particularly good at pixel art. Curiosity arrived with a screwdriver, a compiler and the suspicion that the sealed box would be more interesting once opened.
Geography supplied a larger frame. His father was an Army officer, and Bort grew up in Germany and the Soviet Union. The family left Berlin shortly before the Wall fell and Moscow in 1990. Technology, infrastructure and state power were not abstractions in that childhood. He saw the Cold War from places where borders carried weight and systems signaled who controlled what.
At the United States Military Academy, he studied computer science and graduated with honors in 2000. He became a Signal Corps officer, working in the military branch responsible for communications. In September 2001 he led a tactical communications platoon supporting Operation Bright Star. He later served as a Battle Captain and Brigade Engineering Officer in support of Operation Iraqi Freedom, leaving the Army as a captain.
His formal education kept accumulating around the work: a master’s degree in telecommunications management from the University of Maryland, an MBA from the University of Florida and graduate study in electrical engineering and computer science at the University of Texas. The mixture matters. Bort’s public work moves constantly among machinery, software, institutions and budgets. A defense can be technically elegant and organizationally useless. A clever tool without leadership support becomes expensive shelf furniture.
The offensive route to better defense
After the Army, Bort worked in manufacturing and built a global team and configuration-management database that, by his account, saved the company millions of dollars a year. He later oversaw a technology refresh supporting embassies and consulates, moved into work supporting a corporate chief technology officer, and was recruited into offensive cybersecurity. He developed research programs, helped shape cybersecurity strategy and eventually led a research and development division tied to national-security priorities.
The nickname “Grimm” came from his counterterrorism work. When he founded a consultancy in January 2013, he chose it over the sort of name that would have put “Bryson” on the door. The decision was partly taste and partly theatre: GRIMM sounded sharper. The firm focused on offensive research, assessments and hard-to-test systems, including automotive and industrial technology.
SCYTHE grew from a problem inside that work. Traditional security assessments were skilled but bounded. A team arrived, tested for a limited window, wrote a report and left. Meanwhile, environments changed. New controls were installed. Old configurations drifted. Attackers adjusted. Bort and his colleagues wanted a way for defenders to model realistic campaigns and replay them safely, often enough to see whether security improved.
The rehearsal loop
With longtime cyber executive Ed Amoroso, Bort helped frame that cycle as Attack, Detect and Respond. The language shifts attention away from a pristine test of one product and toward the untidy whole: can an organization notice a sequence, interpret it and act? Their collaboration began in conversation, as useful ideas often do, while trying to describe an area that did not fit neatly into the available categories.
Where the cloud touches concrete
Industrial control systems make Bort’s thesis physical. The abbreviation “ICS” covers technology that helps move fuel, manage water, operate factories and control equipment. Downtime can become more than an inconvenience. Yet many security practitioners spend their careers in ordinary enterprise networks, far from a programmable logic controller or the constraints of a plant where safety and uninterrupted operation come first.
ICS Village closes some of that distance. Its volunteers build and transport working models, offer capture-the-flag challenges and create hands-on learning at gatherings including DEF CON and RSA Conference. The nonprofit’s GasPot lab resembles a scale industrial site rather than a slide about one. Bort hosts its Hack the Plan[e]t podcast, which asks what happens when the systems people rely on become increasingly connected.
The village also explains his habit of moving between private companies and public institutions. Bort has advised the Army Cyber Institute, served as a senior fellow at George Mason University’s National Security Institute and held a nonresident fellowship with the Atlantic Council’s Cyber Statecraft Initiative. SCYTHE lists him on West Point’s Board of Cyber Science and as a senior policy advisor to the Institute for Security and Technology. For him, a factory network, a military mission and a company risk register are different views of the same dependency: digital behavior now changes physical outcomes.
“Ensuring our preparedness, resilience, and response isn’t optional; it’s a responsibility.”Bryson Bort, on his 2025 Industrial Cyber Hall of Fame induction
The CEO and the janitor
Bort’s public persona is unusually frank about the comic compression of startup life. He has described a founder as both chief executive and janitor. At a conference interview, he reduced the vendor’s endless pitch to three cheerful prompts: have you heard of SCYTHE, why have you not heard of SCYTHE, and when do you want to buy? The joke works because it admits the labor beneath the title.
He speaks just as plainly about teams. In discussing SCYTHE’s growth, he argued that founders can overvalue unique technology and miss the people who make a company succeed. His view of purple teaming follows the same logic. Red and blue skills do not combine by buying a purple product or renaming a meeting. Leadership has to care, the business has to participate and the exercise has to produce a workflow people will use.
Recognition has followed: a place on Business Insider’s 2020 list of 50 cyber leaders, the SANS Institute’s 2023 Innovator of the Year award, CISSE’s 2024 Industry Leadership honor and induction into Industrial Cyber’s Hall of Fame in 2025. His LinkedIn name still carries a unicorn emoji. The symbol fits more than the merch. A “unicorn” can mean a rare startup, an improbable creature or the person in the room willing to look slightly ridiculous so everyone remembers the lesson.
A defense that can learn
Bort has said organizations should be as sentient as their attackers. The useful part of that metaphor is awareness. Attackers watch, adjust and keep moving. A defensive program built around an annual snapshot cannot answer in kind. Continuous validation offers a feedback loop: emulate a behavior, see what happened, repair the weak point and run it again.
There is restraint inside the idea. Adversary emulation does not promise perfect safety. It supplies evidence about a particular environment at a particular moment. The finding might be an alert that never reached an analyst, a control that drifted, a response that took too long or an assumption nobody had thought to test. Each is more useful discovered in rehearsal than during an incident.
The ambition visible across Bort’s work is preparedness with receipts. Build talent. Let practitioners touch the systems. Translate threat intelligence into behavior. Give attackers and defenders a shared exercise. Bring the result to leaders in language they can act on. Then repeat, because the machinery changes and the opposition does too.
It is serious work, carried by someone who opens interviews with “Every day is a holiday.” The line has just enough mischief to survive a four-day security conference. It also captures Bort’s durable method: use levity to invite people in, then show them the alarm, the exit and the reason to practice before smoke enters the room.