Dafydd Stuttard gave his software a name that made a noise. Early versions of Burp really did burp. It is a pleasingly undignified beginning for a tool that would end up helping people test the security of serious organizations. There was no particular reason for the name. There was, however, a very particular reason for the software: parts of his working day were tedious, and he thought a computer ought to do them.
At the time, Stuttard was a penetration tester, paid to find weaknesses in applications before somebody less welcome did. The interesting work involved curiosity and judgment. The surrounding work could involve repeating an action, changing something small, and examining the result. He began making tools for himself. Burp found other people with the same problem.
That practical beginning runs through his subsequent career. Stuttard became the founder and CEO of PortSwigger, a co-author of The Web Application Hacker’s Handbook, and the creator of the original material for the Web Security Academy. Each added a different way to help someone understand or perform security testing. The impulse was unusually consistent: take a difficulty encountered at work and make it easier for somebody else to deal with.
A more interesting kind of trouble
His first job was in IT auditing. He found it dull. Getting to know people who did penetration testing introduced him to a more appealing occupation, and they helped him learn it. What attracted him was the opportunity to solve unusual problems and think mischievously. Security gave those inclinations an authorized purpose. A stubborn application could become a puzzle rather than a form to be completed.
The name PortSwigger arrived as a small joke. Computing tools often had “port” in their names; Stuttard also liked a glass of port. His online handle joined the two. Eventually the handle became the company name. The vocabulary has remained convivial: his author biography calls him Chief Swig. A reader can reasonably enjoy the fact that such language survived the arrival of enterprise software.
Burp was released in 2003, years before PortSwigger Ltd was incorporated in 2008. Those are different beginnings: a piece of software going out into the world, then a company taking formal shape around the work. Stuttard’s later account of entrepreneurship resists a perfectly rehearsed founding myth. He did not set out with a grand plan to build a business. He made something useful and discovered that people would pay for it.
“I got to solve weird problems, and be devious, both of which appealed.”
Dafydd Stuttard · 2013
The work behind the button
His old technical posts make the origin feel tangible. In October 2007 he introduced Burp Sequencer, a tool for evaluating the randomness of session tokens. These are among the bits of data that help applications recognize users. If they are predictable, that can become a security problem. Sequencer brought statistical tests and graphical results to a question that is awkward to judge by eye.
A follow-up in May 2008 began with a conversation with a friend. Stuttard had realized that capable hackers using the tool did not necessarily understand its workings or its results. He wrote an explanation. The episode reveals an occupational hazard of good software: making something easy to run can conceal how much there is to understand. The toolmaker had to become a teacher, too.
The pattern is visible in the way he presents these additions. He explains the situation a tester is likely to face, walks through the action, and then describes what the result means. That makes the archive a record of product development at the scale of a working day. The reader can see exactly where another awkward minute might be saved.
In 2011, another post described a way to test access controls through a browser. The aim was to reduce the labor of repeating a sequence of requests in a different user’s session. Such details are less glamorous than an account of a spectacular breach. They are also closer to a working tester’s day. Stuttard kept looking at the small operations that consumed attention and asking which ones software could handle.
The book that opened a lab
Alongside the software came a substantial collaboration with Marcus Pinto: The Web Application Hacker’s Handbook. Its first edition appeared in 2007. The pair also taught the material in person. Their 2013 Black Hat course combined demonstrations with more than 150 lab exercises and finished with a capture-the-flag contest. Students brought laptops. Learning was expected to involve trying things.
The teaching format matters to the story. A security technique on a page can seem straightforward until an actual application refuses to behave as expected. A lab makes that friction available without requiring a real customer’s system. The combination of explanation, demonstration, and practice gave the handbook’s material another life, with the authors present to deal with the questions.
When a third edition became a possibility, Stuttard chose another form altogether. He created the core content for a free, interactive online platform. The Web Security Academy launched on 2 April 2019, beginning with four familiar vulnerability types, including SQL injection and cross-site scripting. Readers could move from the lesson into a browser-accessible lab and test what they had just learned.
An online academy also offered a way to keep the material moving. New discoveries could become lessons without waiting for another printing. PortSwigger’s team has continued maintaining and extending the resource. There is a sensible generosity in that arrangement: sell software that helps people work, while letting people acquire knowledge without buying a textbook. The free classroom became one of the founder’s lasting contributions.
- 2007The handbookStuttard and Pinto put the methods in print.
- 2013The live classroomBlack Hat training pairs explanation with practical labs.
- 2019The open browserThe free Web Security Academy launches.
A company, almost by accident
Stuttard has described the early financial logic with disarming simplicity. Customer revenue gave him money to build a team. He did not initially think of this as adopting a particular funding philosophy; he assumed that was how businesses worked. A strategy label arrived after the behavior. It is a useful complication for anyone hoping to extract a tidy formula from his career.
By April 2019, PortSwigger was receiving a Queen’s Award for Enterprise in International Trade. At that point the company reported customers in 130 countries and a team of 40. They show how far a personal utility had traveled: other people were using it, paying for it, and supporting an employer in northwest England.
The expanding business also created room for other initiatives. In July 2021, PortSwigger announced a scholarship intended to encourage young women into technology, combining university support with paid work opportunities. Stuttard spoke about women’s under-representation in software engineering and the contribution the industry was missing. The scheme connected the company’s hiring interests with a practical route into the work.
What changes when the investor arrives?
On 27 June 2024, Brighton Park Capital announced a $112 million investment in PortSwigger. It was the company’s first external investment. The number makes an obvious headline, but the terms explain more about Stuttard’s position: the investor took a minority stake, and the business retained overall control. He was bringing in a partner after years of developing the company through its customers.
His announcement set out the pressures behind the decision. Enterprise teams faced more applications, quicker releases, and complicated web infrastructure. PortSwigger wanted to develop its products, increase research and community work, and hire across the business. It also planned a US presence. A tool written for one practitioner now had to answer the needs of teams operating across larger organizations.
There is an interesting management problem inside that expansion. The individual tester wants useful control over a particular investigation. An enterprise wants repeatable coverage across many applications. Stuttard’s announced ambition was to serve both. Bringing in investment did not settle that tension; it provided more resources with which to work on it. The founder’s original customer, the practitioner at the keyboard, remained part of the brief.
Brighton Park Capital came in as a minority investor.
The next repetitive task
By 2025, the conversation had moved to AI. Stuttard and research director James Kettle joined Clint Gibler to discuss Burp AI, including assistance with investigating possible issues and exploring variations on test inputs. The demonstrations linked a new technology to a familiar job: taking leads that a tester might otherwise have to pursue through repeated manual steps.
In May 2026, Stuttard made a more pointed argument about agentic testing. Greater capability, he argued, increased the need for governance. He wanted controls around the model’s actions, human decisions where they mattered, and records of what had happened. He was describing a product direction as well as a professional responsibility. Giving software more initiative made the design of its boundaries consequential.
Burp AT subsequently arrived, and an October 2026 product update described custom skills, task goals, additional context, and ways to approve or redirect an agent’s actions. These are concrete attempts to let a practitioner delegate work while still shaping it. They also bring the discussion back to education. Someone has to understand the investigation well enough to decide whether the delegated work is useful.
Stuttard’s career has repeatedly put him near that junction between making work easier and helping people understand it. He built tools, explained their results, taught classes, and put lessons into free labs. Now the tools can undertake more of the investigation themselves. The question has become how much responsibility a tester can hand over while continuing to exercise judgment. Burp may have grown up, but there is still an unfinished chore on the desk.