Dylan Ayrey's company began with a search box that would not go far enough. In 2016, unemployed and installed on his Rochester Institute of Technology classmate Dustin Decker's living-room sofa, Ayrey was hunting bug bounties. The interesting prizes were credentials: API keys, passwords, tokens, the little strings that let one machine persuade another that it belongs. GitHub could search the code in front of him. It was less helpful with the old commits, where an embarrassed developer might have deleted a secret from view without killing the secret itself.
So Ayrey wrote a Python tool to dig through revision history. He called it TruffleHog, an excellent name for software that noses below the visible surface and reports what it smells. The first job was practical and narrow. Find high-entropy strings. Help a bug hunter locate credentials. Make the inaccessible past searchable.
Then he did the consequential thing: he put the code in public. Other researchers used it, companies folded it into their security work, and contributors taught it tricks its author had not anticipated. Ayrey presented it at conferences and maintained it on weekends. For five years, it looked like a side project with an unusually active social life.
“I never planned on turning it into a company. It was just an open-source thing that I presented at conferences and maintained on the weekend.”Dylan Ayrey, 2023
The deleted file that refused to leave
TruffleHog rests on an impolite fact about software: deletion is often choreography. A file vanishes from the current branch, everyone feels cleaner, and its old contents remain available through Git history, pull-request references, caches, logs, packages, images, or some helpful platform API. If the credential itself has not been revoked, cosmetic disappearance changes very little.
That observation became Ayrey's recurring subject. He and his colleagues studied credentials beyond source repositories, from chat systems and cloud storage to container images. They examined 57 million GitHub usernames and reported 11,554 accounts using 1024-bit SSH keys. They tested symmetric JWT signing secrets and found 1.2 percent of the production examples in their dataset could be guessed within seconds. In another disclosure, Ayrey showed how a former employee could retain access to applications through a Google OAuth edge case after being removed from the company's Google organization.
The scanner grows a judgment system
The interesting progression is from resemblance to consequence. An early scanner asks whether a string looks secret. TruffleHog v3, released in 2022, made live verification central: when the engine finds a supported credential, it can ask the provider whether that credential works. The company's later analysis products ask the more expensive question. If it works, what permissions and resources sit behind it?
Security teams have no shortage of machines willing to make them anxious. Verification trims false positives. Context lets them rank the remaining alarms. The product journey is a steady approach toward the human decision at the end: rotate this one first.
Open source as a long hallway
Ayrey arrived at this model before he arrived at the company. At RIT, where he earned a computer-engineering degree in 2015, he took an open-source class and joined the scene around its clubs and hackathons. He has described open source less as a licensing tactic than a portable community. People can change employers while their collaboration continues in public.
His favorite proof came from an intern he had worked with at Salesforce. She later joined Airbnb, operationalized TruffleHog there, contributed features, and kept working with Ayrey through the project even though their badges no longer matched. Two companies that had no reason to coordinate acquired a shared workshop anyway.
That helps explain the boundary Truffle Security chose when it formed in 2021. Ayrey left Netflix and started the business with Decker and Julian Dunning. The open-source detection engine remained available to researchers and small teams; enterprise users paid for orchestration and organizational features. The commercial layer funded work on the common engine. Community was neither decoration nor an acquisition funnel with a friendly haircut. It was where use cases arrived.
Leaving Netflix also changed Ayrey's relationship to the project. Instead of meeting users around the edges of a full-time job, he could spend his days hearing how they bent the scanner to fit environments he had never seen. He has said, in hindsight, that he wished he had joined that community full-time sooner. The remark contains a founder's useful reversal: the audience was not waiting for him to invent demand. It was already busy, producing bug-bounty tales, enterprise workflows, contributions, and requests. His task was to notice that weekend maintenance had quietly become stewardship.
“It's crucial to us to support the little guy and give back to the community.”Dylan Ayrey on the free and paid boundary
The approach attracted capital because it had already attracted behavior. Andreessen Horowitz announced a Series A investment in December 2021. In November 2025, Intel Capital and a16z led a $25 million Series B. By that announcement, TruffleHog had more than 23,000 GitHub stars, 15 million downloads, and 250,000 daily runs. The company said its detector coverage had passed 800 types. Ayrey and fellow scanner authors Zach Rice and Brad Larsen wrote that TruffleHog also supported more than 40 analyzers, which add information about what a leaked credential can do.
A key inside the bed
Ayrey is also attentive to the theatrical problem of security: accurate information can be dull enough to defeat itself. In an interview about security storytelling, he contrasted a large daily count of leaked Amazon keys with a single, stranger discovery. He had found an AWS key inside the firmware of his connected bed.
The bed did what a tidy statistic could not. It gave the risk upholstery. People could picture the object in a bedroom, connected to a home network, carrying cloud credentials and remote-access machinery. The concrete detail opened the door for the technical questions.
This is a pattern across his public work. A malicious website can alter a copied command and add a newline so the terminal runs it immediately. A domain's former owner can leave behind a still-valid certificate. A short RSA key can look official while being weak enough to factor. An employee can leave the directory and stay inside the apps. Each subject is abstract until Ayrey finds the everyday action that makes it slightly alarming: paste, delete, log in, go to bed.
The playfulness is useful because the recommendations are sober. Revoke leaked credentials rather than merely erasing the file. Generate strong keys for users when a platform can do so. Prefer signing designs that do not invite guessable shared secrets. Disclose vulnerabilities with timelines and enough detail for affected teams to act. A memorable prop earns attention; evidence keeps it.
The company catches up with the pig
Writes the first TruffleHog for bug-bounty research and releases it as open source.
Presents GCP lateral-movement and privilege-escalation research at Black Hat and DEF CON.
Leaves Netflix to co-found Truffle Security; a16z announces its Series A investment.
Publishes studies of weak GitHub SSH keys and guessable symmetric JWT secrets.
Raises a $25 million Series B and launches GCP Analyze for credential impact context.
The latest chapter widens the noun. The industry increasingly calls machine credentials and service accounts “non-human identities.” Ayrey's argument is that the problem underneath the new label is familiar. Teams still need to find credentials, determine whether they are live, understand the identity and permission structure attached to them, and remove the dangerous ones without drowning in alerts.
Truffle Security's GCP Analyze launch in 2025 placed that ambition in the product: map the access and possible blast radius behind a leaked Google Cloud credential. The stated roadmap extends analysis toward AWS and Azure, along with credential inventory and productivity tools. It is a move from the archaeology of accidents toward the management of all those machine relationships before an accident becomes the organizing event.
Still, Ayrey's most revealing answer about entrepreneurship is smaller than a funding round. Asked about his best days building Truffle Security, he chose the conversations: hearing the odd bug-bounty stories, the unexpected deployments, the ways people had made TruffleHog useful. The answer matches the architecture of his career. Write a tool to reach into history. Publish it. Watch strangers carry it somewhere you did not plan. Then follow them, notebook open.
There is a pleasing circularity here. TruffleHog began because software kept more history than its interface admitted. The company grew because open source did the same. It preserved relationships across jobs, accumulated contributions across years, and kept evidence of demand long before there was a sales team to name it. Ayrey went digging for forgotten credentials and found that the repository was also keeping a record of what he ought to build next.