The computer academy was supposed to be educational. To a fourth-grader named Min Pyo Hong, it looked more like a portal to the older boys playing games. His mother had noticed the direction of the world and enrolled him. Hong noticed the games. Then came the catch: to make a machine do anything interesting, he would have to learn its language. BASIC first. Fun later.
He initially felt tricked. The trick worked. Typing commands produced pictures, and pictures became games. Hong later remembered writing roughly 8,000 lines of code for one of them. The more important discovery was not the finished game. It was the feeling of making a computer reveal what it could do.
That feeling has survived every version of his career: teenage experimentation, security contests, a nonprofit hacker collective, two startups, an exit, and a move from Seoul to the San Francisco Bay Area. Hong’s subject is cybersecurity, but his method is older and more portable. He looks at a system, asks where its assumptions fail, and keeps pulling until the hidden structure appears.
Curiosity meets a boundary
By middle school, Hong was hacking because he wanted to play PC games without paying. He has also spoken candidly about selling pirated software CDs in the looser copyright culture of 1990s South Korea. The polished version of a security-founder biography might sand these facts away. Hong has not. They explain why his later definition of a good hacker puts unusual weight on judgment.
“Good hackers and crackers cross the borderline between good and evil.”
Min Pyo Hong on the moral conviction hacking requires
Technical ability opens doors. Ethics decides whether one should walk through them. Hong’s career became a long attempt to institutionalize that distinction. In 1998, he co-founded WOWHACKER, a nonprofit Korean security research group. Its members investigated vulnerabilities, shared technical knowledge, published warnings and competed in capture-the-flag events. It was a laboratory, a community and, eventually, a pool of people who understood one another’s standards under pressure.
Competition supplied the pressure. Hong won an international hacking contest hosted by KAIST in 2000. He later led a team that reached the DEF CON Capture the Flag finals five consecutive times. CTF is part puzzle hunt, part emergency room for software: find vulnerabilities, exploit opponents, repair your own systems, and do all of it while the clock behaves rudely. The format rewards technical range, but it also rewards teams that can communicate without ceremony.
From research group to company
In 2008, Hong founded SHIFTWORKS. The company worked on mobile antivirus and mobile-device management, including V-Guard, as smartphones were becoming the computer people carried everywhere. Infraware acquired the business in 2011. It gave Hong the credential founders cannot obtain from a course: he had built something, sold it, and learned which parts of the old thesis no longer fit the next market.
The next thesis moved one layer up. Protecting the device was useful, but the application itself remained exposed to reverse engineering, tampering and theft. When Hong’s team looked for a sufficiently strong and easy product to protect its own fintech software, it could not find one. So it built one. The internal answer became the beginning of SEWORKS.
The company was established in late 2012. Before launch, Hong made a choice that reveals the operator beneath the researcher. The original plan was consumer-facing. He switched it to business-to-business security. Some employees disagreed strongly enough to leave. Hong believed the enterprise model was the picture he could defend, and in the early years he carried the conviction all the way down to managing servers himself.
Then he made the geographical version of the same bet. In 2013, SEWORKS moved its headquarters toward San Francisco while retaining research and development in Seoul. Hong wanted to compete where the market for security software was larger and where new technology was tested quickly. Crossing the Pacific did not make the work less Korean. WOWHACKER’s culture, the team’s skill in reverse engineering and web attacks, and Hong’s own directness traveled with it.
One idea, three surfaces
AppSolid turned the first insight into a service. Its scan, protect and track approach was aimed at developers who could not afford to bolt together a private security lab. The product protected mobile binaries against decompilation, reverse engineering, memory tampering, piracy and copied intellectual property. Its delivery model mattered as much as the feature list: software as a service, limited integration work, and pricing intended to meet developers before a breach became an expensive education.
The category around SEWORKS widened. Pentoma, launched in 2018, applied artificial intelligence to penetration testing for web applications and APIs. LeakJar, introduced later, focused on the quieter danger of passwords already exposed elsewhere and reused by people who hope the internet has forgotten. Mobile code, application surfaces and credentials look like separate markets. Hong’s connecting idea is that defenders should encounter the weakness before an attacker can profit from it.
This is where his old moral argument meets a contemporary technical problem. AI can scale an attack and it can scale a security test. The mechanics may resemble each other. Intention, permission and verification determine what the activity becomes. Hong was writing about the coming contest between AI hacking and AI penetration testing in 2019, before every software company had added a sparkle icon to its vocabulary.
“All mobile apps can be hacked.”
Hong’s blunt starting point for application security
There is also a less cinematic reason to test early: paperwork after disaster is slow and expensive. Automated tools can work quickly, but Hong has warned about the false positives produced by pattern-based scanners. Fast output is not the same as a useful result. The mature version of offense is not a dramatic break-in demo. It is a repeatable practice in which findings are checked, explained and turned into work a development team can actually complete.
SHIFTWORKS begins with mobile antivirus and device management.
Infraware acquires SHIFTWORKS.
SEWORKS is founded in Seoul, then builds toward the U.S. market.
A $10 million Series A brings disclosed funding to $12 million.
Pentoma brings AI-assisted penetration testing into the product line.
LeakJar adds breached-credential defense.
The founder in the beanie
Hong’s personal trademark is more visible than a security philosophy: a beanie and beard, including at business meetings. Asked about the look often enough to make it a recurring interview subject, he offered an admirably unbranded explanation. It is comfortable. The answer fits a founder described by colleagues as technically hands-on and unusually direct. He appears less interested in the theater of conformity than in whether the underlying system works.
That independence has occasionally become public disagreement. During the major 2009 DDoS attacks on South Korean government and commercial sites, he challenged an attribution to North Korea and pointed instead to attacker infrastructure in the United States. Attribution is difficult, and the episode matters here less as geopolitical drama than as evidence of temperament. Hong will say what he thinks the technical record supports, even when the prevailing story is tidier.
Yet the lone-hacker costume would misread the career. Hong talks repeatedly about teams. WOWHACKER was a collective. DEF CON success was collective. SEWORKS drew on security researchers and developers who had practiced together. In one interview, his pride settled not on personal titles but on the people whose technical ability made the company possible. The beanie is individual. The work is not.
SEWORKS now presents itself as founder-led, with three core products and more than 100 enterprise clients. Its advisory circle includes intelligence, mobile-security and venture experience. The company has changed its product language as threats changed: first harden the app, then automate more of the test, then watch for credentials that have already escaped. Hong’s original question remains visible underneath every layer. What would someone trying to break this notice first?
The useful thing to steal
Most careers look inevitable only after an editor removes the wrong turns. Hong’s still shows the seams: games before programming, rule-breaking before white-hat work, a community before a company, one startup before the next, a consumer plan abandoned for B2B, Seoul connected to San Francisco. The continuity is not a perfect master plan. It is a practiced way of looking.
Founders can borrow that without learning to hook an Android system call. Start with a problem you have felt closely enough to recognize the bad available answers. Build a community of people who care about the craft before you need every relationship to fit an org chart. When the model changes, preserve the insight that made the work distinct. And if your capability can be used on either side of a moral boundary, draw the boundary in advance.
Hong wanted to play games, and the computer demanded that he learn its language first. Decades later, the bargain is still operating. To defend software, learn the language of the person trying to break it. Then make the knowledge useful to everyone standing on the other side of the door.
Min Hong’s operating principle
See the system from the attacker’s side, test the assumption before it becomes an incident, and keep technical curiosity inside a clearly drawn moral line.