Min Pyo Hong wanted the games. His mother wanted him to learn about computers. At the computer academy she enrolled him in, the older boys appeared to be having a splendid time. There was, however, a condition attached to joining them: he would have to learn BASIC. A fourth-grader had discovered the small print.
He persevered. Commands became pictures; pictures became something he could play. He later recalled writing 8,000 lines of code. The attraction was the ability to make a thing himself. Before there was a company, a security product or a business card, there was a child willing to do an unreasonable amount of typing for a reasonable amount of fun.
Today Hong is the founder and CEO of SEWORKS, based in San Francisco. He works in a profession where the question “Does it work?” is only the beginning. The next question concerns what happens when somebody persuades it to work differently. His career has followed that second question from competitions to mobile software and, now, AI-assisted security testing.
The games came with consequences
By middle school, Hong was experimenting with hacking to get PC games without paying. He has also spoken openly about selling pirated software CDs in the 1990s under the name HongCD. It is an awkward detail for a later career protecting developers’ work, and a useful one. He knew that software could acquire an unauthorized second life because he had participated in giving it one.
The boundary between investigation and damage became a subject he addressed explicitly. “They always have to keep their strong moral conviction,” he said of hackers and crackers. Skill alone could not settle the matter. A person who understands how to enter a system still has to decide whether entering it is permitted.
In 1998, he founded WOWHACKER, a nonprofit security research group. Its members investigated vulnerabilities, studied possible attacks, circulated technical knowledge and took part in competitions. The group gave people with an unusual interest somewhere to put it. It also created relationships that would eventually extend into SEWORKS, where engineers from WOWHACKER joined the business.
Hong won an international hacking contest hosted by KAIST in 2000. His team later reached the DEF CON Capture the Flag finals five consecutive times. Those are team credentials, earned in an environment built around finding and defending weaknesses under pressure. The solitary hacker makes a convenient movie character. Hong’s record contains rather more colleagues.
A company changes the question
He founded SHIFTWORKS in 2008, working in mobile antivirus and mobile-device management, and subsequently exited the business. Smartphones were creating another place for security expertise to become a product. Hong had moved from demonstrating that he could find a weakness to organizing a company around the needs of people who wanted fewer of them.
SEWORKS followed in late 2012. The original business plan was aimed at consumers. Before the company launched, Hong switched it to selling to businesses. Some employees opposed the decision strongly enough to leave. A change of customer can sound tidy in a presentation; inside a young company, it changes what people have agreed to build.
Hong later described the early years as intensely founder-driven. He even managed servers himself. That detail helps explain the distance between the titles CEO and hacker in his case: the distance could be short enough to cross during a working day. The responsibility for the business and the machinery supporting it met at the same desk.
AppSolid gave the company a practical proposition for mobile developers. Its launch message organized the work into three verbs: scan, protect and track. Developers could assess their apps, apply protection to the compiled software and monitor threats after release. Security had to remain useful after the celebratory launch email had disappeared down the inbox.
San Francisco required more than an address
In 2013, Hong moved SEWORKS toward the American market, opening in San Francisco while research and development remained connected to Seoul. He had watched the American security company Lookout grow and had begun to question how much the market itself determined a business’s prospects. Comparable expertise did not automatically produce comparable opportunities.
He learned that a local address was only part of the bargain. Customers and investors needed to believe the company was staying. The founder’s presence mattered because decisions needed to be made there. A distant office could introduce a product; Hong wanted to build a business with enough authority on the ground to sell it.
His assessment of the two markets was blunt. In 2021, he complained about Korean contracts that paid for the first year and then reduced subsequent payments to a small maintenance fee. He believed the American market offered a better chance of being paid for quality. This was his account of the commercial problem, and it explains the move more precisely than a postcard of Silicon Valley.
The move also widened the people he could work with. He recruited Mary Min, an entrepreneur with experience building and selling gaming companies, who helped develop business relationships. Technical capability had traveled across the Pacific. Sales, partnerships and introductions still had to be assembled. A good product needs somebody to arrange the next conversation.
A local address was only part of the bargain.Presence, decisions and a reason to stay
The app has a front door, too
Hong’s argument about mobile security began with a neglected layer. Companies could protect a server or a device while leaving the application itself exposed. In his writing, he described attacks that intercepted communications, copied software or manipulated memory. Each attacked a different assumption about what an app could safely trust.
A copied game offered a particularly clear business example. If someone modified the original code to remove advertising or give away paid items, the developer’s carefully designed revenue model could stop behaving as intended. The damage did not require a dramatic theft from a central vault. It could begin with changing the little program already in a customer’s pocket.
AppSolid’s approach made application protection available as a service. Its early proposition reduced the work needed to apply security to an app developers had already built. The company’s launch letter described protection against reverse engineering and tampering, followed by monitoring of the tools being used against protected apps. Those tasks connect engineering to the less glamorous question of keeping a product’s economics intact.
Hong also wrote that security needed to exist across the ecosystem. No single measure covered every layer. That admission gives his argument its weight: a useful defense can have limits and still be worth applying. A security product earns its place by addressing a particular weakness clearly, rather than promising that the internet has finally become well behaved.
An attacker’s clock runs quickly
SEWORKS launched Pentoma in 2018, extending its work into AI-powered penetration testing. The underlying idea was familiar to Hong: investigate a system from the position of someone trying to exploit it. The new challenge concerned how much of that investigation software could carry out, and how quickly useful findings could reach the people responsible for repairs.
By 2019, he was writing about attackers using AI to conduct more attacks faster than humans could. He argued that defensive practices built around earlier threats would struggle with the resulting demands on time and resources. Automation would affect both sides. Waiting for trouble to announce itself was becoming an expensive scheduling policy.
The company’s current product range includes Pentoma for penetration testing, AppSolid for mobile application hardening and LeakJar for breached-credential defense. Passwords introduce another route into an account: a secret exposed somewhere else may be reused here. LeakJar brings that risk into the same broad business of locating an opening before somebody takes advantage of it.
SEWORKS lists more than 100 enterprise clients and $12 million in funding. Its advisory circle includes former CIA intelligence officer Andrew Kim, mobile-security entrepreneur Zuk Avraham and investor Perry Ha. These are company facts, but they also show how Hong’s working circle has expanded beyond the researchers with whom he began.
The beanie survives the business meeting
Hong wears a beanie and keeps his beard, including at business meetings. When asked about the look, he has offered the explanation that it is comfortable. It is a pleasantly economical answer in an industry that can turn a choice of sweater into a theory of leadership. The hat appears to have escaped the branding department.
His ambitions have been less modest than his explanation of the hat. In 2016, he spoke about wanting success abroad to give younger Korean security researchers the confidence to enter global markets. He also described hiring as a difficult task: technical skill, temperament and what the company could offer had to fit together. Knowing talented hackers did not remove the work of employing them.
He has continued to add to his professional toolkit. His public profile records a Stanford advanced cybersecurity credential issued in 2017 and a Drata Fundamentals certification issued in June 2025. His GitHub profile identifies him as a Fellow at Hashed Vibe Labs and features a prompt-injection defense project. The questions surrounding software have changed; he is still examining them.
The appealing part of Hong’s story is how little of it could have been written into a childhood plan. Games led to programming. Hacking led to a research community. A mobile-security company led to another company and another country. Along the way, he had to choose customers, recruit colleagues and make technical expertise legible to buyers.
The original pleasure was making a computer do something. His later work asks whether it can be made to do something its creator never intended. That second possibility is troublesome for a developer and absorbing for a hacker. Hong has spent his career trying to put those two people on speaking terms, preferably before the bill arrives.