A computer is a rather successful disguise. From the outside, it looks like one machine. Open it, and the apparent simplicity breaks into components, controllers and their own small territories of code. Yuriy Bulygin has spent much of his working life investigating those territories. The part that interests him is frequently the part its owner has never thought to inspect.
Consider the server’s baseboard management controller, or BMC. It helps administrators manage equipment remotely. It has its own firmware and can operate independently of the main operating system. In the wrong hands, that convenient administrative power becomes a considerable liability. The computer you use has another computer helping to run it. That second computer deserves questions of its own.
Bulygin, the co-founder and CEO of Portland-based Eclypsium, has built a company around asking them. Before the company came CHIPSEC, his open-source framework for assessing hardware and firmware security. Before the framework came years of research at Intel. Across the changes in job title, the work kept returning to the same awkward gap: organizations depend on devices whose interiors they barely know.
A cryptographer learns to distrust the box
Bulygin holds a doctorate in cryptography and a master’s degree in applied mathematics from the Moscow Institute of Physics and Technology. His early career included Kaspersky Lab’s Technological Research team and teaching information security at MIPT. He joined Intel in 2006. The mathematics had brought him to security; the machinery supplied an expanding collection of practical problems.
His public research archive records a 2007 Black Hat presentation on remote and local exploitation of network drivers. Wireless connections offered a particularly uncomfortable possibility: a vulnerable laptop could be attacked without the sort of visible connection its owner might notice. The work included examples involving Intel wireless drivers and ways to uncover weaknesses. Hardware already had plenty of software trouble.
By 2013, Bulygin, Andrew Furtak and Oleksandr Bazhaniuk were presenting a software bypass of Windows 8 Secure Boot at Black Hat. Secure Boot was intended to protect the startup process. Their demonstration examined how mistakes by platform vendors could undermine those protections. A mechanism could be sound in principle while the machine containing it still admitted an attack.
That distinction would keep returning. A security feature has to survive its implementation, configuration and relationships with other components. The conference description included a practical purpose alongside the demonstration: explain how vendors could avoid the mistakes. Finding a way through a defense was part of learning how to make the defense hold.
Give the question away
CHIPSEC’s first public version appeared at CanSecWest in March 2014. It brought security tests, low-level access tools and forensic capabilities into a framework others could use to inspect platforms. BIOS and UEFI firmware, hardware configuration and platform components became subjects for repeatable examination. A researcher’s question could now travel without its original author accompanying every machine.
Making the framework open source also gave the work a life beyond a single employer. The repository offers code and documentation rather than a requirement to take someone’s assessment on faith. For a subject concerned with the limits of inherited trust, that is an appropriate way to begin: let other people examine the tools as well as the equipment.
Bulygin and his colleagues kept presenting. In 2015, their work examined vulnerabilities in System Management Interrupt handlers. In 2017, Bulygin and Bazhaniuk demonstrated how firmware weaknesses could undermine Virtualization-based Security. The layers changed; the consequence remained familiar. Protection higher in the system could depend on code below it doing its job correctly.
Their presentation titles sometimes allowed themselves a little levity. Bulygin’s archive includes Exploring Your System Deeper Is Not Naughty. Firmware research is hardly short of serious consequences, but a roomful of people contemplating low-level interfaces can still appreciate a title with a pulse.
In 2017, Bulygin and Bazhaniuk founded Eclypsium. Bulygin later recalled that they started it during a total solar eclipse. It was an unusually well-timed celestial event for a company concerned with things disappearing from view. The enterprise problem was less theatrical: someone had to turn specialized inspection into work an organization could sustain.
There were people behind that transition as well as code. Madrona’s account of its early investment recalls an introduction to Bulygin in summer 2017 through Will Peteroy of Icebrg and Drew Smith of Oregon Venture Fund. The firm saw a security market concentrated on software above the operating system, with comparatively little attention paid to firmware and hardware beneath it.
“Solve a real problem - not just a novel one.”
Yuriy Bulygin, advice to entrepreneurs
His own explanation of the career move is more hesitant than the usual founder legend. He has described preferring comfort and having to push himself toward risk, both in immigrating to the United States and in leaving an established career to start a company. He credits his wife, co-founder and early team with helping make the venture possible.
He also traces his interest in cybersecurity to a lecture by professor Gabidulin and David Kahn’s The Codebreakers. The recollection gives this career a quieter beginning than a dramatic breach: an idea explained well, a book read with interest, a subject that kept opening into another subject.
The previous tenant has left something behind
Eclypsium’s research soon made the hidden layers tangible. In February 2019, the company published a bare-metal cloud investigation. Renting a dedicated physical server sounds reassuring. Yet the server may have served someone else before it serves you, and it will probably serve someone else afterward. Reclamation has to address what persists inside the machine.
The team changed BMC firmware on an IBM SoftLayer server, released the equipment and reacquired it through a different account. The investigation tested whether the change survived the provider’s reclamation process. It did. The company called the vulnerability Cloudborne and emphasized that the underlying class of problem extended beyond a single provider.
The experiment gave Bulygin’s business thesis a particularly clear illustration. A customer can leave without every trace of their access necessarily leaving with them. Reinstalling the main operating system and inspecting the firmware are different jobs. Cloud computing makes hardware easier to rent; it leaves the hardware very much in existence.
For buyers, the implication reaches into procurement. Evaluating a service includes asking how equipment is prepared between customers and how its lower layers are verified. An elegant interface can conceal a complicated chain of custody. The research put an observable test beside a reassuring assumption, which is generally where security conversations become more useful.
A security feature needs its own security
Another investigation followed the supply chain itself. In December 2022, Eclypsium began disclosing vulnerabilities in AMI’s MegaRAC BMC software. The published report, updated in January 2023, covered five vulnerabilities. Different server manufacturers used the software, so a weakness in one supplier’s component could reach equipment sold under several familiar names.
The report described risks including remote code execution and unauthorized access with elevated permissions. Coordinated disclosure gave AMI time to develop mitigations. This was team research, published under researcher Vlad Babkin’s name, within the company Bulygin led. Its significance came from the connections among products as much as from any individual bug.
A BMC makes remote administration possible precisely because it possesses substantial control. That makes it useful and makes securing it consequential. In a standardized data center, the same vulnerable component or configuration may recur across many servers. The supply chain can repeat a good engineering decision efficiently. It can repeat a bad one with equal enthusiasm.
Bulygin’s professional world is therefore populated by relationships: chip suppliers, firmware developers, equipment manufacturers, cloud operators and customers. Eclypsium’s purpose is to help the customer inspect what has arrived through those relationships. The firm’s founding thesis describes trust in code and hardware as a prerequisite for operating a business, with failures reaching employees and customers downstream.
The AI boom arrives with a motherboard
The newer chapter has brought Bulygin’s work into AI data centers. In June 2025, Eclypsium announced version 4.0 capabilities for AI and GPU infrastructure. The announced coverage included GPU servers and foundational components supporting compute, networking, memory and server management. Model intelligence still depends on equipment executing instructions underneath it.
The company described continuous checks for vulnerabilities, integrity changes and component-level attacks. That extends a familiar research concern into infrastructure attracting fresh investment. A new workload does not relieve a server of its older obligations. Someone still needs to know what is installed, whether it has changed and whether the change should be there.
Led by PEAK6 Strategic Capital, with participation from a top-three US bank and Ten Eleven Ventures. Company financing, not a measure of Bulygin’s personal wealth.
In March 2026, Eclypsium announced that financing as it expanded its infrastructure security work. The company had previously announced a $45 million Series C comprising equity and debt in January 2025. The commercial story had grown considerably since the public framework, while the technical subject remained recognizable: understand what the devices are actually doing.
Bulygin is a naturalized American based in the Portland area. A 2024 interview described him as softly spoken and reported that he trains in Brazilian jiu-jitsu. In that interview, he explained components on a motherboard while talking through their risks. It is an apt image for his work: a physical object, an explanation, and another layer to examine.
His stated ambition is for customers to understand their critical devices, including the code inside them and how that code was built. That asks for a more demanding relationship with technology than the one suggested by a sealed box and a familiar badge. Bulygin has spent years making the interior available for inspection. The box still looks reassuringly simple. He keeps opening it.