Learn the rules: The hacker mindset

For some, rules pose limitations. For others, like Microsoft Research Manager Mike Walker, they’re opportunities. Walker’s fascination with rules and their role in the social order has allowed him to find success professionally and personally, from uncovering weaknesses in networked systems to redefining how computers are trained to fend off cyberattacks to pushing the limits of a reliable mode of transportation—the bicycle—in ultra-endurance racing. In this conversation with Principal Technical Program Manager Weishung Liu, Walker describes how his participation in hacker culture led him to a career building next-generation cyber defense, including his work developing the first all-machine hacking tournament. Along the way, he reflects on why effective security depends on understanding trust and context, what competitive hacking taught him about teamwork and collective intelligence, and how an early lesson reshaped his understanding of leadership. He also tackles an important question: are today’s networked systems any safer than they were a decade ago? MIKEWALKER:Well, you have to understand the rules if you want to be able to do what you want. So I have, I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication. STANDARD INTRODUCTION:This is theMicrosoft Research Podcast, where Microsoft researchers—driving advancement through fundamental science and technology research—explore the who, how, and what’s next in computing and AI. WEISHUNGLIU:Hi, and welcome. My name is Weishung Liu, and I’m a principal technical program manager here at Microsoft Research. And today, I’m joined by Mike Walker, who is a research manager here in MSR, or Microsoft Research, where he leads projects at the intersection of AI, cybersecurity, and large distributed systems. Before Microsoft, Mike led DARPA’s Cyber Grand Challenge, the pioneering program that demonstrated autonomous AI systems capable of finding and patching software vulnerabilities. And CGC actually just celebrated its 10th anniversary this year in 2026. Mike’s work spans groundbreaking efforts that include cloud native memory analysis, automated malware analysis, and next-generation cyber defense technologies. LIU:All right, so, Mike, we have known each other for a couple of years now. And I’ve heard, like, bits and pieces of your story over time as we’ve gotten to talk. But before I really knew who you were, sort of, as a person, I, kind of, knew you as, like, “Mike Walker, the hacker guy that’s working over there,” which I’m sure you love. And I know you love that, when I call you “The Hacker.” But you’ve worked on so many things that I’ve never really thought about before. Like, new words have entered my vocabulary as a result of knowing you and working with you, likethreat intelligence,nation states, and I think there are a couple other ones that I think would have never been in my lexicon had I not known you. So I’m hoping we can spend this time to also have the audience get to know you, as well. So we’re going to start at the beginning then. And the beginning is, I believe, Mike, you grew up in Ohio. LIU:Columbus, Ohio. What kind of a kid were you in Columbus, Ohio? WALKER:I think I was a kid who spent a lot of time in the woods. [LAUGHTER] I was a skateboard kid. I was a basketball kid. But I think mostly I was a kid who read books and lived in a world of their own imagination. LIU:Were you on a farm in Columbus, Ohio, or were you in, like, or is this more suburban, rural, urban? WALKER:It was halves and halves. I spent my … most of the year in Columbus, Ohio, and then every summer, I would go out to the town of Tappahannock on the Rappahannock River in Virginia. And I lived completely on the farm. LIU:So what was the lifestyle inwhat you were doing different between, like, Columbus, Ohio, and the farm? WALKER:So, like, some things that I was doing in Columbus, Ohio, is that my father, who was sort of half scientist, half venture capitalist, would bring me home industrial equipment and say, “See what you can make out of this,” and drop it in my room. [LAUGHTER] Really dangerous stuff. And he would always give me safety warnings, right, like, “This is a helium neon laser.” You know, “This is … this tube is made out of glass. Don’t break it.” And then, “This is a really, really high-voltage power supply driving it, and it can arc and kill you,” right. And I knew what that meant. [LAUGHTER] And then he would leave me with it. And what can you make out of this, right. So I would do stuff like, like try to replicate the Michelson-Morley experiment, you know, because I had the, had the table and the mirrors and I could do that. And then also I spent a lot of time with the Apple II, which was this just incredible machine from some other universe that I had never gone to. I later found out that was, you know, hackerspace and, and information technology culture, but it came from nowhere and there was nobody I could talk to about it. And so I spent a lot of time trying to hook the Apple II up to stuff in my life and, and try to control it with that thing. LIU:OK, so you brought up some hacker stuff, so I have to ask. There was farm stuff. There was, you know, “dad brought home interesting tools and equipment.” How did all of that get you interested in cybersecurity? WALKER:I think I was always in cybersecurity. I just didn’t know. WALKER:You know, there’s this idea that you live two lives: the one before you find out your purpose and the one after you find it. This was, sort of, life before purpose, where I didn’t know why I was so interested in how these things worked. So, you know, I ran a bulletin board system. Before the internet, this was how computers communicated with each other. Dial-up modems, not even backbone linked. Each, each BBS—bulletin board system—[LAUGHTER] was, was a universe unto itself, you know, architected by its creator. And so there were all these little universes you could dial into. And then at some point, all these things I’d been doing my whole life, sort of, got connected to a career. When you say, you know, somebodycould, right, somebodycouldlisten to every single badge swipe event on the network, on campus, and then replicate them and badge themselves into any building they wanted because this is all in a broadcast LAN [local area network] and somebody should change that, there was a time when if you said things like that, the people you told it to would just be like, “Well, don’t do that,” [LAUGHTER] right? And then … Um, and then at some point, the world started getting serious about imposing rules onto networked computers, and they started hiring people who are interested in that. And that’s … suddenly it was a career, right. I was like, “Oh, I was always here, but now it has a name.” LIU:So I have to ask then, like, you brought up the notion of rules. I feel like cybersecurity and rules has a relationship there. How much of a rule follower were you growing up versus how much do you think you are a rule follower now, and was there a difference or have you always been some version of “rule following”? WALKER:Well, you have to understand the rules if you want to be able to do what you want. WALKER:So I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer secur