For some, rules pose limitations. For others, like Microsoft Research Manager Mike Walker, they’re opportunities.
Walker’s fascination with rules and their role in the social order has allowed him to find success professionally and personally, from uncovering weaknesses in networked systems to redefining how computers are trained to fend off cyberattacks to pushing the limits of a reliable mode of transportation—the bicycle—in ultra-endurance racing.
In this conversation with Principal Technical Program Manager Weishung Liu, Walker describes how his participation in hacker culture led him to a career building next-generation cyber defense, including his work developing the first all-machine hacking tournament. Along the way, he reflects on why effective security depends on understanding trust and context, what competitive hacking taught him about teamwork and collective intelligence, and how an early lesson reshaped his understanding of leadership. He also tackles an important question: are today’s networked systems any safer than they were a decade ago?
Subscribe to the Microsoft Research Podcast:
Transcript
[MUSIC]
MIKE WALKER: Well, you have to understand the rules if you want to be able to do what you want. So I have, I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication.
[THEME MUSIC]
STANDARD INTRODUCTION: This is the Microsoft Research Podcast, where Microsoft researchers—driving advancement through fundamental science and technology research—explore the who, how, and what’s next in computing and AI.
[MUSIC ENDS]
WEISHUNG LIU: Hi, and welcome. My name is Weishung Liu, and I’m a principal technical program manager here at Microsoft Research. And today, I’m joined by Mike Walker, who is a research manager here in MSR, or Microsoft Research, where he leads projects at the intersection of AI, cybersecurity, and large distributed systems.
Before Microsoft, Mike led DARPA’s Cyber Grand Challenge, the pioneering program that demonstrated autonomous AI systems capable of finding and patching software vulnerabilities. And CGC actually just celebrated its 10th anniversary this year in 2026.
Mike’s work spans groundbreaking efforts that include cloud native memory analysis, automated malware analysis, and next-generation cyber defense technologies.
Mike, thanks for joining me.
MIKE WALKER: Good to be here, Wei.
LIU: All right, so, Mike, we have known each other for a couple of years now. And I’ve heard, like, bits and pieces of your story over time as we’ve gotten to talk. But before I really knew who you were, sort of, as a person, I, kind of, knew you as, like, “Mike Walker, the hacker guy that’s working over there,” which I’m sure you love. And I know you love that, when I call you “The Hacker.”
But you’ve worked on so many things that I’ve never really thought about before. Like, new words have entered my vocabulary as a result of knowing you and working with you, like threat intelligence, nation states, and I think there are a couple other ones that I think would have never been in my lexicon had I not known you.
So I’m hoping we can spend this time to also have the audience get to know you, as well. So we’re going to start at the beginning then. And the beginning is, I believe, Mike, you grew up in Ohio.
WALKER: Columbus, Ohio.
LIU: Columbus, Ohio. What kind of a kid were you in Columbus, Ohio?
WALKER: I think I was a kid who spent a lot of time in the woods. [LAUGHTER] I was a skateboard kid. I was a basketball kid. But I think mostly I was a kid who read books and lived in a world of their own imagination.
LIU: Were you on a farm in Columbus, Ohio, or were you in, like, or is this more suburban, rural, urban?
WALKER: It was halves and halves. I spent my … most of the year in Columbus, Ohio, and then every summer, I would go out to the town of Tappahannock on the Rappahannock River in Virginia. And I lived completely on the farm.
LIU: So what was the lifestyle in what you were doing different between, like, Columbus, Ohio, and the farm?
WALKER: So, like, some things that I was doing in Columbus, Ohio, is that my father, who was sort of half scientist, half venture capitalist, would bring me home industrial equipment and say, “See what you can make out of this,” and drop it in my room. [LAUGHTER] Really dangerous stuff. And he would always give me safety warnings, right, like, “This is a helium neon laser.” You know, “This is … this tube is made out of glass. Don’t break it.” And then, “This is a really, really high-voltage power supply driving it, and it can arc and kill you,” right. And I knew what that meant. [LAUGHTER] And then he would leave me with it. And what can you make out of this, right.
So I would do stuff like, like try to replicate the Michelson-Morley experiment, you know, because I had the, had the table and the mirrors and I could do that. And then also I spent a lot of time with the Apple II, which was this just incredible machine from some other universe that I had never gone to. I later found out that was, you know, hackerspace and, and information technology culture, but it came from nowhere and there was nobody I could talk to about it. And so I spent a lot of time trying to hook the Apple II up to stuff in my life and, and try to control it with that thing.
LIU: OK, so you brought up some hacker stuff, so I have to ask. There was farm stuff. There was, you know, “dad brought home interesting tools and equipment.” How did all of that get you interested in cybersecurity?
WALKER: I think I was always in cybersecurity. I just didn’t know.
LIU: Explain.
WALKER: You know, there’s this idea that you live two lives: the one before you find out your purpose and the one after you find it. This was, sort of, life before purpose, where I didn’t know why I was so interested in how these things worked.
So, you know, I ran a bulletin board system. Before the internet, this was how computers communicated with each other. Dial-up modems, not even backbone linked. Each, each BBS—bulletin board system—[LAUGHTER] was, was a universe unto itself, you know, architected by its creator. And so there were all these little universes you could dial into. And then at some point, all these things I’d been doing my whole life, sort of, got connected to a career.
When you say, you know, somebody could, right, somebody could listen to every single badge swipe event on the network, on campus, and then replicate them and badge themselves into any building they wanted because this is all in a broadcast LAN [local area network] and somebody should change that, there was a time when if you said things like that, the people you told it to would just be like, “Well, don’t do that,” [LAUGHTER] right? And then …
LIU: Did you listen to them?
WALKER: No. [LAUGHTER] I was young.
Um, and then at some point, the world started getting serious about imposing rules onto networked computers, and they started hiring people who are interested in that. And that’s … suddenly it was a career, right. I was like, “Oh, I was always here, but now it has a name.”
LIU: So I have to ask then, like, you brought up the notion of rules. I feel like cybersecurity and rules has a relationship there. How much of a rule follower were you growing up versus how much do you think you are a rule follower now, and was there a difference or have you always been some version of “rule following”?
WALKER: Well, you have to understand the rules if you want to be able to do what you want.
LIU: Yes.
WALKER: So I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication.
LIU: OK. I’m going to have to ask you then about a game that we played recently called No Vehicles in the Park (opens in new tab).
WALKER: No Vehicles in the Park is … it’s a game about content moderation is one way to look at it. I think it’s a fascinating thought experiment. But it just takes the thesis that rules are simple and challenges it with putting the player in the position of judge. And so the name of the exercise is the name of the rule, which is no vehicles in the park.
And then it asks you some very simple commonsense questions about, is this a violation of the rule no vehicles in the park? Like if the International Space Station overflies the park, is that a vehicle in the park, and is it against the rules?
LIU: Mike, do you think the ISS flying over the park is a violation of the rules?
WALKER: No. [LAUGHTER] But it’s important that we have a resilient way to adjudicate things that, that bridges social norms.
LIU: OK. How much did you agree with the population, by the way, of No Vehicles in the Park?
WALKER: I’ve rarely ever broken 50%. Yeah.
LIU: I got like 90 …
WALKER: I play often.
LIU: I think I got 96% on my first try, so I think I … does that mean I’m kind of like a lemming that, like, just understands the social construct of rules?
WALKER: I think it means you, you channel the zeitgeist.
LIU: Mm, OK, I’ve been assimilated.
WALKER: Right …
LIU: That’s what it feels like.
All right. So let’s talk about something that I love, which is you had a short segment in 60 Minutes (opens in new tab) where you had a conversation with Lesley Stahl, and she described you as “one of the world’s top hackers,” at least at the time in which she interviewed you. And so now I have to know, how did you find hacker cultures? What was the extent of your involvement and, you know, how did you really get into it?
WALKER: It, sort of, happened all at once, and I can tell the beginning of the story, and then I can tell you the day that the story stops.
So the beginning of the story is that I was working at a, at a startup building telecommunications technologies on Sept. 11, 2001, and I was living in Maryland, outside of Washington, D.C., but my wife was in Washington, D.C., on that day, and, um, and then all the phones stopped working. My workplace was overflown by an F-16, and, and after that, in the nation’s capital, there was this sudden talent search for people who understood computer security or people who’d always been there but didn’t know what it was called. And that talent search found me.
LIU: What, uh, what were the qualifications, like, that you had that, you know, matched with their list of talent that they were looking for?
WALKER: I wish I knew.
LIU: World’s top hacker?
WALKER: I think, I think that that label was placed on me much later.
LIU: [LAUGHS] All right, fine.
WALKER: I think that I became part of a series of cultures after that day, and one of them was the, the group of people who play in DEF CON Capture the Flag, which is a hacking contest in Las Vegas. And when you start getting involved in trying to get, get better at something in a way where you can compete at a national or international level, especially in sort of a coffeehouse environment where everyone else is trying to get better, too, it sort of propels you upward very quickly.
LIU: OK, let’s, let’s go back later to talk about Capture the Flag, because I think it’s related to the, sort of, next arc of your life, which was your time as a project manager—program manager—at the Defense Advanced Research Projects Agency, also known as DARPA, which is also why Lesley had been interviewing you at the time. It was associated with your affiliation at DARPA, and you were there for about four years.
How did you, how did you go from, you know, let’s say call, call to action from the nation’s capital looking for people with your specific set of skills to being at DARPA as a PM.
WALKER: So we should, we should be clear, we’ve just, sort of, skipped over 11 years of Mike trying to get better at hacking.
LIU: [LAUGHS] You were world’s top—look, I just believe world’s top hacker, one of the world’s top hackers.
WALKER: Well, I think, uh, I think my, my friends, colleagues, and teammates from the time, if they were here to, to hear that accusation being made, would give me endless grief about