Security Consultant’s ‘Evil Bit’ Scheme Draws Scrutiny Over Hacker Hiring Practices

Corey Thuen, a noted figure in the cybersecurity community, has announced a new initiative that involves hiring external hackers to explore what he describes as the "evil bit" – a binary notion of adversarial intent that he says either exists or does not. The move, reported by SecurityWeek, has ignited a debate about the boundaries of offensive security work and the ethical implications of commissioning hacktivist‑style activities.

The term "evil bit" originally surfaced in the 2003 RFC 3514, a tongue‑in‑cheek proposal that suggested adding a flag to IP packets to indicate malicious intent. While never adopted, the concept has persisted as a metaphor for distinguishing benign from hostile traffic. Thuen appears to be repurposing the idea as a strategic lens, framing certain cyber‑operations as a test of whether an adversary’s malicious intent can be isolated and examined through hired expertise.

Hiring independent hackers for targeted assessments is not unprecedented; bug‑bounty platforms and red‑team services routinely rely on external talent to uncover vulnerabilities. Thuen’s approach, however, emphasizes a more confrontational posture, seeking actors who can simulate or even execute hostile techniques to probe the presence of the so‑called evil bit. By framing the effort as a binary test rather than a continuous risk assessment, the initiative blurs the line between defensive research and proactive intrusion.

Industry observers have expressed mixed reactions. Some security professionals argue that controlled, transparent engagements can yield valuable insights into emerging threats, especially when traditional defenses struggle to anticipate novel tactics. Others caution that commissioning potentially illegal activities, even under the banner of research, raises serious legal and moral questions. The lack of publicly disclosed safeguards or oversight mechanisms adds to concerns that the program could be misused or attract actors with motives beyond pure testing.

Regulators and corporate compliance officers are likely to monitor the development closely, as the practice touches on evolving norms around cyber‑offense and the permissible scope of third‑party involvement. Should Thuen’s model gain traction, it may prompt calls for clearer guidelines governing the hiring of hackers for adversarial simulations, as well as discussions about liability when such activities cross jurisdictional boundaries. For now, the "evil bit" experiment remains a focal point for broader conversations about how the security industry balances innovation, risk, and responsibility.