25 years breaking systems. Now building the record.
Co‑founder and CTO of RotorLab, the system of record for commercial drone programs.
- Rapid7
- HP Fortify ShadowLabs
- K2 Intelligence
- OccamSec
What I work on
Where offensive security meets uncrewed aircraft
The same questions I asked as a penetration tester, now asked of aircraft: what happened, who can prove it, and what an attacker would do with the gap.
Drone security
A drone is a radio, a flight controller and a ground station, each with its own trust assumptions. I test them the way an adversary would, and contributed to the design of the UAS Security Verification Standard (UASVS).
Drone security posts 02Flight-log forensics
Every aircraft writes its own account of every flight. Reading it like an access log, timestamps first and then what is missing, turns a crash into a timeline and a dispute into evidence.
Flight-log forensics posts 03Records that hold up
A record typed up after the question convinces nobody. Hash-chained entries, signed documents and a verification code anyone can check make the record stand on how it was built.
Records engineering posts
RotorLabThe record behind every flight.
One record per aircraft, from the first drawing to the audit.
I lead the engineering behind it: flight-log forensics, the rules engine, and the verification behind every document RotorLab issues. The company, the product and its news live at rotorlab.app.
Flight 2291 Hex survey · RL-0412
● Filed · verifiedWriting
Notes from the security side of drones
-
The FCC Covered List and your drone fleet: what’s settled and what’s pending
Foreign-produced drones and drone components have been on the FCC’s Covered List since December 2025. Here is what that entry actually restricts today, what it leaves alone, and…
-
What the FAA can ask to see, and how fast you can produce it
Part 107 asks for fewer records than most program managers assume, but it expects you to produce every one of them on request. Here is the short list,…
-
Reading a Betaflight blackbox log after a crash
When a quad goes in, the flight controller has usually written down what it saw. Here is the order I read a Betaflight blackbox log in: the link…
Before RotorLab
A career spent on the offensive side
A penetration test ends with a report someone else has to be able to trust. RotorLab applies that idea to aircraft.
Rapid7
Original professional services team. Engagements, talks and trainings worldwide.
HP Fortify on Demand
Founding member of ShadowLabs. Application and mobile security at enterprise scale.
K2 Intelligence, OccamSec
Red team leadership at both, plus executive protection certification at ESI in 2016.
ORE Sys
Co-founder and CTO. Led engineering and security for a blockchain gaming platform and its token, plus distributed-systems work for healthcare and logistics.
Community
Community and standards
BSides Chicago
Part of the founding crew. Has spoken and trained at security events in North America and abroad since.
Speaking RacingMultiGP Iowa
Founded a MultiGP drone racing chapter in Iowa. RotorLab is the Official Crash Analyzer of MultiGP.
MultiGP EducationLoras College
An approved drone engineering program built on RotorLab.
Loras College StandardsUASVS
Design contributor to the open UAS Security Verification Standard.
uasvs.orgPut your program on the record.
RotorLab sales, pilots and procurement go to the RotorLab team. For talks, interviews and podcasts, write to me directly.