Top Cybersecurity Influencers to Follow in 2027
Security researchers, threat-intelligence leads, journalists and practitioners worth following in 2027 — the updated Engatica cybersecurity influencers list.
Start with the breach data, not the personalities. Verizon's 2025 DBIR puts credential abuse behind 22% of breaches and third parties behind 30% — up from 15% a year earlier — while IBM puts the average US breach at a record $10.22 million. The failures that matter now are about identity, supply chains and AI systems with no access controls, and the people below are the ones explaining that shift in public: the researchers who find the holes, the officials who answer for them, and the journalists who check both. For the 2027 edition we re-verified every role we could — several names have left government, changed employers or moved into AI security since this list last ran.
The workforce picture matters as much as the threat picture. ISC2's 2025 Cybersecurity Workforce Study — 16,029 respondents — found 95% of teams reporting at least one critical skill need and 88% suffering a significant consequence from the skills shortage, with budget constraints now outranking talent scarcity as the binding problem. On the AI side, IBM found that 97% of AI-related breaches lacked proper AI access controls and that shadow AI added roughly $670K to breach costs, while organisations using AI and automation extensively saved $1.9M per breach.
The list
| Name | Known as | Follow for |
|---|---|---|
| Bruce Schneier | Security technologist; author of Rewiring Democracy (2025) | Cryptography, security policy |
| Brian Krebs | Investigative journalist, KrebsOnSecurity | Cybercrime reporting |
| Troy Hunt | Founder, Have I Been Pwned | Data breaches, web security |
| Katie Moussouris | Founder, Luta Security | Vulnerability disclosure, bug bounties |
| Mikko Hypponen | Chief Research Officer, Sensofusion | Malware and cyber warfare |
| Graham Cluley | Security blogger and podcaster | Cybersecurity news, Smashing Security |
| Rachel Tobac | CEO, SocialProof Security | Social engineering, vishing |
| Eva Galperin | Director of Cybersecurity, EFF | Surveillance and stalkerware |
| Keren Elazari | Security analyst and TED speaker | Hacker culture, cyber immunity |
| Marcus Hutchins | Security researcher | Malware analysis; stopped WannaCry |
| Jayson E. Street | Author and DEF CON Groups ambassador | Physical security, social engineering |
| Kevin Mitnick (legacy entry) | Late author of The Art of Invisibility | Social engineering — listed in the original Engatica era; died 2023 |
| Chuck Brooks | President, Brooks Consulting; Georgetown adjunct | Cybersecurity influence and policy — a fixture of the original Engatica lists |
| Joseph Steinberg | Cybersecurity columnist | Consumer and enterprise security |
| Dave Shackleford | Founder, Voodoo Security; SANS instructor | Cloud and virtualisation security |
| Window Snyder | Security pioneer; ex-Apple, Square, Intel | Secure development |
| Parisa Tabriz | VP, Google (Chrome) | Browser security |
| Dan Kaminsky (legacy entry) | Late security researcher | DNS security — died 2021 |
| HD Moore | Creator, Metasploit | Offensive security tooling |
| Dave Aitel | Founder, Immunity Inc. | Exploit development |
| Chris Wysopal | Co-founder, Veracode | Application security |
| Katie Nickels | Director of Intelligence, Red Canary | Threat intelligence, MITRE ATT&CK |
| Lesley Carhart | Director of Incident Response, Dragos | ICS/OT incident response |
| Rob Lee | Founder, Dragos; SANS instructor | ICS security, digital forensics |
| Jake Williams | Founder, Rendition Infosec; SANS instructor | Incident response |
| Dave Kennedy | Founder, TrustedSec | Offensive security, Social-Engineer Toolkit |
| Georgia Weidman | Founder, Shevirah; author, Penetration Testing | Mobile and pentesting |
| Kim Zetter | Investigative journalist | Zero-day and election security reporting |
| Andy Greenberg | Senior writer, WIRED | Cybersecurity investigations; Sandworm |
| Nicole Perlroth | Author, This Is How They Tell Me the World Ends; Founding Partner, Silver Buckshot Ventures | Cyber arms trade reporting |
| Lily Hay Newman | Senior writer, WIRED | Security and privacy reporting |
| Zack Whittaker | Security editor, TechCrunch | Data breach reporting |
| Lorenzo Franceschi-Bicchierai | Senior writer, TechCrunch | Hacking and surveillance |
| Matthew Green | Cryptographer, Johns Hopkins | Applied cryptography |
| Filippo Valsorda | Cryptographer; Geomys founder | Go security, age encryption |
| Tavis Ormandy | Vulnerability researcher, Google Project Zero | Fuzzing and disclosure |
| Natalie Silvanovich | Security engineer, Google Project Zero | Exploit research |
| Ian Beer | Security researcher, Google Project Zero | iOS/macOS research |
| Samuel Groß | Security researcher, Google Project Zero | Browser exploitation |
| Maddie Stone | Security researcher, Google TAG | Zero-day tracking |
| Shane Huntley | Director, Google Threat Analysis Group | State-backed threat tracking |
| Jen Easterly | Former Director, CISA; CEO, RSAC | National cyber defence and resilience |
| Chris Krebs | Former Director, CISA | Risk and election security |
| Rob Joyce | Former NSA Cybersecurity Director; venture partner, DataTribe | Nation-state defence |
| Anne Neuberger | Former US Deputy National Security Advisor (cyber); a16z | Cyber policy |
| Dmitri Alperovitch | Co-founder, CrowdStrike; Silverado Policy Accelerator | Threat intelligence, geopolitics |
| George Kurtz | CEO, CrowdStrike | Endpoint security |
| Nadav Zafrir | CEO, Check Point; Team8 founder | Cyber investing and defence |
| Assaf Rappaport | CEO, Wiz (Google Cloud) | Cloud security |
| Yinon Costica | Co-founder, Wiz | Cloud security posture |
| Phil Venables | Venture Partner, Ballistic Ventures; former Google Cloud CISO | AI-era security practice and investing |
| Johann Rehberger | Independent AI-security researcher (wunderwuzzi) | Prompt injection and LLM agent attacks |
| Heather Adkins | VP of Security Engineering, Google | Warnings on autonomous AI-powered hacking |
| Sherrod DeGrippo | Director of Threat Intelligence Strategy, Microsoft | Threat intelligence; Microsoft Threat Intelligence Podcast |
Why this list looks different in 2027
AI changed both sides of security: LLM-generated phishing and automated vulnerability discovery on offense; AI-assisted detection, triage and code review on defence. The follows that matter most now are the ones publishing primary research — zero-day trackers, threat-analysis groups, and practitioners running incident response in public. Legacy entries are marked where a figure from the original list has since died; we keep them because their work still anchors the field.
For the AI side of the same coin, see AI fairness in practice and our LLM hub.
Frequently asked questions
How was this list compiled?
The list began as the original Engatica cybersecurity ranking and was rebuilt for the 2027 edition. We kept the researchers, threat-intelligence leads, journalists and former officials whose work still anchors the field, re-verified the roles we could against current public sources, and added four names whose recent work — including AI-security research — made them impossible to leave out. Legacy entries for figures who have since died are marked and kept deliberately.
How often is the list updated?
We review the list on the site's annual edition cycle and correct roles as they change. The 2027 edition, for example, caught a former CISA director becoming RSAC's CEO, a prominent researcher leaving WithSecure for anti-drone defence firm Sensofusion, and Wiz becoming part of Google Cloud. If you spot something stale between editions, tell us and we will fix it in place rather than waiting for the next cycle.
How can I get added to the list, or get an entry corrected?
Nominations are open year-round: use the nominations page and include links to the person's recent public work — research, talks or reporting, not follower counts. We add people whose work other practitioners cite. For corrections to an existing entry (a changed employer, a new book, a wrong title), the same page works; verified corrections are applied to the live list, not held for the next edition.
What does the latest breach data say security teams should prioritise?
Verizon's 2025 Data Breach Investigations Report puts credential abuse behind 22% of breaches and third-party involvement at 30% — double the previous year — while IBM's 2025 study found 97% of AI-related breaches lacked proper AI access controls and put the average US breach cost at a record $10.22 million. The practical order follows from that: identity and credentials first, supplier access second, and access controls on AI systems before they scale.
Sources
- Jen Easterly: Cybersecurity's Relentless Optimist — The Register (2026)
- Krebs Resigns from SentinelOne After Trump Memo Targets Him — The Register (2025)
- Mikko Hypponen Leaves Anti-Malware Industry to Fight Against Drones — SecurityWeek via Cybernoz (2025)
- Google Completes $32B Wiz Acquisition — CTech by Calcalist (2026)
- Parisa Tabriz — Wikipedia (2026)
- Rob Joyce — Wikipedia (2026)
- Anne Neuberger joining the CNAS Board of Directors (press release, 14 May 2025) — Center for a New American Security (2025)
- New Book: Rewiring Democracy — Nathan E. Sanders (2025)
- Nicole Perlroth, Founding Partner of Silver Buckshot Ventures — Black Hat USA 2025 Keynote Announcement — Business Wire (2025)
- Katie Nickels — Articles — Muck Rack (2026)
- 2025 Data Breach Investigations Report — Verizon (2025)
- Cost of a Data Breach 2025: Navigating AI — IBM (2025)
- Cybersecurity Skills Matter More Than Headcount in an AI Era: ISC2 Study — Network World (2025)
- Cyber Visionary Phil Venables Joins Ballistic as Venture Partner — Ballistic Ventures (2025)
- Prompt Injection (on Johann Rehberger's research) — LastPass Labs (2025)
- AI-Powered Cyberattacks: Google Executive Warns of Future Threats — SC Media (2026)
- Microsoft Threat Intelligence Podcast (Sherrod DeGrippo) — The CyberWire (2026)