Michał Zalewski

Researchers / independent engineers · Software/Tech · milestone at age 24 ·T3 Domain-recognized

Milestone (age 24)

Published 'Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks' in 2005 at age 24, a landmark computer security book translated into multiple languages, while serving as T-Mobile's chief security specialist and having discovered major vulnerabilities in SendMail, TCP/IP, and Internet Explorer.

Zalewski was born on January 19, 1981, in Poland. He is entirely self-taught in computer security, having begun posting on the Bugtraq vulnerability mailing list in the mid-1990s as a teenager around age 14-15. He discovered several major vulnerabilities including a buffer overflow in SendMail, weaknesses in TCP/IP ISNs, and a code execution hole in IE's JPG parsing. He served as T-Mobile's chief security specialist for four years before joining Google in 2007 at age 26. He published 'Silence on the Wire' in 2005 and later 'The Tangled Web' in 2011, both with No Starch Press.

Think your path resembles Michał Zalewski's?Compare the visible ingredients, then see exactly where the comparison stops working.

Am I the next Michał Zalewski? →

Starting point

Born on January 19, 1981 in Poland; self-taught in computer security from a young age; family background not documented.

Current position (2025)

VP of Security and Privacy Engineering at Snap Inc.; previously Director of Information Security Engineering at Google (2007-2018); recipient of Lifetime Achievement Pwnie Award.

How this path compounded

01 Starting advantages

5/24 starting-position score

Strongest documented signals: Frontier geography, Rare early tools, Early online platform.

Describes the starting position, not what the person later made of it.

Cohort percentile: 20

02 Built or converted leverage

13/25 multiplying-capacity score

Strongest observed levers:Domain proximity, Started serious reps before 20, Prior reps.

Measures what was present, not whether it was inherited, earned, self-built, external, or mixed.

Cohort percentile: 55

03 Compounding trajectory

7 documented steps

The timeline below shows the sequence of work and transitions around the selected early milestone. It is evidence of a path, not proof that every step was necessary.

Milestone at age 24

04 Observed career standing

T3 · Domain-recognized

Notable and widely recognized within the domain. The tier summarizes documented career recognition through the data cutoff—not Michał Zalewski's worth or future potential.

How tiers work →

Question four · where did the leverage come from?

Michał Zalewski's leverage provenance

Each non-zero lever gets a best-supported origin, evidence signals, and confidence. Unresolved is the honest default when the biography cannot distinguish self-built, advantage-enabled, earned, external, or mixed.

Started serious reps before 201/1

Mixedmedium confidence

Mapped starting advantages and self-directed-building language are both documented.

Rare early tools (1/2)Early online platform (1/2)

Domain proximity2/2

Advantage-enabledmedium confidence

One or more documented starting advantages plausibly enabled this lever.

Direct domain exposure (1/2)Frontier geography (1/2)

Prior reps2/3

Mixedmedium confidence

Mapped starting advantages and self-directed-building language are both documented.

Rare early tools (1/2)Early online platform (1/2)

Scarce skill depth2/3

Mixedmedium confidence

Mapped starting advantages and self-directed-building language are both documented.

Rare early tools (1/2)Early online platform (1/2)

Structural wave / timing2/3

Externalmedium confidence

A structural wave is external to the person, even when their position improved access to it.

Frontier geography (1/2)Early online platform (1/2)

Concentration intensity2/3

Mixedmedium confidence

Mapped starting advantages and self-directed-building language are both documented.

Adversity / constraint catalyst (1/2)

Native distribution1/3

Mixedmedium confidence

Mapped starting advantages and self-directed-building language are both documented.

Early online platform (1/2)

Elite ecosystem network1/3

Advantage-enabledmedium confidence

One or more documented starting advantages plausibly enabled this lever.

Frontier geography (1/2)

This is a bounded inference from the current annotations—not a claim about private effort, merit, or the percentage of Michał Zalewski's outcome attributable to any origin.

Luck is not a leftover score.

Structural luck, Encounter luck, Event luck, Outcome variance can change every arrow in the path. This successful-only dataset cannot observe the near-identical paths that did not break through, so luck stays visible and unscored.

Within Researchers / independent engineers, Michał Zalewski's starting-advantage total is at the 20th percentile. Separately, their built or converted leverage total is at the 55th percentile. Other T3 profiles average 7.0 / 24 starting advantage and 11.7 / 25 leverage. Similar scores appear in other tiers, so these figures describe positioning—not a cause.

Trajectory

1995 · age 14
Began posting vulnerability research
The Bugtraq mailing list as a teenager.
2005 · age 24
Published 'Silence on the Wire
A Field Guide to Passive Reconnaissance and Indirect Attacks' with No Starch Press.
2007 · age 26
Joined Google as Information Security Engineer
Later became Director of Information Security Engineering.
2010 · age 29
Initiated the Google Vulnerability Reward Program
The first bug bounty of its kind.
2011 · age 30
Published 'The Tangled Web
A Guide to Securing Modern Web Applications' with No Starch Press.
2014 · age 33
Released American Fuzzy Lop (AFL)
A groundbreaking open-source fuzzer.
2018 · age 37
Left Google after 11 years; joined Snap Inc.
As VP of Security and Privacy Engineering.

Primary leverage engine

Technical depth

Scarce technical / intellectual depth

Secondary engine

Self-created domain repetition

Built/converted leverage

13 / 25

evidence: Medium

Built or converted leverage

Multiplying capacity documented later in the path. Measures what was present, not whether it was inherited, earned, self-built, external, or mixed.

Started serious reps before 20

1/1

Prior reps

2/3

Scarce skill depth

2/3

Native distribution

1/3

Elite ecosystem network

1/3

Complementary team

0/2

Structural wave / timing

2/3

Concentration intensity

2/3

Capital safety

0/2

Domain proximity

2/2

Starting-advantage scores (0–2 each)

Access or conditions documented near the beginning of the path. Zero means "no clear evidence in reviewed sources," not "advantage was absent."

Family financial platform

0/2

Parent / family domain

0/2

Inherited audience / network

0/2

Elite institution pipeline

0/2

Frontier geography

1/2

Rare early tools

1/2

Dedicated mentor / coach

0/2

Exceptional peer / cofounder

0/2

Early online platform

1/2

Direct domain exposure

1/2

Prodigy / innate ability

0/2

Adversity / constraint catalyst

1/2

Family context

Born in Poland in 1981. Self-taught from a young age. Family background not documented in reviewed sources.

Parent / family domain

Not documented in reviewed sources.

Archetype & tags

Self-created domain repetitionself-taughtBugtraqSendMail-vulnerabilityTCP/IP-ISNT-MobileGoogleSilence-on-the-Wirelcamtuf

Evidence summary

Zalewski published 'Silence on the Wire' at 24 in 2005, a landmark security book translated into multiple languages, while serving as T-Mobile's chief security specialist. Born in Poland in 1981, he is entirely self-taught and began posting on Bugtraq in the mid-1990s as a teenager. He discovered major vulnerabilities in SendMail, TCP/IP ISNs, and IE's JPG parsing. He joined Google at 26 in 2007, where he spent 11 years building the product security program and created the American Fuzzy Lop fuzzer. He received the Lifetime Achievement Pwnie Award.

advantage confidence: Medium · source count: 4 · audit: not_independently_audited · status: subagent_researched_beta

Sources

Related — same primary engine

Mark Zuckerberg

Founder/Entrepreneur · age 19

Launched Facebook at Harvard

Leverage 19/25T1

Michael Truell

Founder/Entrepreneur · age 23

Co-founded Anysphere/Cursor

Leverage 19/25T1

Alfred Wahlforss