David Brumley

David Brumley is a Professor of Electrical and Computer Engineering at Carnegie Mellon University with a courtesy appointment in the Computer Science Department. He previously served as Director of CyLab, CMU's Security and Privacy Institute, from 2015 to 2017. His research focuses on developing systems that automatically check software for exploitable bugs using program analysis with security-specific properties.

Brumley received his Ph.D. in Computer Science from Carnegie Mellon University, an MS in Computer Science from Stanford University, and a BA in Mathematics from the University of Northern Colorado. Before his academic career, he served as a Computer Security Officer for Stanford University from 1998-2002.

Brumley's research focuses on software security techniques that provide users with guarantees. His work sits at the intersection of model checking, formal methods, compilers, and logic, all applied to security problems. He develops efficient symbolic execution, reasoning about bit-level arithmetic in finite fields, sound decompilation, and decision procedures. His research also extends to network security and applied cryptography, focusing on efficient protocols, signature schemes, and privacy-preserving cryptography. A key aspect of his work involves binary code analysis, which allows reasoning about the security of code that actually executes.

Brumley's publication record shows a consistent progression from theoretical foundations in program analysis to practical security systems. His work spans symbolic execution, fuzzing, exploit generation, and binary analysis. The Mayhem Cyber Reasoning System, which won the DARPA Cyber Grand Challenge, represents the culmination of his research vision for automated vulnerability detection and patching. His publications demonstrate how theoretical advances in program analysis can be translated into real-world security tools.

• USENIX Security Best Paper Awards (2003, 2007)
• International Conference on Software Engineering Distinguished Paper Award (2014)
• NSF CAREER Award (2010)
• United States Presidential Early Career Award for Scientists and Engineers (PECASE) (2010)
• Sloan Foundation Award (2013)
• DARPA Cyber Grand Challenge Winner ($2,000,000) (2016)

Brumley has mentored numerous PhD students who have gone on to successful careers in academia and industry, including co-founders of ForAllSecure. He served as faculty mentor for the CMU Hacking Team Plaid Parliament of Pwning (PPP), which has been ranked #1 internationally and won DefCon 2013. His research has been supported by significant grants including DARPA programs and the NSF CAREER award. He also runs PicoCTF, an annual computer security contest for high school students that has become one of the largest cybersecurity education initiatives of its kind.

Brumley leads the development of security systems through both academic research and commercialization. He is the CEO of ForAllSecure, which commercializes the Mayhem system developed through his academic research. His work bridges the gap between theoretical security research and practical security tools used by industry, creating a pipeline from academic innovation to real-world impact.