Dan Geer

Dan Geer is an American computer security researcher and risk analyst noted for his work on information security economics, vulnerability disclosure, and applied statistical methods for cybersecurity. He has held technical and leadership roles at organizations across the technology, intelligence, and finance sectors, and has influenced policy debates in the United States and internationally through testimony, writing, and advisory roles. His career spans applied research, consulting, and executive positions intersecting with privacy, law, and public policy.

Early life and education

Born in 1956, Geer grew up during the rise of commercial computing amid developments associated with Bell Labs, Digital Equipment Corporation, and the broader shift from mainframe to microcomputer architectures such as the IBM PC. He pursued formal education in fields that intersected computing and applied mathematics at institutions connected with the American higher education system, which included exposure to curricula influenced by researchers from Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University. His formative years coincided with milestones like the publication of the TCP/IP specifications and the proliferation of Unix environments.

Career

Geer’s professional trajectory includes technical leadership and advisory positions at firms and institutions such as In-Q-Tel, Forrester Research, Verdasys, Cigital, and consulting engagements with technology vendors like Microsoft, Sun Microsystems, and Intel. He served as Chief Technology Officer at Verdasys and as Chief Information Security Officer roles in industry settings tied to Wall Street finance infrastructures and research consortia linked to DARPA-style initiatives. Geer has been a speaker at conferences including Black Hat, DEF CON, RSA Conference, and academic venues such as USENIX and has advised government entities connected with National Institute of Standards and Technology and think tanks like the Council on Foreign Relations.

Research and publications

Geer’s output spans technical papers, position essays, and testimony addressing security engineering, applied statistics, and the economics of vulnerability. Notable works include essays and presentations circulated within venues associated with IEEE, ACM, and workshops co-located with SANS Institute events. He contributed to discussions about disclosure practices in contexts involving vendors such as Cisco Systems and Oracle Corporation and platforms like Linux and Windows NT, often referencing incident case studies tied to incidents involving Stuxnet, Conficker, and notable worm outbreaks of the early 2000s. His writings frequently intersect with scholars and practitioners from MITRE Corporation, RAND Corporation, and Harvard Kennedy School on topics that combine technical detail with policy implications.

Views on cybersecurity policy and risk

Geer is widely associated with framing cybersecurity as a risk-management discipline that benefits from economic modeling and actuarial approaches drawn from sectors like insurance and financial services; he has advocated for measurable metrics addressed to organizations such as Securities and Exchange Commission and regulators in contexts similar to Sarbanes–Oxley Act compliance. He has argued for responsible vulnerability disclosure practices that balance vendor incentives exemplified by programs at Google, Facebook, and bug-bounty initiatives with public-interest protections referenced in debates involving FBI digital-forensics priorities and National Security Agency surveillance controversies. Geer has emphasized transparency and data-driven decision-making aligned with standards from ISO/IEC JTC 1, NIST Cybersecurity Framework, and policy dialogues involving European Commission digital policy forums.

Awards and recognition

Geer’s contributions have been recognized by peers and institutions that include honors and invitations from organizations such as ACM, IEEE, and security industry awards presented at forums like RSA Conference. He has been cited in policy hearings before bodies comparable to the United States Congress and has received professional acknowledgement from research centers and private-sector advisory boards linked to In-Q-Tel and cybersecurity philanthropy initiatives. His influence is reflected in curricular adaptations at universities such as Carnegie Mellon University, Harvard University, and University of California, Berkeley that integrate economic and risk concepts into cybersecurity programs.

Category:Computer security specialists Category:American technology writers