Rules as Opportunities: Microsoft Research's Mike Walker on Hacker Mindset and AI Cybersecurity

For some, rules pose limitations. For others, like Microsoft Research Manager Mike Walker, they’re opportunities.

Walker’s fascination with rules and their role in the social order has allowed him to find success professionally and personally, from uncovering weaknesses in networked systems to redefining how computers are trained to fend off cyberattacks to pushing the limits of a reliable mode of transportation—the bicycle—in ultra-endurance racing.

In this conversation with Principal Technical Program Manager Weishung Liu, Walker describes how his participation in hacker culture led him to a career building next-generation cyber defense, including his work developing the first all-machine hacking tournament. Along the way, he reflects on why effective security depends on understanding trust and context, what competitive hacking taught him about teamwork and collective intelligence, and how an early lesson reshaped his understanding of leadership. He also tackles an important question: are today’s networked systems any safer than they were a decade ago?

MIKE WALKER: Well, you have to understand the rules if you want to be able to do what you want. So I have, I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication.

[THEME MUSIC]

STANDARD INTRODUCTION: This is the Microsoft Research Podcast, where Microsoft researchers—driving advancement through fundamental science and technology research—explore the who, how, and what’s next in computing and AI.

[MUSIC ENDS]

WEISHUNG LIU: Hi, and welcome. My name is Weishung Liu, and I’m a principal technical program manager here at Microsoft Research. And today, I’m joined by Mike Walker, who is a research manager here in MSR, or Microsoft Research, where he leads projects at the intersection of AI, cybersecurity, and large distributed systems.

Before Microsoft, Mike led DARPA’s Cyber Grand Challenge, the pioneering program that demonstrated autonomous AI systems capable of finding and patching software vulnerabilities. And CGC actually just celebrated its 10th anniversary this year in 2026.

Mike’s work spans groundbreaking efforts that include cloud native memory analysis, automated malware analysis, and next-generation cyber defense technologies.

Mike, thanks for joining me.

MIKE WALKER: Good to be here, Wei.

LIU: All right, so, Mike, we have known each other for a couple of years now. And I’ve heard, like, bits and pieces of your story over time as we’ve gotten to talk. But before I really knew who you were, sort of, as a person, I, kind of, knew you as, like, “Mike Walker, the hacker guy that’s working over there,” which I’m sure you love. And I know you love that, when I call you “The Hacker.”

But you’ve worked on so many things that I’ve never really thought about before. Like, new words have entered my vocabulary as a result of knowing you and working with you, like threat intelligence, nation states, and I think there are a couple other ones that I think would have never been in my lexicon had I not known you.

So I’m hoping we can spend this time to also have the audience get to know you, as well. So we’re going to start at the beginning then. And the beginning is, I believe, Mike, you grew up in Ohio.

WALKER: Columbus, Ohio.

LIU: Columbus, Ohio. What kind of a kid were you in Columbus, Ohio?

WALKER: I think I was a kid who spent a lot of time in the woods. [LAUGHTER] I was a skateboard kid. I was a basketball kid. But I think mostly I was a kid who read books and lived in a world of their own imagination.

LIU: Were you on a farm in Columbus, Ohio, or were you in, like, or is this more suburban, rural, urban?

WALKER: It was halves and halves. I spent my … most of the year in Columbus, Ohio, and then every summer, I would go out to the town of Tappahannock on the Rappahannock River in Virginia. And I lived completely on the farm.

LIU: So what was the lifestyle in what you were doing different between, like, Columbus, Ohio, and the farm?

WALKER: So, like, some things that I was doing in Columbus, Ohio, is that my father, who was sort of half scientist, half venture capitalist, would bring me home industrial equipment and say, “See what you can make out of this,” and drop it in my room. [LAUGHTER] Really dangerous stuff. And he would always give me safety warnings, right, like, “This is a helium neon laser.” You know, “This is … this tube is made out of glass. Don’t break it.” And then, “This is a really, really high-voltage power supply driving it, and it can arc and kill you,” right. And I knew what that meant. [LAUGHTER] And then he would leave me with it. And what can you make out of this, right.

So I would do stuff like, like try to replicate the Michelson-Morley experiment, you know, because I had the, had the table and the mirrors and I could do that. And then also I spent a lot of time with the Apple II, which was this just incredible machine from some other universe that I had never gone to. I later found out that was, you know, hackerspace and, and information technology culture, but it came from nowhere and there was nobody I could talk to about it. And so I spent a lot of time trying to hook the Apple II up to stuff in my life and, and try to control it with that thing.

LIU: OK, so you brought up some hacker stuff, so I have to ask. There was farm stuff. There was, you know, “dad brought home interesting tools and equipment.” How did all of that get you interested in cybersecurity?

WALKER: I think I was always in cybersecurity. I just didn’t know.

LIU: Explain.

WALKER: You know, there’s this idea that you live two lives: the one before you find out your purpose and the one after you find it. This was, sort of, life before purpose, where I didn’t know why I was so interested in how these things worked.

So, you know, I ran a bulletin board system. Before the internet, this was how computers communicated with each other. Dial-up modems, not even backbone linked. Each, each BBS—bulletin board system—[LAUGHTER] was, was a universe unto itself, you know, architected by its creator. And so there were all these little universes you could dial into. And then at some point, all these things I’d been doing my whole life, sort of, got connected to a career.

When you say, you know, somebody could, right, somebody could listen to every single badge swipe event on the network, on campus, and then replicate them and badge themselves into any building they wanted because this is all in a broadcast LAN [local area network] and somebody should change that, there was a time when if you said things like that, the people you told it to would just be like, “Well, don’t do that,” [LAUGHTER] right? And then …

LIU: Did you listen to them?

WALKER: No. [LAUGHTER] I was young.

Um, and then at some point, the world started getting serious about imposing rules onto networked computers, and they started hiring people who are interested in that. And that’s … suddenly it was a career, right. I was like, “Oh, I was always here, but now it has a name.”

LIU: So I have to ask then, like, you brought up the notion of rules. I feel like cybersecurity and rules has a relationship there. How much of a rule follower were you growing up versus how much do you think you are a rule follower now, and was there a difference or have you always been some version of “rule following”?

WALKER: Well, you have to understand the rules if you want to be able to do what you want.

LIU: Yes.

WALKER: So I have a definite fascination with the rules, [LAUGHTER] but the thing you have to understand about the rules is that rules are a social construct. And I think that a lot of … in the computer security field, when, when people hear the word “security” and they think about the rules that the security system is imposing on them, every time a security system asks something of users, then you’re asking for their trust. And that trust is a precious commodity. And so when you squander user trust, then the security regime falls down. So I think it’s really important to understand the social context of rules instead of just having instant adjudication.

LIU: OK. I’m going to have to ask you then about a game that we played recently called No Vehicles in the Park (opens in new tab).

WALKER: No Vehicles in the Park is … it’s a game about content moderation is one way to look at it. I think it’s a fascinating thought experiment. But it just takes the thesis that rules are simple and challenges it with putting the player in the position of judge. And so the name of the exercise is the name of the rule, which is no vehicles in the park.

And then it asks you some very simple commonsense questions about, is this a violation of the rule no vehicles in the park? Like if the International Space Station overflies the park, is that a vehicle in the park, and is it against the rules?

LIU: Mike, do you think the ISS flying over the park is a violation of the rules?

WALKER: No. [LAUGHTER] But it’s important that we have a resilient way to adjudicate things that, that bridges social norms.

LIU: OK. How much did you agree with the population, by the way, of No Vehicles in the Park?

WALKER: I’ve rarely ever broken 50%. Yeah.

LIU: I got like 90 …

WALKER: I play often.

LIU: I think I got 96% on my first try, so I think I … does that mean I’m kind of like a lemming that, like, just understands the social construct of rules?

WALKER: I think it means you, you channel the zeitgeist.

LIU: Mm, OK, I’ve been assimilated.

WALKER: Right …

LIU: That’s what it feels like.

All right. So let’s talk about something that I love, which is you had a short segment in 60 Minutes (opens in new tab) where you had a conversation with Lesley Stahl, and she described you as “one of the world’s top hackers,” at least at the time in which she interviewed you. And so now I have to know, how did you find hacker cultures? What was the extent of your involvement and, you know, how did you really get into it?

WALKER: It, sort of, happened all at once, and I can tell the beginning of the story, and then I can tell you the day that the story stops.

So the beginning of the story is that I was working at a, at a startup building telecommunications technologies on Sept. 11, 2001, and I was living in Maryland, outside of Washington, D.C., but my wife was in Washington, D.C., on that day, and, um, and then all the phones stopped working. My workplace was overflown by an F-16, and, and after that, in the nation’s capital, there was this sudden talent search for people who understood computer security or people who’d always been there but didn’t know what it was called. And that talent search found me.

LIU: What, uh, what were the qualifications, like, that you had that, you know, matched with their list of talent that they were looking for?

WALKER: I wish I knew.

LIU: World’s top hacker?

WALKER: I think, I think that that label was placed on me much later.

LIU: [LAUGHS] All right, fine.

WALKER: I think that I became part of a series of cultures after that day, and one of them was the, the group of people who play in DEF CON Capture the Flag, which is a hacking contest in Las Vegas. And when you start getting involved in trying to get, get better at something in a way where you can compete at a national or international level, especially in sort of a coffeehouse environment where everyone else is trying to get better, too, it sort of propels you upward very quickly.

LIU: OK, let’s, let’s go back later to talk about Capture the Flag, because I think it’s related to the, sort of, next arc of your life, which was your time as a project manager—program manager—at the Defense Advanced Research Projects Agency, also known as DARPA, which is also why Lesley had been interviewing you at the time. It was associated with your affiliation at DARPA, and you were there for about four years.

How did you, how did you go from, you know, let’s say call, call to action from the nation’s capital looking for people with your specific set of skills to being at DARPA as a PM.

WALKER: So we should, we should be clear, we’ve just, sort of, skipped over 11 years of Mike trying to get better at hacking.

LIU: [LAUGHS] You were world’s top—look, I just believe world’s top hacker, one of the world’s top hackers.

WALKER: Well, I think, uh, I think my, my friends, colleagues, and teammates from the time, if they were here to, to hear that accusation being made, would give me endless grief about it.

Certainly, there was a, there was, sort of, a golden age of Capture the Flag, and I got to be part of it and see some of the people. I got to see the game change over time. But it was a competition, so … and it was very reflective of a skill set that was of national interest. I think at the same time, the think tank RAND had published an opinion piece called Hackers Wanted (opens in new tab), right, which, sort of, described the immense need for more people who could think that way at a high level.

And DARPA, specifically Norm Whitaker and Dan Kaufman, who were leading I2O [Information Innovation Office] …

LIU: DARPA Dan!

WALKER: DARPA Dan … looked at the game of hackers, right, and if you could think of that as soccer, their immediate question was, what about robot soccer? You know, could we make automated systems that could play this game? And so they encountered myself and some colleagues giving a talk about, sort of, the, the interleaving of Capture the Flag as, you know, hacking contests and talent development. And they said, you know, could you do talent development for computers the same way, right? Could machines play Capture the Flag? And that, that was the beginning of the conversation about building the world’s first all-machine hacking tournament.

LIU: OK, so now, now maybe let’s go back and explain what DEF CON Capture the Flag was, or CTF, because I think a lot of us who are again not in the space, you say, “Capture the Flag,” and I’m thinking, like, summer camp. And, you know, each … there are two teams, and there’s kids who hide flags, and then you try to run around and find the flag, you find the defenders and whatnot. So what was the DEF CON version of this?

WALKER: It’s changed over time. That’s the thing about this game that I should lead with is that Capture the Flag is different with every generation, and at least in my opinion, I think it’s gotten better with every generation, right. Each hacking group that’s picked up the lessons of the past and the game has made it better, but it is, sort of, based around that playground idea, right. My team has some flags. Your team has some flags. We’re going to try to take each other’s flags. Whoever takes the most wins, right. It is that simple.

Now there are more than two teams, somewhere between eight and 16, and each team is trying to take flags from every other team. They’re trying to protect their own flags. But, of course, the flags are made of data, right, …

LIU: Mm-hm.

WALKER: … or control over a networked system. And the way that you protect your own data and control of your own network system is network defense, right, and computer defense. And the way that you take flags from other, other teams is you hack into their servers and you take their flags and you do it without getting caught. And then what makes this game, sort of, unique is that all the software that you’re protecting is written just for that game. It will never be used again. It’s boutique. It was written by the organizers, kept in secret, revealed to the teams the minute they sit down. They’ve got new software they’ve never seen before. They don’t know what it does, and they’re in a race to understand it, and they’re racing everybody else. Because if you can understand it, then you can protect it, and if you can understand it, you can hack it.

LIU: OK. So let’s get into this thing called DARPA’s Cyber Grand Challenge, or CGC, which just celebrated its 10th anniversary. And so from what I understand, CTF—humans playing soccer. CGC … robots playing soccer? Is that probably a good way to, to …

WALKER: That’s exactly it.

LIU: OK, so now explain to me a little bit further, like, what was CGC, what was your role, and then more importantly, did it feel historic at the time or just, kind of, impossible and you somehow figured out with a large group of folks at DARPA, “This is how we’re going to solve this impossible thing”?

WALKER: Well, there’s, there’s two ways to answer that. There’s the, the day before it worked and the day after it worked, right. [LAUGHTER] There were actually three and a half years before it worked. So if you’d ask me, I think, in any of that three and a half years, I would have said let’s wait and see.

LIU: So, so what was it, though, like—by the way, I think you can watch the first CGC online (opens in new tab). Like, there’s a whole recording of the event.

WALKER: There is a recording of the event, which we had sports casted live with announcers, and, and so you can watch it as it happened, and it was, it was a capture the flag, right—protect data, steal data—that was run entirely by autonomous systems behind an air gap, so if they failed, there was no person even to turn them off and turn them back on again.

LIU: So how did … so if I think about how you just described Capture the Flag with DEF CON, but there were, like, people on the floor coding, I’m assuming, though, you’re saying CGC did not have that. So were there teams that had, like, pre-created something?

WALKER: Yes. They had spent many years of their life actually building these autonomous systems, and you can’t really preflight an autonomous system whose purpose is to fight. You can preflight an autonomous system whose purpose is to maybe go for a drive, right. You can take it for a drive. But if you’re going to fight other systems, you have to, like, build another one, right. And we did give them some exposure to a, sort of, scripted opponent.

The DARPA infrastructure team built a scripted opponent and attempted to give teams some pre-exposure. But that first confrontation between adversarial hacking machines, there wasn’t really a great way to prepare for it. And so the teams were in this really tough position of watching the systems play—win or lose—in a way where they couldn’t do anything but watch.

LIU: So, you know, I want you to think back on that time, as well, because, like, now when we’re talking about AI, it seems a little bit more commonplace, right? We’re like, oh, you know, we have GPT, we have Claude, we have a lot of other models, as well. So, like, how historic was that? Because I think it can’t be understated how vastly different, sort of, autonomous or artificial intelligence capabilities were like 10 years ago versus now.

WALKER: It was, it was a different universe of capability, and Cyber Grand Challenge had a role in the development of the technology stacks that we’re seeing today, but it was an expert systems contest. There was, there was no—at that time, we would have called it machine learning—but there’s no, no real involvement, critical involvement, in machine learning.

But there was this fusion of tooling where you had, sort of, an autonomous set of tools that could perform a lot of these tasks as far as conventional compute could push the state of the practice at the time. I think if we look back from the perspective of today, which is, which is still a perspective that’s difficult to keep up with and difficult to appreciate how, how radically different the intelligence displayed by today’s models is from what we had in 2013, 2016, we’re still seeing the technology stacks that we would have called “expert systems” in 2016 being used as what we call a harness today.

So if … just to talk about another DARPA project, AIxCC [AI Cyber Challenge] (opens in new tab), which happened a few years ago, some of the people from Team Atlanta, which won that competition (opens in new tab), are building a harness called MDASH, which is, I think we could call it a cyber reasoning system that is powered by models and used to do these sorts of tasks autonomously.

LIU: You were interviewed by The New York Times in 2016 about CGC (opens in new tab), and you said that making networked technology safer was a “challenge for civilization.” And, you know, what do you think about that? Has civilization made progress on, you know, resolving that challenge? And what are some tangible takeaways that you think, you know, from 10 years ago till now, think through sort of how, how we’re making things safer for civilization?

WALKER: I’d say that’s as true now as it was then, maybe more so. And I think our dependence on networked systems for every piece of civilization has only increased. I think it’s difficult to buy a car or to participate in a utility grid that isn’t networked, right.

How we’re doing? I think that we’re seeing a great disruption of the status quo right now. I think that we reached a pretty steady-state equilibrium, where our, our security in our networked civilization was, sort of, dictated by offensive scarcity. There was a known cost for high-end computer network attack, and that cost equation has been completely upended by the capabilities of models.

LIU: So in thinking about, sort of, capabilities of models then, some terms that, that I’ve heard used are things when we’re testing models, for example, is––we call it––red teaming. But then I also hear that there’s something called blue teaming. And then, of course, if you’ve taken primary colors or understood kindergarten primary colors, if you put red and blue together, you get purple teaming. Can you explain to the audience a little bit about those differences?

WALKER: Yeah. Red team and blue team is sort of an artificial separation between being an attacker and being a defender, and it’s also, sort of, an oversimplification and an abnegation of capability, right. Attackers attack; defenders defend. But if you, if you take that simplification away and you look at what’s going on under the hood, you’ll see that the difference between offense and defense most of the time is, sort of, who’s in control or who’s driving.

If you were to give a name to a program that encrypted every file in your computer and then unlocked it when you needed it, that is either a cryptography utility or it’s ransomware depending on who holds the key. If you were to give a name to a program that, that allows you to log in to your computer remotely and control it, maybe your home automation setup, that is either malware or remote administration utility [LAUGHTER] depending on who holds the key, right? Who holds the key.

So there’s, there’s this, sort of, blurring of offense and defense where computer security capabilities at their most atomic basic level aren’t offensive or defensive. They’re dual use. And so the idea of red teaming and blue teaming is sort of this idea that we can impose single use onto dual-use capabilities, and purple team is the acknowledgment that that’s not true, right.

Attackers, as soon as they break into a network, they have an intrusion that they need to defend. You’ll hear all these terms like moving laterally, which just means breaking into more computers, or exfiltration, which means taking data. But the whole time they’re doing that, they’re trying not to get caught, right. So they are defending their attack, right.

LIU: Mm.

WALKER: And at the same time, when defenders are doing things like log analysis or really any—or traffic analysis—their tools themselves can be broken into, right. They have a duty to defend their own tooling, and they also need to, in order to prevent attackers, they need to be able to find vulnerabilities, find weaknesses, and then grade weaknesses in their own software. And the way that you find vulnerabilities is vulnerability research, and you grade weaknesses by writing exploits or at least proof of vulnerability, and that’s offense, right. So purple team is just this idea that attack and defense are the same skill set. They’re the same tooling. They’re blended. And it’s really a contest to control the logic of memory of networked computers run all the time.

LIU: All right. So, so I’m going to ask you a little bit about the team that you manage then. It’s called New Security Ventures. And would you classify the type of work that you and your team do as being red, blue, or purple? Or are we going to introduce a different coloring from the rainbow?

WALKER: I think that we do highly offense-aware defensive tool development. So we build defensive tools, but we build them knowing that they are a target.

LIU: What’s one example of a project that your team has been working on?

WALKER: We have a project we call Project Freta. It’s named after the birthplace of Marie Curie (opens in new tab), the pioneer of battlefield imaging (opens in new tab). [LAUGHTER] And the idea is, is that … well, first I actually need to introduce tampering. We think of ourselves as the solution to tampering, but, but first, what’s tampering, right?

LIU: What’s tampering?

WALKER: What problem are we solving?

So let’s say that my job is to break into a store undiscovered, right? It’s mission impossible, right? I’m going to break in, take the Doritos, not get caught, right.

LIU: Wait. Hold on. What flavor of Doritos?

WALKER: I don’t know.

LIU: What?!

WALKER: I don’t actually eat them. I’m sorry.

LIU: OK, fine.

WALKER: But that’s, you know, it’s mission impossible. I have to take them.

LIU: Fine. You got to go get Doritos.

WALKER: I have to not show up on the video.

LIU: Yeah.

WALKER: I can compute this path of not being observed by the video camera. It’s really hard, right. Maybe I do some, some kung fu, some gymnastics. I slide into the laser wire, I grab it, and I get out. But there is another way to break in and not get caught, which is to walk in, right, wave at the camera, cut the feed on the camera, take it down, and replace it with a fake video camera that just plays good video, like there’s nobody in the, in the store, and then go in and change the tape and leave. That’s tampering, right?

LIU: OK.

WALKER: And it sounds actually less complicated, right, than trying to simply not be observed. And if you look in the computer security world at tampering, tampering is often the easier way to accomplish the objective of an attacker, which is to break in and not get caught and defend their intrusion, right. They’re doing defense while they’re doing offense. And so Project Freta is an attempt to solve that at cloud scale, to make it so that when defenders acquire defensive signals, right, telemetry signals about what’s happening in computers, they don’t do it with software that can be removed or tampered with. They do it by acquiring signals from cloud hardware. And so we’re a whole-system memory analysis environment built from the ground up for looking at memory that’s acquired from cloud hardware.

LIU: So, OK, so you just revealed, for example, how Project Freta works and how it protects or is trying to defend against something like tamper. But then, you know, I’m kind of curious, though. You just revealed how it works. So, you know, you’re kind of telling the attackers what you’re doing and how you’re defending. How does that work if you’re like, “This is how I’m defending, like, this is how I’m defending my castle. Here you go”?

WALKER: Well, you can reveal a technology or you can reveal its deployment. And I’ve revealed a technology, and I haven’t said anything about its deployment.

LIU: OK, so there’s a, there’s a difference, and there’s layers that you’ve described so that, you know, even though you’ve revealed something, you haven’t revealed the full extent.

WALKER: Well, you’re, you’re bringing up a really interesting part of the game theory of, of adversarial computer network attack-computer network defense, which is that attackers condition their behavior based on their perception of what the defense is doing. And so that gets into these, these strange effects of, is the best way to protect a network to say that you have something or to actually have it or to have a mismatch between what you say you have and what you have.

LIU: So you’re like bluffing in poker.

WALKER: There’s a reason this game is played in Vegas. [LAUGHTER]

LIU: OK, OK. So we’ve had, we’ve had some, like, more serious, like, topics for a while. And I want to get into something that maybe a lot of folks who maybe even know you don’t know about you, which is you love—I think I’m going to use … I think I can say love—cycling.

WALKER: That’s true.

LIU: How did you get into cycling?

WALKER: I got into cycling in, sort of, the way that I’ve gotten into a lot of things in my life, which is I got into it through what I thought at the time was, was a disaster. I blew out my knee playing basketball, which was one of my first great loves, right. And I went through surgical repair. And afterwards, the surgeon told me you can’t do the stuff with this knee that you used to do.

I said, “Well, what can I do?” You know, I hadn’t even thought to ask this question before surgery. You know, I’m sitting there trying to, like, rehabilitate the knee. And he said, “Well, you could try swimming or you could try riding a bike.”

I didn’t really know anything about either one. You know, I used to ride a bike to get around. And then a friend of mine in college introduced me to mountain biking, which is sort of this idea that you could take a bicycle, which is a very stable system—you know, you go out and you ride it down the sidewalk; it works great—and ride it over, you know, just horrible, you know, really steep, rough terrain that no one should ever try to ride a bike on.

LIU: OK. And you did this recently at a 100-mile endurance race called High Cascades.

WALKER: High Cascades 100 (opens in new tab).

LIU: And what was it like to prep for that? Because I feel like you’ve been, you’ve been working on some very important things on the professional side. And then you also had this big 100-mile endurance race that you were prepping for on the personal side. How did that go?

WALKER: There are very few things in life where you have a fixed date and time where you have to show up and deal with uncertainty, and ultra-endurance racing is one of those. Um, there’s, there’s the parts that you can prepare for and the parts you can’t, right. You can’t prepare for the smoke forecast or the weather. You can just have a range of options.

But then, you know, as far as the conditioning, I do spend a lot of time on the indoor trainer. I just wake up really early. I have, I have a whole structured plan. I think I started around January to race in July.

LIU: Do you follow them like you follow rules? [LAUGHS]

WALKER: Well, I’m much more strict about following my training plan. Actually, I think, I think I’ve been advised—this is real—not to be trainer robot.

LIU: Wow.

WALKER: So I had to back off on being trainer robot.

LIU: OK, so you had to ease up on the rules that you were following, that you wrote for yourself.

WALKER: Yeah. There’s this mode … all the cycling fans on the … watching this are going to, are going to be like, [WHISPERS] “Oh my gosh, he’s talking about erg mode.” There’s this mode called erg mode where the, the trainer decides how hard you should pedal. And it took me … and so I would just set it to that and do what it told me, right. And so it was this big thing to, to actually go into free ride and try to, try to ride the terrain.

LIU: OK.

WALKER: Yeah. Back, back off and try to, try to listen to your body a little bit rather than just do whatever it takes.

LIU: [LAUGHS] I feel like there’s a relationship between what we are talking about now and something maybe related to the cybersecurity side of Mike. But I have to … I really want to get a photo of this on this podcast, this video podcast. So I am going to ask you about Orange Crush.

WALKER: Oh, OK.

LIU: Can you tell the audience, what is Orange Crush?

WALKER: Orange Crush is the project bike that I built over the year when I was out with a blown shoulder.

LIU: I think that’s when I met you.

WALKER: Yeah. The problem with riding the bikes down the steep hills is, like, sometimes, it doesn’t go completely perfect.

LIU: Didn’t we have … we also had a colleague who also likes to mountain bike who, like, broke his back at around the same time you had a shoulder injury.

WALKER: Yeah.

LIU: Also mountain biking.

WALKER: Yeah. Kind of depends on how you break your back versus how you break your shoulder on which one of those works out better.

I got a … I messed my shoulder up pretty good, so it took some time, but it meant that I got to, kind of, conceive of something and put it together, mostly left-handed, which is its own challenge. So it’s, it’s a gravel bike, but it’s … and, of course, my wife named it. She gets the naming rights because she’s better at it, but it is very orange.

LIU: Um, we’re, we’re coming up close on time, so I’m going to start wrapping up with a few questions, but I, I love this question and I can’t help but ask you, Mike, what is the difference between suffering on a bike and suffering through a hard technical project?

WALKER: Well, I don’t think of riding a bike as suffering at all. That’s like the good part.

LIU: Even, even, OK. Because in your 100-mile endurance race on High Cascades, I think you said it was, like, nine hours of …

WALKER: Yeah.

LIU: … nonstop riding, like, in terrain.

WALKER: Racing. Yeah.

LIU: That seems like there might have been a little bit of suffering.

WALKER: No, that’s absolutely the best part. [LAUGHTER] No, no, the suffering is, the suffering is the checklist and the logistics the day before. Suffering is going out for a pre- ride and getting a flat and trying to find a bike shop that can get a tire patch in the day before High Cascades. [LAUGHTER] No, the logistics and the, and the worrying, right, that’s always the hard part. Once, once, once you’re at … you know, it just gets worse and worse up until the start. And then you’re racing, and it’s wonderful.

LIU: And I want the audience to know—because High Cascades, you can actually look it up on the internet …

WALKER: That’s true.

LIU: … Mike finished 69th out of 329 participants (opens in new tab). I’d say that’s pretty, that’s pretty darn good. I don’t even know how to ride a bike, Mike.

WALKER: Um, I, I race these days to learn about myself, you know.

LIU: Do you work on hard technical projects to also learn about yourself?

WALKER: I work on hard technical projects half because just getting to solve hacking problems is, it’s, sort of, what I’ve always done. But then also, I get to work with great people, and I get to, I get to see impact. I get to see the impact of our work.

LIU: All right. So I have a lightning round of questions that I’m going to ask you.

WALKER: OK. All right.

LIU: So just come up with—this is not a Rorschach test. Just come up with, like, …

WALKER: It might be.

LIU: It requires pictures if I do that. But we’re going to do a lightning round. So the first one: advice that blew your mind or changed your perspective.

WALKER: Hm, um, I remember when I was starting at the agency, I was, I’d, I’d worked in an engineering shop for a long time, and the culture of, of many engineering shops is to be critical of leadership, right. They would see what leadership did and then take the information they had and be critical of the decision. Not all the time, but sometimes. And I had a mentor who took me aside and said, “Have you ever considered that the decisions that you don’t agree with are the result of information you don’t have?”

LIU: Ooh.

WALKER: And then they took me into a situation where I, sort of, was revealed … the, the information I didn’t have about the decision I disagreed with was revealed to me, and suddenly I thought it was a great decision. I was like, “That’s incredible.” And then I left and I couldn’t talk about it, and I saw other people having the same criticism of the decision, and that started the process of reformatting how I thought about leadership. Every time I hear a decision now, I think to myself, “What do they know that I don’t?” And that curiosity process is always running.

LIU: OK. Lesson you learned the hard way—which is … I feel like this is a very easy question for you—or the misstep that humbled you.

WALKER: There’s so much to choose from here. [LAUGHTER]

LIU: First one that comes to mind.

WALKER: I probably made one on the way here.

I’ll, I’ll pick one that’s, that’s relevant to the discussion today, which is that I remember distinctly playing in qualifiers in a hacking competition and getting, getting the answer, right—getting the key, right—and running up to the person who was handing in keys for our team, being like, “I solved”— you know, I don’t know what it was; every challenge has a name, right—”like, 202,” and they were like, “Oh, we solved that an hour and a half ago.” [LAUGHTER]

And, and I, I remember, you know, “Oh, OK. Well, I better find something new to work on.” And I just looked around the room and, you know, we’re all curled over our hacking workstations, two monitors and a keyboard no one would recognize as a keyboard—you know, we all look the same—and, and thinking to myself, I can quantify the IQ in this room, but I can’t look around and quantify how well we’re working together.

LIU: Mmm.

WALKER: Right? I don’t know how aligned we are in this goal of getting the most points and winning here. And I can’t look around and figure out how many people here are on the right challenge or on a challenge that’s already been solved, have the tools they need, would be paired with the right person.

And myself and a couple of my colleagues started thinking about, like, what is the right way to create social intelligence in, in technical teams and hacking teams? And, and that has stuck with me. I mean, that’s been a constant thread, is, is just the abandonment of the hero journey and net IQ as a way that, that teams accomplish things, because you will find people working on challenges to get the key, right—as a metaphor—where the problem’s already been solved in any organization that isn’t working on, on its EQ. You’ll find it everywhere.

LIU: OK, talent or—I was going to ask you a bunch more, but we’re lightning rounding right now. Talent or accomplishment you’re most proud of if given the chance to brag.

WALKER: Mm. Bragging’s not in my nature, I don’t think. But …

WALKER: I, uh, I taught myself to juggle while my knee was blown out.

LIU: [LAUGHTER] That’s the thing you’re most proud of is juggling.

WALKER: Well, so if you haven’t, if you haven’t learned how to juggle, it’s fine, right. But if you have, you know that 99% of it is dropping them and they go everywhere, which when you’re immobilized with a busted knee, it’s actually harder than it sounds.

So I engineered a way to teach myself to juggle where I just got myself into a small enough space that I couldn’t lose them and I could just sit there with my blown-out post-surgery knee and teach myself to juggle. I did it in a couple of weeks.

LIU: Can you still juggle?

WALKER: Oh, yeah.

LIU: OK, so if I handed you stuff later …

WALKER: I mean, let’s not break the room, but sure.

LIU: [LAUGHS] OK. Last one: career path you would have chosen—this is going to be hard—if you weren’t, like, in cybersecurity. And it feels like it’s, like, in your DNA, so I’m not sure, but I would love to hear an attempt.

WALKER: Oh, it’s science fiction writer 100%.

LIU: Really?

WALKER: You know, I thought I was going to be a musician, but when you’re a … when you go out and you start getting into a music scene, you, kind of, find out if you were a natural or not. So I think science fiction writer is still the thing where I wish I’d kept at it a little more.

LIU: All right, I’m going to, I’m going to break my own rule, which is not … which is a social construct, and ask you one more, which is, can you recommend to the audience a really good—your favorite or one of the best sci-fi books you’ve ever read?

WALKER: Oh, sure. Easy. It’s The Forever War (opens in new tab). Haldeman’s Forever War. And it’s, I think, it’s about coming to hand in the key except the challenge’s already solved, except sort of writ large in a, in a universe governed by relativity.

LIU: OK.

WALKER: No spoilers.

LIU: No spoilers. All right. Fine.

Thank you so much, Mike—this was a great time—for joining me.

To our audience, thank you for listening. If you want to learn a little bit more about any of my colleagues in Microsoft Research and their work, check out the Microsoft Research website at aka.ms/research (opens in new tab) [MUSIC] or listen and watch other episodes of the podcast on YouTube and major podcast platforms.

[MUSIC ENDS]

Learn more:

New Security Ventures Homepage

Project Freta Homepage

Toward trusted sensing for the cloud: Introducing Project Freta Microsoft Research Blog | July 2020

Stepping Up Security for an Internet-of-Things World (opens in new tab) Article | October 2016

Cyber Grand Challenge (opens in new tab) Research program homepage | DARPA

DARPA’s Cyber Grand Challenge (opens in new tab) Video | February 2015

No Vehicles In The Park (opens in new tab) Homepage

Security, privacy, and cryptography

Research Groups

New Security Ventures

Microsoft Research Special Projects

Related labs

Microsoft Research Catalyst Lab