Gary McGraw
American researcher who argued that security has to be built into code, not bolted onto the network afterwards.
Around 2000, while the industry was busy buying firewalls and antivirus, McGraw and John Viega wrote Building Secure Software (2001), whose message was that most breaches start with a programmer's mistake. The follow-up, Software Security: Building Security In (2006), laid out "touchpoints" — code review, threat modelling, penetration testing — woven into the development process.
As CTO of the consultancy Cigital he helped create BSIMM (2008), which measures what real organisations actually do about software security rather than what they ought to do. He also hosted the Silver Bullet podcast for twelve years, a title that doubled as a warning. Since 2019 he has run the Berryville Institute of Machine Learning, which studies security in ML systems.