James Forshaw

Forshaw made his name in 2013 by collecting $100,000 from Microsoft's first Mitigation Bypass Bounty — a bug bounty for techniques that defeat the operating system's defences rather than for individual bugs. He later joined Google's Project Zero, working alongside Tavis Ormandy and Ian Beer.

His speciality is logic flaws rather than memory corruption: access checks that look at the wrong thing, symbolic links pointing where they shouldn't, sandboxes with a door left ajar. Bugs like these often hand over clean privilege escalation without anything crashing. His NtObjectManager PowerShell toolkit and the book Windows Security Internals (2024) are effectively the documentation of the Windows security model that Microsoft never wrote.