Johannes Ullrich
The physicist who started collecting other people's firewall logs in 2000 and ended up with one of the internet's first shared pictures of attack traffic.
DShield was a simple idea: volunteers submit their firewall logs, someone aggregates them, and suddenly you can see which ports are being scanned and from where — across the whole internet rather than one network. Ullrich launched it in 2000, and a year later it became the backbone of the SANS Internet Storm Center, where volunteer handlers write daily analyses.
Ullrich became dean of research at the SANS Technology Institute and hosts the daily StormCast podcast, a few minutes on what is being scanned right now. DShield's data and honeypots are still where people look when they want to know whether a fresh vulnerability is already being exploited in the wild.