Stephen Northcutt
US Navy intrusion-detection pioneer who built SANS's certification engine, GIAC.
At the Naval Surface Warfare Center in Dahlgren, Northcutt led work on Shadow, an early network IDS assembled from tcpdump and scripts — cheap, free, and a pointed alternative to expensive commercial sensors. The experience became Network Intrusion Detection (1999), which through several editions was the standard text for analysts expected to read packet dumps by hand.
He moved to SANS and in 1999 founded the GIAC certification programme, which turned hands-on exams into a business roughly the size of the training itself. He later became president of the SANS Technology Institute. Few people have done more to make the security industry measure competence in strings of capital letters.