3. As an undergrad, you earned millions of airline miles finding bugs in United Airlines’ systems. What was the allure and what did you do with all those miles? 

Honestly, my girlfriend at the time — and now wife and mother of my child — had an internship with PayPal on the West Coast, and I wanted to visit her on the weekends. I might have overshot how many miles that would take. [Ed. Note: Pickren also donated 5 million of those miles to Georgia Tech for student organizations involved in charity work to use.]

4. What other kinds of industries have you helped? 

I’ve worked across social media, cloud, browsers, augmented and virtual reality, and most recently maritime. At Georgia Tech’s Cyber-Physical Security Lab, we even built a full-scale marine testbed — something truly unique that I highly recommend people check out!  

5. Lately, you’ve been finding and fixing vulnerabilities in critical infrastructure systems. Why do those problems interest you? 

My Ph.D. research focused on the attack surface created when cyber-physical systems intersect with web technologies. Many modern cyber-physical systems, from industrial devices to ships, have begun to incorporate web technologies in unusual and potentially dangerous ways — for example, secret embedded webviews inside privileged human-machine interfaces. Exploring this emerging trend has been exciting, and it allows me to bring my background in application-layer offensive security to a traditionally “old school” domain. 

6. How do you decide when a system or device is a good candidate to investigate for issues? 

You start to develop a “Spidey sense” after pentesting for a while. You’ll observe some unexpected behavior or odd error and know something isn’t quite right. If you tie enough software quirks together, you might eventually create a really impactful killchain of bugs.

7. Who’s winning in cybersecurity — the good guys or the malicious actors? 

There’s the classic saying: “Hackers only need to get it right once, but defenders need to be right every time.” That rings true in pentesting. A small oversight can unravel years of product hardening if an attacker knows how to exploit it. That’s what makes defense so difficult. Still, with places like Georgia Tech producing talented security professionals, I think we’re in good hands. 

8. What vulnerability or issue keeps you up at night? 

Artificial intelligence agents learning to pentest. I’ve never worried much about basic scanning tools. Interesting bugs usually require chaining complex, creative exploits that scanners can’t find. But an advanced large-language-model-driven agent capable of reasoning creatively? That keeps me up at night.

9. What’s one thing we should all be doing to protect ourselves and our systems online? 

Enable multifactor authentication and use a password manager. 

10. You finished your Ph.D. in the spring. So, what’s next? 

I’ve joined the family business in the powersports and marine industry. Specifically, I’m now working at AquaAmp, where we build rugged outdoor electronics. Stay tuned for some really exciting products in this space!