Guy who named 'BlueKeep' Windows flaw joins Microsoft Threat Protection

Kevin Beaumont, the UK cybersecurity expert who named the wormable Windows BlueKeep bug, is joining Microsoft Threat Protection.

Beaumont, a widely quoted security expert who's run large security operations centers, has offered insights from the trenches into new attacks via his popular DoublePulsar blog and Twitter for the past few years, covering issues including WannaCry, NSA exploits, the rise of malicious Office macros, and BlueKeep.

The move to Microsoft Threat Protection, which is responsible for Microsoft Defender antivirus, is notable in part because Beaumont has been "largely suspect" of cybersecurity vendors and "occasionally critical of Microsoft".  But he's also a fairly big fan of Microsoft's cloud-based SIEM Sentinel, which he's used to monitor his BlueKeep honeypot. Microsoft credited Beaumont and Marcus Hutchins – the UK security researcher who halted the 2017 WannaCry outbreak and was later arrested in Las Vegas – with helping it catch the first attempts at exploiting BlueKeep, which Microsoft feared could be as bad as WannaCry.