I am the vulnerability.

Every security company says the same two things. We find vulnerabilities. We fix vulnerabilities. Scan the marketing pages of any twenty vendors and you will read the same promise twenty times, with different fonts.

The line on my personal brand says something else. It says I am the vulnerability. Not a typo. Not edgy for the sake of it. It is the most honest sentence I have ever written about my career, and people ask about it constantly. So here is the story behind it. It starts on a help desk, it nearly ended there, and if you are somewhere in your own life waiting for conditions to change, I wrote the ending for you as much as for me.

FINDING 001The exposure I ignored

The help desk was not my first attempt at a future. I tried college twice in the years after high school, the first attempt squeezed around a family health crisis that had me driving my mom to physical therapy between classes, and neither attempt stuck. It would be easy to say I lacked motivation, and partly I did. The truer version is that I had not found a reason strong enough to outlast a hard week. Hold onto that detail, because it comes back at the end of this story.

January 2020, I took a help desk job at AutoNation. Phones, tickets, printers, password resets. I was good at it. I stayed for three and a half years, and for most of that time I told myself the same thing everyone on a help desk tells themselves: this is temporary, I am going to move up, next year will be different.

AutoNation sells cars, and at one point I was cross training on the sales floor, learning to sell them as a hedge. I remember standing there one afternoon, looking out over the lot, and seeing the whole thing at once: no degree, two abandoned attempts at school, and a version of my life where I stayed right there for thirty years because it was the only door that had opened. Nothing against the people who sell cars well and love the work. It just was not the life I kept telling myself I was building, and I was drifting toward it anyway, one skipped study session at a time.

Then the outsourcing came. You could see it moving through the org the way you can watch a storm front on radar. Roles consolidated. Openings frozen. People you sat next to for years suddenly gone, their tickets routed somewhere cheaper. By August 2023 it reached me.

Here is what I believed at the time: that something had been done to me. A company made a spreadsheet decision and my job fell on the wrong side of it. That framing is comfortable. It is also useless. It puts the root cause somewhere you cannot reach, which means there is nothing for you to fix, which means it will happen again.

I did not understand that yet. First I did the natural thing. I landed on my feet and called it a recovery.

FINDING 002Same root cause, new asset

September 2023 I started at Abt Electronics. Another help desk. I worked hard, and within four months I got promoted into the security team. On paper that is a great story: laid off in August, security analyst by January. I had broken into the industry. I should have felt like I had made it.

What I actually felt, slowly, was the same storm front forming again. Not from outsourcing this time. From looking around.

I saw peers, genuinely good people, who were going to sit in the same role for the rest of their careers. Same chair, same tickets, same ceiling, for decades. Not because they lacked talent. Because they were waiting. Waiting for the company to invest in them, waiting for the promotion cycle, waiting for permission. And when I looked at what actually separated me from them, the honest answer was: one lucky promotion and nothing else. I had gotten into security on momentum. Momentum runs out.

The layoff had not taught me anything yet. It had just moved me. A vulnerability does not disappear because you migrate the workload to a new server.

ROOT CAUSEThe exam room where it clicked

July 2024. Security+. My best friends and I had a plan: study together, sit the exam together, get certified together. It was going to be our thing, the group of us leveling up as a unit.

It fell apart the way group plans fall apart. Quietly. One person got busy. Another kept pushing the date. The study sessions thinned out and then stopped. And I had a choice that felt small at the time: wait for everyone, or go alone.

I went alone. I studied alone, I booked the exam alone, I sat in that testing center alone, and I walked out with the certification alone.

Somewhere in that walk to the car, the whole thing reframed itself. Nobody was coming with me. Nobody was coming for me either. No company, no manager, no promotion cycle, no group of friends moving as a unit. Every future I was waiting on had a dependency on someone else showing up, and the dependency kept failing. The layoff was never the vulnerability. The stalled career was never the vulnerability. Those were symptoms.

That realization is not a feel good moment. It is heavier than blaming AutoNation, because it means everything that happens next is on you. For yourself. For your family. There is no vendor to escalate to. But it is also the only version of the story where you get to act, and I decided I would rather carry the weight than wait out another storm front. That trade, weight for agency, turned out to be the best deal anyone ever offered me. I just had to offer it to myself.

REMEDIATIONSeventeen months, no downtime

October 2024 I enrolled at Western Governors University for a Bachelor of Science in Cybersecurity and Information Assurance. WGU is competency based: prove you know it, move on. No seat time, no pace but your own. Which means the degree moves exactly as fast as you are willing to work. For the first time, the thing between me and the future was not a gatekeeper. It was just work. I could do work.

I finished the bachelors in seven months.

Then I enrolled in the Master of Science in Cybersecurity and Information Assurance and finished that too, March 2026. Both degrees, seventeen months end to end, roughly thirteen of those months actively in school. The whole time I was working full time as a security analyst. Days belonged to the job. Nights and weekends belonged to the degree. Certifications stacked up inside and alongside the coursework: CySA+, PenTest+, CCSP, SSCP, Project+, Linux Essentials, ITIL, and more, past twenty certifications total by the end of it.

I want to be honest about what that stretch actually looked like, because the compressed version sounds like a montage and it was not one. It was constant work. Every day. Never stopping, never giving up, no matter how bad it got, and there were nights it got bad. Exhaustion, doubt, watching other people relax while you open the next course. The grind is not glamorous. It is just a decision you make once and then have to keep making every single morning. Some mornings the only thing I had going for me was that I had made the same decision the morning before, and I was not about to let that streak die.

But here is the thing nobody tells you about treating yourself as the vulnerability: remediation compounds. Every course finished made the next one faster. Every cert made the next one easier. The same discipline that got me through the bachelors in seven months made the masters feel almost routine. You are not just closing a finding. You are hardening the whole system. The person who started that degree in October 2024 could not have built a company. The person who finished it could not imagine not building one.

VERIFICATIONPatched, and monitoring

You do not get to call a finding closed without verification, so here is mine. The help desk technician who got outsourced in 2023 went on to found a company. He built CVEasy AI, invented a scoring engine, filed ten patents, and ships a platform that reranks how organizations prioritize risk. Not because he was special. Because one day in a parking lot after a certification exam, he finally read his own scan results correctly.

And this is why the line stays on the brand permanently, instead of retiring like a campaign. A patched system is not an invulnerable system. Anyone in this industry will tell you that. New exposures appear the moment you stop paying attention, in software and in people. I am still the vulnerability. I will always be the vulnerability. That is not defeat, that is the operating model: I am the thing that needs constant assessment, constant hardening, constant work, and I am also the only one with root access.

It is probably not an accident that the guy who learned to score himself like a finding now builds vulnerability prioritization for a living. Once you have run a real root cause analysis on your own life, running one on a CVE feed feels like the easy part.

THE WHYA reason that outlasts a hard week

I owe you one more piece of the story, because grind alone does not explain seventeen months, and I do not want anyone reading this to think discipline is something you either have or you do not. Discipline is downstream of a reason. Remember the detail I asked you to hold onto? The first two attempts at school failed because I was studying for a version of myself I could barely picture, and the moment a week got hard the picture dissolved. The third attempt held because this time the reason was bigger than me: a family I refuse to let down, my mom still working on her feet in her seventies among them, and a future I could finally see clearly. When the alarm went off and every part of me wanted to skip the next course, the reason ended the argument.

The same reason answers the question I get in a different form: why build CVEasy as a company at all, in an industry full of established players? The honest answer is not a market gap. I built the scoring engine for my own work, and a tool that only helps me felt like a waste, so I made it a company. There is no guarantee it works. I am building it anyway. I do not know if I get the ending I want. I know I do not get it by waiting.

YOUR SCANNobody is coming, and that is the good news

If any part of this sounded familiar, if you are on a help desk telling yourself next year will be different, or in a role with a ceiling you can already touch, or waiting on a group plan that keeps quietly rescheduling itself, then run the scan honestly. List every future you are counting on and mark the ones that depend on someone else showing up. A manager noticing you. A company investing in you. Friends staying on pace with you. Every one of those is a dependency you do not control, and dependencies you do not control fail. Mine failed twice before I stopped rating them LOW.

Hear the second half of the sentence, though, because this is the part that took me a parking lot and two lost years to hear. Nobody is coming to save you also means nobody has to. Nothing about my story required talent I was born with or a break someone handed me. It required a decision, made once, then kept every morning: study the thing, book the exam before you feel ready, go alone if the group dissolves, open the next course when everyone else is relaxing. That is the entire mechanism. It is brutally simple and it is available to you tonight, for free, without anyone's permission. And if the decision keeps dying on hard weeks, the way mine did twice, you are probably not missing willpower. You are missing a why. Find the person or the future you refuse to let down, and put it somewhere you will see it every morning.

Two degrees and twenty certifications in seventeen months sounds impossible right up until you understand it was never one big act. It was one small act, repeated. You do not need to be exceptional to do what I did. You need to stop misrating your own findings, accept that you are the vulnerability in your own life, and start treating that like what it is in this industry: not an insult, but a work order. The severity is real. So is the patch. And you are the only one with root access.