🧠Humans of Cyber | Andrew Morris
A spotlight on Andrew Morris and GreyNoise, the project built to help defenders separate internet noise from activity that matters.
Security teams lose time when every alert looks urgent and harmless internet noise gets mixed in with real threat activity. One project built to help with that problem is GreyNoise, created by Andrew Morris. Today, GreyNoise is led by CEO Ash Devata, with Morris serving as Founder and Chief Architect.
GreyNoise was built to help defenders understand what they are seeing in their logs by separating widespread internet scanning and background activity from behavior that may deserve closer attention. Instead of treating every IP hit as equally important, the platform was designed to give analysts more context around who is scanning, what kind of activity is common, and what might actually matter.
GreyNoise collects and analyzes internet-wide scan and attack data through a large sensor network, then uses that visibility to label activity and help teams prioritize investigations. It is used through its platform, API, and integrations, which makes it useful for security operations, vulnerability management, and threat hunting workflows.
That made GreyNoise important for defenders who needed a faster way to decide whether an event was part of routine internet noise or something more targeted. Its value came from reducing wasted effort and helping analysts focus on the signals that were more likely to point to real risk.
Today, GreyNoise remains one of the more recognized names in internet telemetry and real-time threat context. Andrew Morris’s work, alongside Ash Devata’s leadership, helped push the idea that security teams do not just need more data, they need better ways to filter and understand it.
Subscribe and Comment.
Copyright © 2026 911Cyber. All Rights Reserved.
Follow 911Cyber on: