INFOSEC INSTITUTE▊
Organization dossier Watchdog docket: attrition.org/errata/charlatan Status: still operating
A security-training company that — per Attrition.org's documented findings — plagiarized independent community researchers, then, by its founder's own client list, sold that training to the NSA, GCHQ, the Air Force and the Army. When caught, it attributed the copying to a contractor.
InfoSec Institute is the best source for high quality information security training. We have been training Information Security and IT Professionals since 1998 with a diverse lineup of relevant training courses. In the past 13 years, over 15,000 individuals have trusted InfoSec Institute for their professional development needs!
InfoSec Institute, describing itself on its own website (c. 2011), as reproduced verbatim by Attrition.org
- ENTITY
- InfoSec Institute (ISI), Elmwood Park, Illinois — for-profit information-security training company, infosecinstitute.com, founded 1998 FACT
- PRINCIPAL
- Jack Koziol, founder & owner — named personally in Attrition.org's incident documentation; the record below distinguishes company findings from findings naming him FACT
- THE FINDING
- Per Attrition.org (Nov 2011): systematic, repeated plagiarism across ISI courseware and articles — Corelan.be exploit-dev material, plus presentations, plus a reverse-engineering course ATTRIBUTED
- THE DRAMA
- Stolen-then-sold: the plagiarized material, per Attrition, reached government and military clients ISI itself listed — and when the exposé landed, the company blamed a contractor and quietly revised its policy
- RECORD
- No court has adjudicated any of this. The plagiarism findings are a watchdog's documented allegations — detailed and side-by-side, but attributed, not a judicial ruling. ATTRIBUTED
- STATUS
- STILL OPERATING — infosecinstitute.com is live; the courses still sell; the archive still has the errata page
This one is a company, not a person — but a watchdog named the founder in specific incidents, so he appears where the record puts him and nowhere else. Keep the two distinct; this file does. What follows is the sequence as one archivist documented it: the positioning, the first catch, the cascade, the contractor defense, the quiet policy revision.
Every plagiarism line below wears the name of the person who found it. None of it has been to court. That is why the archive exists. Both sides get the microphone. You decide who wins.
the drama timeline
ACT I — THE CREDENTIALS (1998–2010)
Every display begins with the gathering of materials. This one gathers a founding date, a client list, and a promise of "high quality" — the last of which the field will later hold up to the light.
-
c. 2010–2011
The pitch, and the client list
ISI describes itself as "the best source for high quality information security training," in business "since 1998," trusted by "over 15,000 individuals." Per a 2010 presentation by founder Jack Koziol — the company's own account of its book of business — ISI had trained the US Air Force, the NSA, the US Army, GCHQ, Symantec, KPMG, Bank of America, Trustwave, JPMorgan and McAfee. The words and the roster are the company's own; Attrition.org reproduced both.
Note the materials: a founding date, a government roster, and the phrase "high quality." Hold that phrase. The field will need it in a moment.
ACT II — THE FIRST CATCH (OCT 2011)
The field has seen many training decks. It had not, until October 2011, been asked to buy back its own words. What one researcher noticed, another archived.
-
OCT 29, 2011
The Corelan material
Attrition.org documents that ISI took, in its words, "large portions of material from Corelan.be without credit or license" — the exploit-development work of an independent research community. This is the first catch, per Attrition; it is not, per Attrition, the last.
-
OCT–NOV 2011
"A rogue contractor," the company said
ISI's explanation, per Attrition: the copying was the work of a contractor, not the house. Attrition, having reviewed further material — "including a presentation from founder/owner Jack Koziol and other contract instructors" — states its own view that the incident "was not a one-off, and likely not the work of a rogue contractor as ISI claimed." The company's defense is on the record; so is the watchdog's disagreement with it.
ACT III — THE CASCADE (NOV 2011)
A watchdog, once alerted, opens every drawer. Over three weeks in November, Attrition.org filed one incident after another — several of them naming the founder by name.
-
NOV 2–24, 2011
Three incidents naming Jack Koziol
Attrition.org documents founder Jack Koziol personally in three separate incidents: an Advanced Persistent Threat presentation (Nov 2), an Applied Penetration Testing presentation (Nov 24), and a Heap Overflow presentation (Nov 24) — each, per Attrition, containing plagiarized content, each with its own dated errata page.
-
NOV 5, 2011
The senior instructor
Attrition.org documents that Kenneth Magee, a senior instructor at ISI, plagiarized in several published articles — per Attrition, a second author inside the same shop.
-
NOV 26, 2011
The reverse-engineering course
Attrition.org documents plagiarism in ISI's reverse-engineering course material — the fourth named incident in a month. Fast Company, reporting the wider "computer security textbook plagiarism epidemic," placed ISI within it.
ACT IV — THE RESPONSE, AND AFTER (NOV 2011–)
Companies of this species do not vanish when a display fails. They issue a policy. Note who helped write it, and note who kept paying for the courses.
-
NOV 2011
A revised content policy — with the watchdog's help
Per Attrition.org, during the settlement of the Corelan matter ISI was given advance warning of the errata page, and Attrition "assisted ISI by giving guidance on revising their policy for reviewing content." ISI then "released a statement (since removed) outlining their new content creation policies." The correction is on the record and it cuts in the company's favor.
The rarest sight in the file: the watchdog and the accused, briefly, at the same table — one drafting a policy, the other agreeing to it.
-
2011
Eleven at the Bureau
Attrition.org notes, per the Better Business Bureau, eleven complaints filed against ISI — a customer-side signal running alongside the authorship one. Consumer reviews collected separately describe slides with "spelling errors, mismatched audio," and copy-paste formatting.
-
EPILOGUE
Still operating
infosecinstitute.com is live and the courses still sell. Attrition's errata page remains up, uncorrected and unretracted, alongside a 2017 revisit of the sector titled "if plagiarism is bad, denying it is worse." No court ever ruled on any of it. The archive keeps the page.
both sides, on the record
The watchdog's findings (Attrition.org's, not ours): repeated, documented plagiarism across ISI's courseware and articles — the Corelan.be exploit-dev material, three presentations naming founder Jack Koziol, a senior instructor's articles, and a reverse-engineering course — each with its own dated errata page and side-by-side comparison [1] [4] [5] [6] [7].
Stolen, then sold: by the company's own 2010 client list, the training reached the NSA, GCHQ, the US Air Force and the US Army; Attrition's point is that plagiarized material reached those buyers — "a disservice," in its words, "to them, and the people the material was taken from" [1].
Corroborated in the press: Fast Company placed ISI inside a wider "security textbook plagiarism epidemic" [2]; eleven BBB complaints and customer reviews describe the product end of the same problem [1] [3].
The company's position: ISI attributed the copying to a contractor, not the house — the "rogue contractor" account Attrition itself records the company giving [1] [4]. It then acted: during the Corelan settlement it revised its content-review policy — with Attrition's own guidance — and published a statement outlining new content-creation policies [1]. Corrective conduct, on the record, in the company's favor.
Scope of the record: every plagiarism finding here is a watchdog's documented allegation — detailed, dated, side-by-side, but a private finding, never tested in court. No court, regulator, or tribunal has adjudicated any of it, and nothing on this page is a judicial finding of plagiarism against the company or against Jack Koziol personally [1].
Company vs. founder: where a finding names Koziol, this page says so and links the specific errata page; where it names the company, it says that. The company operates today; the training still sells [8].
YOU DECIDE
Scoped to the claim, never the person. The claim "InfoSec Institute plagiarized independent researchers" is a watchdog's documented finding — Attrition.org laid out the Corelan material, three founder-named presentations, an instructor's articles and a course, each with a receipt. It is detailed and it is attributed; it is not a court judgment, and no court has ruled on it. The claim "it was one rogue contractor" is the company's own defense, on the record, and it stays on this page at full strength — as does the fact that ISI revised its content policy afterward.
Weigh the costly signals: what the company paid to be true. It priced itself as "the best source for high quality" training and listed the NSA and GCHQ as customers. The rebuttal cost one archivist a side-by-side comparison and a dated page. The one thing that would settle it — an adjudication — has never been filed, in either direction.
The archive does not judge. The archive merely keeps the page up.
evidence locker
PRIMARY WATCHDOG RECORD
Attrition.org — "Charlatan: InfoSec Institute (ISI)" ATTRIBUTED — the master errata page: the Corelan finding, the client roster (per Koziol's own 2010 talk), the contractor account, the policy revision, the BBB count. A watchdog's documented findings, not a court ruling.
attrition.org/errata/charlatan/infosec_institute/ Fast Company — "When Hacks Attack: The Computer Security Textbook Plagiarism Epidemic" ATTRIBUTED — press reporting placing ISI inside the wider plagiarism story. (Live; returns 403 to automated fetch — bot-blocked, not dead.)
fastcompany.com/1769244/when-hacks-attack-…
THE INDIVIDUAL INCIDENTS — DATED, EACH WITH A RECEIPT
Attrition.org — ISI attributes plagiarism to contract instructor (Nov 5, 2011) ATTRIBUTED — the company's contractor account, as recorded by the watchdog. The defense's own receipt.
attrition.org/…/isi-unknown.html
SUBJECT'S OWN CHANNELS & SOURCE COMMUNITY
Corelan.be FACT — the independent research community whose exploit-development material was copied, per Attrition's finding.
corelan.be
The standard. Every plagiarism finding above is sourced to a named watchdog, Attrition.org, and stated as its documented allegation — dated, side-by-side, and wearing its author — corroborated by Fast Company's reporting. None of it has been adjudicated by any court, and this page says so plainly. The company is distinguished from its founder; findings that name Jack Koziol personally are marked and linked to their specific errata pages, and no finding is extended beyond its source. The defense — the contractor account and the revised content policy — is carried at full strength. No motive is asserted, no fraud is alleged, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.