Highlighted company: PortSwigger

PortSwigger gives away the thing most companies in their position would charge for. The Web Security Academy has been free since it launched in 2019, and in the year to September 2025 people launched more than 10 million of its labs.

They make the tool the profession runs on, then they teach the profession how to use it, for nothing. Here is who they are, and why the engineers who join tend to stay.

Who PortSwigger are

Dafydd Stuttard wrote the first version of Burp in 2002 to automate his own penetration testing work, and released it publicly in 2003 under his hacking handle. PortSwigger, he explains, means one who swigs port. He is still the CEO, still holds the majority of the company, and his internal title is Chief Swig.

Burp Suite is now used by more than 90,000 security professionals and 18,000 organisations across more than 170 countries. The company was bootstrapped and profitable for 16 years before taking a penny of outside money, and when it finally did in June 2024 it took $112m from a single investor and Daf kept control.

Almost 200 Swiggers across three offices. Booths Park in Knutsford is the headquarters, and London and Atlanta both opened in 2025. They won the King's Award for Enterprise for International Trade in 2025, and in April 2026 they took the Overall Judges' Award at the Northern Tech Awards.

Their research team is small and has reshaped how the web is attacked and defended. James Kettle, their Director of Research, published HTTP Desync Attacks in 2019, HTTP/2: The Sequel is Always Worse at Black Hat in 2021, and Smashing the State Machine in 2023, which introduced the single packet attack. In August 2025 he presented HTTP/1.1 Must Die at Black Hat USA, and Gareth Heyes followed a year later with CSS: the bomb inside your inbox. They also run Top 10 Web Hacking Techniques, the annual community vote that began in 2006 under Jeremiah Grossman and Matt Johansen, stopped in 2015, and which PortSwigger picked up in 2017.

How they perform on cord

The numbers below are from cord, on 3 September 2026.

• Four live roles, all onsite at Knutsford.

• 142 conversations started with engineers across their time on cord.

• Four Talent Champions on the account, the most recent added on 1 September 2026.

• One role publishes a band, and it runs from £100,000 to £185,000.

• A 100% response rate on two of their four live roles, on cord's own measure.

Their volume is deliberately low, and that is the point. They say they would rather leave a role unfilled than lower the standard, and that they have kept roles open for months rather than compromise. Four live roles bears that out. This is a company hiring deliberately, not filling seats.

Why engineers stay once they get there

They pay what they think you are worth, not what they can get away with. That is close to their own wording on their rewards page, and they mean it structurally: they do not set a fixed salary band for any position. Reward is decided on the ability and contribution of the individual. In their 2025 internal survey, 80% of Swiggers said they were satisfied or very satisfied with their reward, against a YouGov benchmark of 40% for knowledge workers. The £85,000 spread on their Engineering Manager role is what no fixed band looks like written down.

They are onsite, and they argue for it rather than dodging it. Five days a week, and their careers page makes the case: problems that would take days to resolve in a thread get resolved in minutes when you can turn your chair round. They say Swiggers consistently tell them they learned more in six months there than in two years elsewhere. They are also open that the model will not work for everyone.

They make the building worth the commute. Free hot lunch every day cooked by chefs the company employs, with each team getting a tasting menu of five courses once a quarter. A gym in the building, with classes led by trainers most days. A daily shuttle to the station. And SwigHouse, a company guesthouse in Knutsford where people relocating can live rent free for their first few months while they find somewhere permanent.

Rest that is actually protected. 33 days holiday including public holidays, plus a Recharge Week where the whole business closes, so nobody comes back to a full inbox. An 8% employer pension, income protection at full pay for six months, and Bupa cover underwritten with medical history disregarded.

A hiring process they publish in full. A first conversation with your Talent Champion, then 30 minutes with people who do the job, then 30 minutes with someone independent of the hiring team who is deliberately unscripted. Then a day in the office where the practical exercise is shared with you in advance, and no dress code. They also commit to giving feedback whether you get the job or not.

The six principles written as a unit test and put on the wall of the first Knutsford office in 2013 are still there: we have fun, we work hard, we make Burp as good as possible, our customer service exceeds expectations, we are fair and generous to everyone, we don't follow the herd.

The team doing the hiring

Four Talent Champions run it, and they are the people you speak to first in that process.

• Adam Spencer, Senior Talent Partner. 64 conversations started on cord, the most of anyone on the account.

• Tom Price, Global Talent Champion. 56 conversations.

• Jake Sharrock, Talent Champion. 22 conversations.

• Simon Wood, Talent Champion, added to the account on 1 September 2026.

Highlighted Companies is a series of hand picked companies on cord. Data sourced from cord, September 2026.