From SQL Injection to Cloudflare VP: Chema Alonso on 25 Years of Hacking

In this episode of This Week in NET, host João Tomé is joined by Chema Alonso, Vice President and Head of International Development at Cloudflare.

Chema shares how a 1998 paper on SQL injection launched his career in hacking, his path from running a startup in Madrid to becoming a Microsoft MVP for 14 years, and how he ended up leading cybersecurity at Telefónica for more than a decade — after telling them “you don’t have enough money to make me work for you.” He also explains why he left Telefónica in 2025 to join Cloudflare, and what surprised him about the company’s technical depth.

The conversation explores how AI is changing cybersecurity, from AI agents competing in Capture-the-Flag contests to automated attack chains running around the clock. Chema also discusses the black market for zero-day vulnerabilities, Cloudflare’s role in Europe, and how AI may reshape the economics of the Internet.

We also hear the story behind his famous beanie hat, a Bluetooth exploit that Apple initially called “a feature” until Steve Wozniak got involved and a quick-fire round covering his first computer, favorite hacks, admired researchers, and why Gemini once hallucinated that he went to jail.

⏱️ Timestamps

01:00 — How SQL injection in 1998 started his career

02:36 — From startup to Microsoft MVP to training Spain's cyber forces

04:36 — Black Hat, Def Con, and the global hacking scene

05:53 — How Telefonica recruited Chema

08:49 — 20 years of daily blogging as "brain gym"

10:27 — The beanie hat origin story

14:34 — Why he left Telefonica to join Cloudflare