Bugcrowd Founder Casey Ellis: AI Slop, and the Future of Hacking

We weren't understood. People assumed you were a criminal. Yeah, we kind of liked that in some ways, but it limited our ability to actually like do things that helped, if that makes sense. Fast forward all of that, I ended up, you know, breaking bad, becoming an entrepreneur.

Casey Ellis is the founder of Bugcrowd, and that's not a platform that just allowed ethical hackers to earn money from vulnerabilities. It helped legitimize bug bounty as part of an enterprise security strategy globally. Today he's a security leader and one that's not too afraid to share his opinions, popular or PayPal, Google, eBay.

It doesn't matter how smart that person is, they're going to fail because the math is wrong. What AI does or was going to do and is now doing is like tightening that loop up so small that we can't actually fit inside it to take action. The fact that the internet still works is a minor miracle.

So Casey, Thanks so much for joining me here on this episode.

I really appreciate it. Thanks for having me, man. Yeah, it's good to chat.

I first just kind of want to start with maybe a little bit of background for people that don't know you and your kind of journey. So obviously one of the founders of Bugcrowd, but maybe even like before that, how did this whole journey in security actually kind of start?

Yeah. Okay, cool. I mean, I was born at a young age, so there's that. That's my typical kind of backstory intro joke. And yeah, I grew up hacking stuff. So I'm a child of the early '80s, so kind of grew up, you know, started school analog, ended digital, went through that whole kind of period, right? And my dad was a science teacher. He'd bring home tech from school. Um, my mom, uh, just fostered this like creativity that they saw in me early on and, and tried to create every opportunity they could for me to tinker and play with stuff as well as kind of wrangling the fact that like, okay, this kid obviously thinks like a criminal, but doesn't want to be one. What are we going to do with all that? Right. So that was kind of the early start. Um, you know, fast forward to the end of high school, I basically pretty much went straight into a network engineering role. This is like 2001. And then realized, you know, I'd been hacking stuff, like gone on to IRC, BBS, sort of in that era of educational learning, all that kind of thing. And yeah, started hacking stuff in the context of doing IT work and realized that like people, you know, actually can get value from this. If I can, like, it's fun. It's, you know, the kind of stuff I love to do at that point in time. And I could actually teach folk like how they could make their systems more secure. So that was sort of where it all got started. Did the tech side for about 6 years. And then basically, you know, it was actually when I got married, my wife sat me down at one point and she said, hey, like you people good too, you know, just someone who computers good, you should go try sales and see how you feel about that. So I did, felt like a dirty white hat sellout for a little while in there, but realized that like, if you solve a problem, it doesn't matter if that, if that solution isn't connected to where the problem exists and that might involve sales and marketing. So yeah, fast forward all of that. I ended up, you know, breaking bad, becoming an entrepreneur. And, uh, you know, that led to Bugcrowd and all the, all the things that have happened since.

And what led you to go into Bugcrowd?

Yeah, I think, I mean, there was a couple of things. Like one of the big things was just having grown up in the hacker community through that era, right? Like we didn't, you know, everyone who kind of joins now, they sort of take it as a bit of a given that like we're understood, we've got a seat at the table, all that other stuff like that. That's only been true for maybe, you know, 8 to 10 years.

Yeah.

Like when I was coming up in it, like we weren't understood. People assumed we were a criminal. Um, yeah, we kind of lacked that in some ways, but it limited our ability to actually like do things that helped, if that makes sense. And I just kind of wanted to do something about that problem. So that was a, that was a big piece of it. The other side of it is like just from a, uh, solution kind of entrepreneur standpoint. Um, I was running a pentest company prior to starting Bugcrowd. And looking at, looking at kind of the way that we do those things and thinking, okay, if our job's to outsmart this crowd of adversaries that have like lots of different skill sets, lots of different motivations, and like an incentive to succeed, and we're trying to compete against that with someone being paid by the hour, it doesn't matter how smart that person is, they're gonna fail 'cause the math is wrong.

Right, right. Yeah. Yeah.

Meanwhile, there's this community that's sitting there unplugged from the problem, and it was, you know, pretty much a series of conversations in Australia, um, And kind of a light bulb moment where I'm like, oh, it's like everything in together and like, see if that works, then see if we can get the market to actually accept the idea of like firstly hackers and then crowdsourcing and bounty and VDP and all of that. Um, and then kind of grow from there. So that was 2012.

Being in that space, you know, obviously having that, like that hacker, hacker mindset, what was available to hackers kind of like before that, before the bug crowd, or even like just before the bug bounty movement.

Yeah. And it's important to call out like Bugcrowd didn't invent bug bounty or VDP. Like that was prior art. Um, you know, we were the first to come out and basically say like, let's put a platform in between the community and all the problems that need to be solved and try to accelerate it. But yeah, prior to that, uh, I think what was it? PayPal, um, Google, eBay. There was like a list of tech companies that were running, you know, VRPs, which is what we called them back at, back at that point in time. Like that was available. So if you wanted to hunt and get paid and all that kind of stuff, like that was an option. Um, you had, you know, the MSRC off the back of the work that like Katie and Kimberly did in there, they, they'd really ramped up their, um, vulnerability intake program and, you know, they weren't paying at that point in time, but they were like doing a lot around, you know, honoring the researcher, which was kind of cool. So there was a bunch of different things that were kind of available, but there was no, momentum behind it and it was really very much an underground community kind of doing the thing at that point.

So sure.

We actually mostly learned from each other. Like that's probably the more succinct answer to your question.

Yeah. Because like what the platforms did is made it a real thing. You know, like it wasn't just someone that was like in between breaking stuff on the internet for fun would get paid.

Yeah. And then just having to advocate for themselves.

Yeah.

I'm not a bad guy and all this other stuff. I think, yeah.

And then also like with the vulnerable vulnerability disclosure programs, it's kind of like there was no transparency around like, you know, that or maybe perhaps the sun. So that's right. Platforms were really important.

But yeah, I think, I think a big piece of what we managed to achieve in that period was like legitimizing the overall idea of a hacker being like potentially a strategic asset for an organization, as opposed to just this like random threat on the internet that you've got to figure out how you're going to deal with it every single time.

Yeah, definitely. As soon as you brought up the, the, the not being perfect, I mean, bug bounty has been, it's a pretty foundational part of security programs now because you have your tools and you have your pen tests, but, and they had their place, like, you know, I'm from a vendor and I've also been involved in pen tests. Love them both. However, it doesn't give you that wide coverage, that continuous coverage from it. So a really important part of it. But there's, there's been some challenges kind of, I guess, more recently in, in dealing with this.

Yeah. And what I would say is that like, it's not actually that recent, like the, like the, the reaction to, um, like AI slop, you know, just this overall kind of increase in submissions, like across the board over the past, you know, 6 months to a year in particular feels very much like it did back in like 2014, 2015, when, when folks went from one person doing the work to multiple people doing the work, right? Oh crap, we're not ready for this. Like we haven't actually prepared. We're not, we haven't thought through vulnerability management. We haven't thought through triage, community management, like any of that stuff to the degree that we need to for what's coming. And there was a period of adjustment there. So it's like, this is, I think a lot more dramatic because like AI has kind of put the ability to find, submit, You know, do all those different things in the hands of way more people. And back then it was kind of just going from not crowdsourcing to crowdsourcing. So a bit of a step function shift in volume change, but the reaction I think is kind of similar.

Similar. So what is like, we've had Daniel Steinberg on the show and he was talking about that they shut down the curl bug bounty program. Now, one of the things I do want to point out about that interview too is that Daniel's not at all against, oh no, You know, bug bounty programs and all of that. And I think a lot of the people, there's a lot of news headlines out there with different organizations trying to adjust in different ways. I don't think any of them are really against bug bounty. It's just the fact that it's becoming harder and harder to manage the programs.

Yeah. So I think, and this is a thing that I've actually said a bunch of times over the years that often surprises people when they hear me say it. Um, but I'll say it again, because I think the stuff that's happened there, that happened with, with Daniel, with Curl, and the things that are happening just in general, um, kind of validate the point. I believe that every organization should have a VDP. And in fact, every organization already has a VDP, whether they like it or not. They're just maybe not getting the report, right? Um, because if you're on the internet, like, you can assume that you've screwed something up and someone outside your organization will find it. The end. Like, for me, that's like an issue of internet physics. You know, it's not like a spooky event or any of that other stuff. To me, that's just kind of how it works. But then this option of adding an incentive on top of that to encourage people to do that, I don't think that every organization should do that. Um, and you can see the distinction because when people say bug bounty these days, it's like, is that crowdsourced security? Is it a pen test through a bug bounty platform? Is it a VDP? Is it a public bug bounty program, like it's all kind of gotten lumped into the one term of ART, because that's honestly the term of ART that we used back in the day to, to kind of get this idea across the table in the first place. So I think there's like, what are we actually talking about here? That's, that's a pretty important bit of scoping. Um, but yeah, like I said, like I don't think every organization, I think, you know, the curl program shouldn't have been a bounty in the first place. Because if you got like volunteer maintainers, It's like you can only, you know, and good on them for, for making it as long as they did with that kind of throughput. But, you know, not every organization's ready for that. Not every organization's necessarily in a position where they can handle that. And that's just is, that just is what it is.

So, and what, what makes that distinction is, and like, if you're an organization, when is the time to move from kind of having a vulnerability disclosure program and then having a paid incentive?

Yeah, I think that's a really good question. Because like the other, you know, you talk about the different ways that like we kind of carve up this crowdsourcing idea now, and there's like AI being thrown on top of all of it as well. Um, yeah, the private version of it, I think every organization can get some sort of value from that because they can control it, they can throttle it. But when you're doing this with the open internet, it's like the metaphor I use is, you know, it's kind of like walking outside when there's a thunderstorm coming and telling it not to hit your house with lightning. Oh yeah, that's not how this works.

Yeah.

A VDP is like putting up a lightning rod. Expecting that, like a bug bounty program is like shooting rockets with wire on them up into the cloud. And if you're not ready to do that, then maybe you kind of shouldn't.

Yeah.

I think organizations that, that are ready for a public bug bounty program, it really goes to the maturity of your vulnerability management process internally. Um, you know, do you have a proper understanding of what risk actually means to your organization? Like, how do you prioritize? Do you have the ability to do the community management pieces on top? Yeah, there's, there's a variety of different things. I think the, the outlier there is if you've got a competitive, uh, vulnerability acquisition market for the product that you make. So if you've got actual offensive procurement going on and you want to compete with that, that's another reason that's probably not a bad idea.

That's such an interesting kind of thought though. It's like, yeah, your, your competitor in this space is like someone selling your exploit.

That's part of my backstory as well coming into this in terms of how I think about the economics of like, to me, it's not about like, is this a pen tester or blah, blah, blah, blah, blah. It's like, to me, the real question is what is this bug actually worth?

Yeah.

And that, you know, this, the, the answer to that is partly like to whom, right? So, yeah.

So, I mean, part of this whole discussion is it's great to kind of to get some background on this because it's not actually that, that, that AI slop reporting. It's a new, it's a new issue because it's AI, but it's also, it just, it's just highlighted an old issue. It's increased an old issue.

I think that's right. I think we're doing far, like we're doing stupid things faster with more energy. Right. We, you know, Bugcrowd was working with, with the foundational models, you know, 4 or 5 years ago was kind of when that kicked off. And then at one point I had a demo of an offensive tooling set that got created at a hackathon at one of the providers, right? Yes. It's like, 4 years ago. So before all of the crazy mega rounds stuff that you see going on now, like, oh, this is coming fast. Right. And the thing that, that made me realize is that like in security in general, we kind of rely on this concept of the OODA loop, you know, um, observe, orient, decide, act. Right. Um, and there's like cycle times involved in that, like, you know, deploy, defend, like attack, learn, fix, blah, blah, blah. What AI does or was going to do and is now doing is like tightening that loop up so small that we can't actually fit inside it to take action. Right. So we've got to, you know, I think in some ways kind of rethink the game.

What does that rethinking of the game look like? So the, we've got this here and something that stood out for me in what Daniel was going through is it part of it was that they always got crappy reports that didn't actually work, but now they're very, very convincing.

Yeah.

You know, and that's part of the problem too, because now you could look at something and know pretty quickly.

And again, that's always been true. Like I remember Voln Reports, you know, 2013, 2014 with people like Photoshopping fake, like XSS returns and stuff like that. Like the idea of, you know, like we're effectively, if you're running a bug bounty program, you're effectively creating a game for people that are wired up to break games.

Yeah. Okay.

Yeah.

So like, yeah.

So the QED, like this is, this is, this is happening.

Can I have a bug in the process? Yeah, for sure. Like in the process of like, and that's just part of the deal.

Like it is, it's one of the reasons why, you know, it's been so, so interesting kind of building out the platform side of it. 'Cause you get to see all these like weird edge cases that pop up, you know, in the conversation itself. I think, you know, like the challenge with AI is, as you said, it makes it really easy just to, spray and pray, you know, like the whole idea of like big bounty, you know, found this thing, give me money and then I'll tell you what it is. Like, they're all kind of versions of the same thing. And to me, there's two solutions to that or two categories of solution. One is basically community driven. Yeah, if you see, if you're involved in this community and you see your peers doing that, like they're actually harming you. In the process, because everyone who's participating kind of gets tarred with the same brush, right?

Right, right.

There was a season where, yeah, bounty hunters would call each other out if there was like extortion or big bounty or any of that kind of stuff, and it was sort of self-policing. Um, that's not as true at the moment, I think. Um, but I do think like elements of that really help.

Yeah.

And then the other side, of course, is technical controls. Like, how do we You know, how do we improve the ability to automatically triage? Um, you know, think those things through. I don't necessarily think, I think platforms can be really helpful with the 80%, but it's going to matter with the 20 on the receiving side, right? Because it's, that's where like the edge cases are and that's where you can kind of commit fraud like that and sometimes be successful.

Yeah.

Yeah.

Yeah. Yeah. For sure. Because do you, you know, yeah, you can just spray and pray and at some point it's just so overwhelming your bug bounty program.

Maybe it's just like, yeah, like the asymmetry of it's always been the challenging part. Yeah. Like, like Bugcrowd built out a triage team before we built the platform. Right. Because we knew that like this, this, you know, we're dealing literally in like unintended consequences as a service. So the fact that it's weird.

Let's talk about like, how do we, like, what do you think kind of the solution to these could be? Like, where, where does it go? Because it's obvious that something needs to, to change. And I think like one of the, we've got the area of AI pen testing, which I think is interesting. I don't think it's ever going to replace the human element.

I think it'll replace parts of it, but yeah, I'll let you finish.

No, yeah, but so the solution that a lot of people have been floating and also from vendors as well is that, hey, we can automatically test bug reports and kind of get that AI in the triage process. Is that the solution? Is the solution other companies have kind of said, well, we're just not going to accept reports from certain tier of people?

I think, so those, like you talked about the technical and the community category.

Yeah.

Like in terms of like, you know, automated triage and reproduction where it's possible. The thing, the thing about the triage pipeline, and this is like, as someone who has seen what that looks like between like the entire internet and like 3,000 different companies, right? So there's a lot of, we've seen most of the edge cases, you know, that you could think of, like, yeah. Thus far, but also operate on the assumption that there's stuff that we haven't seen yet just because of the nature of what we're doing. Yeah. So like, to me, the problem's never solving it to 100% because you just can't, right? Like, a bug's not meant to be there in the first place. So like, to operate on the assumption that you can, you know, fully predict it, that's like, cool, we can all just pack up and go home now.

Yeah. Yeah. Yeah.

Yeah. I think the triage piece is really, really, you know, potentially useful, especially when there's code available for that. Um, you know, DAST can get weird sometimes as edge case types of attacks that are hard to reproduce automatically, but there's a lot that aren't. And if you can deal with that and qualify things in or out, awesome, you're golden. I think the community piece, you know, in terms of like, there should be, you know, to some degree, like a hall of, not necessarily a hall of shame, but this idea of like, you're a known bad actor, right? In this, in terms of like, we've told you, you know, you're not just like misinformed and super enthusiastic and kind of annoying and needing education. Like you are actively ignoring that and making our lives hell, like Cool. Put them in the dev null for that person. Like, I think that's a really good solution. I think doing that in a way that's visible to others so that they can understand what's valuable and what's not is pretty, pretty useful as well. I think the other thing is just with, with bounty itself, right? If you do have an incentive, it's not that you're disincentivizing the things that you can find through automation or the things that you don't want to hear. It's that you're just incentivizing everything else more. Right, right. It's like, no, we're not going to pay for AI slop level bugs. Because I actually do think that AI is going to get better at, you know, sparkling QA. Yeah. Right. As opposed to like hacking in that sense. Um, and it should, like if, if, if we've got a greater ability to find those types of issues so we can deal with them, then we should reduce the cost of doing that to as close to zero as we can. That just makes sense.

Yeah.

But you don't want to pay $1,000 every time that's happening.

No.

If you've got some other stuff that you're really concerned about that you'd rather focus people on. Do you get what I mean?

Yeah, I know. I totally, I totally understand what you mean. And then the part that like worries me too about all of this is from that community side where bug bounty and in these areas have pushed the boundaries. And if we made it harder for the entry for the new gen to come in to this.

Yes, 100%.

Like that kind of worries me a little bit. And when I say is that I love AI, like I love the category of AI pen testing. I love that we can now find vulnerabilities that scanners could.

Yeah.

Like iDoOR, know, like broken access control, things that are kind of not obvious for a scanner, but it's, it's not, in my opinion, gonna replace the, the human element of really just trying to break something in very weird, uncreative ways.

I think that's right. I, I, I think the, um, you know, and we've seen like a, a revision of this that we've seen in the past, like early, again, I feel like old man telling a story right now, but whatever. Early, early on, a lot of hunters were really successful Um, by looking where everyone else wasn't. Yeah. So the whole idea of like, here's your, you know, www.domain. Um, everyone's gonna be looking at that. I'm gonna find things that are related to this company that are so far flung on the internet that no one's gonna think to look there. And like people were making a million bucks, you know, hand over fist in that season because that was pre-ASM, right? As a market. Yeah.

Yeah.

So like anyone who worked in, in security or in industry knew that like there's a whole bunch of shit that people have left out on the internet and forgotten about. Up. Like we all knew that, but that problem wasn't obvious. And then the bounty hunters came along and kind of set the whole thing on fire. And now we've got EASM, the category, right? So like, cool, good outcome. You know, you could argue that they kind of cannibalized their own opportunity in doing that. Like there's an element, like that's sort of part of why we're meant to be doing all of this in the first place, right? We don't want to be vulnerable.

Yeah, I know.

That's the entire point. So there's this like I think there's this continuous kind of refreshing of the low-hanging fruit. And, you know, kind of to what I think you were saying, like that creates the opportunity for people to upskill and actually apply their creativity. Like, cool, you've got a bunch of lame bugs, but can you chain them together to get a better impact?

Yeah.

Or like, can you learn from that and start to learn new classes of vulnerability that are more difficult for AI or scanners to find? Like that kind of thing.

Yeah. And, and like, and speaking of AI, it's like, for the first time in a very long time, we've got a new class of vulnerability, which is the whole prompt injection thing. So all of a sudden it's kind of like, which is a pretty greenfield at the moment for both.

But I mean, so yeah, there's that. Like, you think about this, like we're not even touching still, we're not even touching hardware.

Yeah.

Like I think when I think about the overall kind of threat, um, landscape, like again, like why are we doing this all in the first place? It's not just to build cool things. It's to actually make the internet safer.

Yeah.

Um, most of the conversations focused on like the top 5 turtles in a stack of like 50.

Yeah.

Right.

And like China is in the bottom 20.

Yeah.

Yeah.

Yeah.

There's, there's a lot to work on that I actually think needs attention and is probably having the oxygen sucked out of the room by a lot of this kind of AI appsec conversation that's going on. So I actually don't think that's a bad thing. If that causes people to go look elsewhere in terms of what they get skilled at as hackers, that's probably a good thing.

That's just, that's such an interesting point because I think, you know, when you, when you look at it and you try and go to the, to the future, we look at kind of what we're finding now, what we're doing now. And we think that that's going to stay the same. So, you know, in 5 years time, we've got no more bug hunters because there's nothing left to find.

That's right. And this is where I get, because I mean, part of my job, you know, part of how I see my job in the founding role in general is just like try to see around corners, right? So I'm like always thinking about how does this stuff evolve over time? Not just what's happening right now. And, you know, when I get asked the question, like, is AI going to replace pen testing or like research specifically? I'm like, no, because even if we were able to solve every security problem that we have today with, with AI, which we're not even scratching the paint off that.

Yeah.

Theoretically, if you could, what are the bad guys going to do?

Yeah.

Are you just going to pack up and go home?

Right.

Yeah.

Yeah. Yeah.

I don't think so. No, no, no. And they've got human intent, they've got human creativity, like, it's their job to operate in the edges that we leave behind. And they're going to always be pursuing that. Therefore, so yeah.

Yeah. That's so it's yeah, yeah, yeah. That, well, you're like totally right.

I think that's like philosophical, but you know, like thinking about like, okay, where, what does that mean we can do next? It's the kind of stuff I was just talking about. Yeah.

And like, whenever I kind of think about this too, is something I say a lot, it's, it's a little bit facetious, but you know, I say that, you know, SQL injection. Well, the term was coined 1998 or around about that. We solved it that same year with prepared statements, basically, you know, like it's technically a solved problem, right? It still makes up like 50% correct, which is the best kind of correct.

Yeah.

Yeah. Yeah. It still looks like so much vulnerability. So, you know, we can solve all these things from a technical point of view. We can get better at finding them and they will still exist. It's just a kind of like as a rule of nature.

There's a long tail that needs to be cleaned up. You know, we've got. Quantum coming over the hill at some point in the future. We've got, you know, AI getting slapped into robotics and mechanical, like there's a lot of like cool frontier tech stuff that people can kind of dig into and work on. And that's always going to be novel and net new. And in the meantime, like, you know, half of the hardware vulnerabilities to get hosed by Flax Typhoon are like format strings from the '80s.

Right.

Yeah, right. Like, so to your point, like there's a lot of solved problems that aren't solved at all. And yeah, I think those create a lot of opportunities for hackers to go and specialize, figure out how they can be a part of contributing to the solution.

Yeah, yeah, for sure. Recently, IBM stock crashed momentarily because Claude could now support COBOL. And then I had no idea that there was that much COBOL left in the world.

Yeah, I mean, I gave a keynote at an Indian conference in 2020 and like literally what I told people was learn ASP.NET. Um, Java and COBOL, right?

Yeah.

Yeah.

It's like boring. It's not cool. Like these are not the cool languages to go off and learn right now. But if you go off and look at what's actually powering the internet, it's those two. And then you look at what's under the hood, it's COBOL. Like it's everywhere. And like the thing with that is that the people that, um, know how to do that stuff, they're either retiring or passing away literally.

Yeah.

Like the fact that like AI understands COBOL now, of course it does. It's been around forever, but it still requires. Discretion of the human to actually wield those tools to make those things work. And you need understanding of the system to be able to do that well. Yeah. It's just stuff like that.

I want to kind of start to wrap things up, but I'm very curious kind of what your position on where we're going in the future. We've touched on this, but like, where do we end up in the bug world? How does it kind of fundamentally change over the next 5 years?

There's a lot in that one. I think You know, kind of what I said before, what I would love to see happen and what I think will happen, it's just a question of whether it's orderly or chaotic. Yeah. How we get there is this idea of vulnerability disclosure being just a thing that happens. Yeah. And so for, you know, if you're building a company, you recognize that people outside have the ability to identify risks you don't know about.

Yeah.

And you've made that safe for them to tell you legally. Plus you've got, you know, to the point of the swap and all those different things. Yeah. You'd actually triage that. And like get to the signal in the noise. Um, I think, you know, all of the conversation around bouncing and all that other stuff is sort of almost hiding like the, like the axiomatic truth of the fact that that's sort of what we're actually talking about, right?

Yeah, yeah.

Like pen testing, it's assurance. It's no, it's like to err is human, and other people are going to figure that out, and then they want to help you. The end.

Yeah.

So it's like, to me, that's, you know, physics is pulling in that direction. I think pen testing and, and just assurance in general. It'll be interesting to see how it plays out, but I, I think there's a correction kind of in progress now with AI putting kind of downwards pressure on, on pentests.

Mm. Yeah.

In the market. I think it was frankly a little bit inflated to begin with. I thought that was true when I started Bugcrowd as well.

Right.

I was trying to do the same thing with the crowd. Yeah. Improve effectiveness. Right. And you know, like the, the, the hidden thing behind all of the SLOP stuff, uh, and, and that story is that there's way more vulnerabilities out there than we care to actually talk about. And if you're in security, you know that, but people outside don't realize that. It's like the internet, the fact that the internet still works is a minor miracle.

I can't believe in the amount of times how close we've come to it breaking, like the exe.utilis example, when like the compromises have happened on like npm at the moment.

And when you go down the rabbit hole, you're like, holy crap. Okay. This is wild. Um, so I think that's going to become more obvious and like the sense of value is, is, you know, potentially going to align itself better, like will become more focused on being able to fix things quickly, being able to like build them in a way that's secure in the first place, which is a lot of what's happening right now, which is great. There's still all the legacy trash to clean up, but that's, you know, we'll see how that plays out. And then honestly, I think, you know, the idea of like, why are we doing this all in the first place? Like, what are the threat actors up to? Who are we actually defending against here? As aside from, you know, confidentiality, integrity, business availability, like if we're talking about an actually motivated threat actor, they're all ostensibly here to defend again.

Yeah.

What do they want? Like how do we impose cost? How do we disrupt their economics? Or at least make our own, how reflect theirs better? Like, yeah, very high polluting terms here, but I do think the, uh, the vulnerability marketplace is going to get kind of interesting as things get spicier.

Yeah.

You talk about like nation-on-nation stuff. You talk about, you know, letters of marque in like Congress and the White House right now, different countries saying, yep, countries, uh, companies can hack back when they go IP threatened, all those different things. You talk about the idea of like non-cooperative defense. So if there's a whole bunch of systems that are vulnerable or compromised and there's threat associated with that, we can actually break into them ourselves and fix them on behalf of the user. Like there's a whole bunch of, I'm not necessarily advocating that don't go off and do any of this right now, but when you look at kind of the raw ingredients of what we're working with, I can't see how some of those things don't end up becoming normal over the next 5 years. You know what I mean? So it's, yeah.

Yeah. Yeah.

The hack back, the right to hack back has always kind of been something and you can see, I don't like it, but I don't see how we don't end up there.

Yeah. Yeah, yeah, yeah, yeah, yeah, yeah, for sure. Well, look, we've come to the end, but we always like to play a little game on the show called Would You Rather. I give you two options, both of them are gonna suck, and you have to pick one.

Fantastic.

So would you rather store all of your secrets, your API keys, credentials in a.env file inside a private Git repository? So they're in your Git, they're there, it's in all your history, or you've got no firewall on your running application.

No firewall.

You're going to pick no firewall? Oh, that was a very quick answer.

It's because I know where the bodies are buried.

I always think when I would like, when, whenever you look at like a big breach, like secrets always involved somewhere, right?

Yeah. Yeah.

Yeah. All right. Let's do another one for your dependencies. You have to auto update to the latest version every time. So there's kind of risk of break, risk of malware, or you pin your versions now and you can never touch them again.

Oh, that's a hard one. Never again.

Never again.

Update.

Yeah.

I'd go with update. Pin it.

Pin it. Yeah. This is at, okay. This is, this is what, what's your thinking behind that?

Uh, I think the, the internet's collectively had an oh shit moment around the whole supply chain thing. Um, and it's far from a solved problem right now, but I think there's a lot of attention going into it. And in the meantime, like actual vulnerabilities will probably continue to exist. Yeah, I, I, that would be a bet on the fact that we actually get better at not allowing malware into the supply chain at some point in the not too distant future and just be super vigilant in the meantime.

Yeah, yeah, yep. I like it, I like it. We'll do one, one more. Uh, so would you rather, I guess if we're, the approach I take from this is if you were starting Bugcrowd entirely again, right?

Yep.

Write the entire thing As Sam Altman said, character by character, like without code or vibe code the whole platform? What would you rather?

Um, I would, I would not, I mean, I hate the term vibe coding.

Right. Sure. But use AI-assisted coding.

100% use AI-assisted coding.

Yeah.

Yeah. For sure.

Yeah. Yeah. I think that's kind of like the general approach since I've been doing this podcast. That question has changed.

I can imagine.

So it was 100% at the start that people were saying I would never, I would If I had to use AI, I would not trust it. Yeah. It's flipped 100% to the other side. Yeah. Now, which is interesting.

That doesn't surprise me at all.

Yeah.

Especially like with the security context, right? We can't control things, but going slow, like the risk of not doing a thing at all is 100%. So like, what are you going to do? The other part of that is seeing how the frontier labs are doing it. Like they're using so much of their own stuff to write their own platforms. Yeah. And to me, that's like they're off in the future somewhere, but like that's probably roughly where we end up.

Yeah.

So I'm kind of using that as a bit of a leading indicator.

Yeah, for sure. And we love to, we love to bash on like when like AWS fired a whole bunch of people for AI and then they had like an outage and we all love to connect these dots. But I also kind of think about it. It's like we're at a breaking change right now in it where things are going to break a little bit, but as long as it doesn't break, you know, it's too bad. Like there's going to be turbulence.

Not to double-click and start a, you know, brand new podcast on that one too much, But like, I, it, you can do it well. Yeah. This is the thing. And this is why I like object a little, like, are you talking about really vibe coding or actually using AI from an engineering standpoint? Because like AI assisted engineering with like thoughtful design, you know, good thought put into like maintainability updates, all those different things. Like AI is just a force multiplier to people that are already really smart and good at doing this stuff well. Like, why wouldn't you use that?

For sure. But I think it comes down to the fact that like what you're talking about is do I put a prompt in Lovable or Replit? Or do I, or am I using Cursor and kind of understanding what it's doing and getting it to make suggestions for me? You know, like there's a, there's a very big difference between the two of those.

So if that was the case, yeah, I'd still probably find a way to use AI.

Fair enough. Well, Casey, it's been awesome. Thanks so much for having me on here. And all the best going forward.

Good to chat.

Why are people still such a fundamental issue that we have in security?

Human people are just complicated. If you don't know every department or understand how people are doing their jobs, it's really, really difficult to secure those people and ensure they have the proper amount of access, but not too much access.

You said something interesting. You said secure those people. How do you secure a person?

I mean, I think people are inherently insecure. People just either don't know or they forget, and they end up doing something that is dangerous or risky. Securing people is, is difficult because I think a lot of the time we think about securing the tools, and we really shouldn't be permissioning our tools to the same level that we have permissions.