Offense Taken | How Is AI Changing Bug Bounties? | Ep. 03

Welcome to our 3rd episode of Offense Taken, a video series made here at Expo. My name is Fede Kereshrome, and over here we try to see how offensive security is changing. At Offense Taken, we try having unfiltered conversations with experts who are shaping the way hacking, AI, and security is made. A quick shameless plug. This week we announced our finding and award of a full chain in Chrome. It is, I think, the first time we get a full reward like this. We are super excited. We are waiting for the embargo to tell more. Actually, Google is changing the rules, shortening the gap between the notice and the embargo. So sit tight. Happy to chat about all the details, but it is a good time.

Congrats on that too, by the way.

Thank you, Casey. And here we have today, I'm joined by Casey Ellis, hacker, founder, entrepreneur, even band player. A good friend, and I'm happy to bring somebody that has as much experience as yourself in the industry, in the community. So I'll jump right into it. First of all, I want to say thanks because for many people that might not know you. I know because of common friends and a lot of people from the industry, all the work that you invest in making the community safer, the community stronger, and sometimes that it's not being seen on the title. So I'm taking a quick shot of this.

Thank you.

You have made Backcrowd, you have made Disclose.io, you are trying to work your way into MakeHackers. who are operating in good faith, a safe passage so they can make security easier for other people and they can do what they do best by reporting vulnerabilities. How that has changed from when you started to maybe this year and—

Oh, yeah, okay. That's a great question. I mean, I think the biggest change, you know, we started working on Bugcrowd in 2012. So like Bugcrowd didn't invent Bug Bounty or vuln disclosure. That was definitely prior art in that sense, but we were basically the first to come out and say, hey, let's build a platform and try to, you know, broker conversations and connections between all these hackers that are out there. And all the companies that like need that kind of creativity to be able to pretty much outsmart adversaries has always been, you know, my, my, um, my thought. It's, it's a battle of, of creative input, um, in a lot of ways for defenders between, you know, what they've got available and what the bad guys are applying to the problem. So I just wanted to plug the community into being a part of solving that. And, you know, things kind of escalated from there. Um, To put it mildly. Um, I'd say the biggest thing that's different now is that like in, in 2012, you know, it like you, it was a, it was a wild idea. Um, I think these days like you can talk about hacker input, the fact that like hackers, like hacking is a, is a skill set and a, and a mindset that's like, it's actually morally agnostic. It's dual use. And like the bad version of it is kind of why we're all gainfully employed. Um, but just because you can think like this doesn't make you necessarily a criminal. So I think that's something that people have wrapped their heads around, you know, a lot better over the past kind of 14 years. And what that means is that we get a seat at the table a lot more easily. I think, you know, prior, um, you know, I mean, I, you've been in the industry a while as well. Like there was a long season there where it was, you know, folks kind of screaming from street corners saying that folks should care about security. And we don't really need to do that anymore. It's something that's sort of, if not understood, it's accepted pretty broadly. So I think those are some of the changes, like, and that's more about the environment. Do you know what I mean? Like, I think the environment that we all operate in has definitely shifted a lot over that period. And, you know, I'd like to think that that's in part because of some of the stuff that we've done. Obviously we've not been the only ones trying to kind of You know, raise the tide that lifts all the boats on that. But, um, you know, pretty proud of the work that the team and myself have gotten to contribute to that, I guess. Um, but yeah, I mean, that's the environment stuff. I think in terms of hacking itself, you know, obviously AI has caused a lot of questions, a lot of, um, concern, conversation. It's caused, I think, shifts in, in, you know, the perception of value. Like, what is the thing that's actually valuable that we're doing here? And if we can get a clanker to do it, then why would I pay?

Yeah.

pay a human to do it, for example? Um, to me, that's always actually been a really valid question to ask, uh, because, you know, from my perspective, the answer is like, it doesn't really matter where the vulnerability comes from. It's going to have some sort of value to an attacker. So like, how are you thinking about that from like a risk perspective as an organization? And oftentimes, you know, how do humans kind of play a role in making sure that that risk gets surfaced? properly, you know, no matter what tooling they're using, right? So yeah, it's definitely, it's never a dull moment. I mean, I feel like I've, I've seen, you know, the, the community and the industry and the perception of hackers, it's shifted, you know, I think pretty consistently, at least every 2 or 3 years since, since 2012 when I started Bugcrowd. And even before that, I've been doing this since the late '90s, right? I think AI is definitely a far more, like, more people are talking about it than I think probably some of the more esoteric stuff that we were talking about in the past, because AI has just kind of dropped itself on everyone all at once. But in other ways, it's sort of no different. Like the community's an ecosystem and it evolves.

We are in a way, in a, more mature stage as a cybersecurity industry, thanks to bug bounty, responsible disclosure, policy work, outreach. But in something that I think as an industry, we have been trying to scale ourselves in many ways, right? It could be through automation of creation of, I don't know, Metasploit or platforms that allow people who don't have the exact knowledge to scale their own way in offensive. Then we have the crowdsourced one, like, hey, we— that's like our hybrid model. Let's bring a lot of talent and pay for actual signal. If you get something, we will provide.

Yep.

And I think right now we are in a mix of those 2. By, in a way, outsourcing part of what we know to models and trying to get these problems. So for me, the question is, for you, what is more dangerous right now? People overhyping AI hacking and models committing crimes, or ourselves that we might be dismissive of, oh, this is just a hype? Or I don't know, what is your take on what is happening on, you know, on X, on the conversation around this?

That's a really, I mean, that's a tough choice, right? Because it, because like, I do think, yeah, there's definitely a lot of hyperbole and there's, you know, like sort of people like completely freaking out about things that if you kind of stack rank them against all of the different risks that we should be thinking about and dealing with, maybe aren't as high. on, on the list as they kind of sound when people talk about it. Um, so that's definitely a thing, like, that just happens, um, to me. Like, that's not really necessarily something that you can avoid, but it's definitely a phenomenon that affects AI, particularly in security. Um, but yeah, like you said, on the other side, like, it, it's remarkable to me. Like, I, you know, started doing work with the Frontier Labs in '22, right? And like Bugcrowd, you know, we've been coordinating like offensive machine learning testing, all sorts of different things since like 2017. 2018. So like, to me, this stuff isn't actually that kind of new in that sense. I'm, I still feel like I'm learning 10 million new things every day and all of that. Don't get me wrong, but it's not like this sort of black magic that's dropped out of the sky. Um, you know, and yet at the same time, like the number of conversations I have with, with folks, um, Particularly in leadership on the defensive side, where it's like, oh no, AI is not that important. Or like, I don't really know how this works. Or, you know, my favorite one, like it told me that there are 5 Rs in the word strawberry one time. So I think this whole thing's full of shit or like whatever, right? Like there's definitely, there's a huge spectrum, I guess, of, of, you know, awareness and understanding and, and I guess adoption. Uh, across the board. And as hackers, like, we tend to be right on the front edge of that. Um, but then there's everyone that's sort of trailing, trailing behind in some ways. I do feel like the hacker community has sort of begrudgingly accepted AI at this point. Um, like, I, I, I had that observation at BSides Las Vegas and at DEF CON actually this year. Um, because, you know, BSides Las Vegas is like a hype-allergic conference. Um, like to the max and everyone's like, okay, this thing's here. It's real. Like, what do we do about it? How do we integrate it into what we're doing? How do we think about it as a threat potentially? Like all that stuff. And that hadn't really happened until this year. Um, and even with, with DEF CON, you know, hanging out with some of my, um, you know, neckbeard kind of, you know, true OG hackers and they're like, oh, this is all crap and blah, blah, blah, and, and doing their, you know, classic curmudgeon thing. Right.

Yeah.

But when you sort of sit down and actually talk about it, they're using this stuff, they're leaning into it, they're starting to actually learn and understand how it works. So I feel like we're over that hump, if that makes sense. Um, yeah, it's, it's, you know, like I said, it's, it's again, this huge spread. I, I think the big thing, this is something that I've been saying sort of all along since I saw generative AI kind of hit the street. It's like, this is like the new, this is like the internet.

Yeah.

Yeah, I think thinking about it back in '22, '23, the way that people probably would've been thinking about DARPANet, you know, eventually becoming the internet in like 1997 or 1998. Like, I think that's actually a really productive way to think about it because it's not just new tech from my perspective. It's like a phase shift in how we use technology overall. And people are at different levels of, I guess, understanding that concept.

Then I think when I chat with friends and to be honest, I'm, I'm new in the AI, uh, area of offensive, right? So I, we have this conversation of, we are complaining, but we always have complained about the state of things.

It's kind of what we do professionally, right?

Professional collective. Are you hoping this can raise the bar in a way that we are still trying to solve, you know, cross-site scripting or SQL injection? And I'm not talking about sophisticated ones. I'm just talking like out-of-the-mill OWASP top 10.

Yeah, that's a good question. I think we've got enough offensive feedback to tell us that we still kind of suck at this stuff as it is, right? Like the whole idea that we're doing it 24/7 now.

100%.

Um, and this is not a diss on Expo or, or anyone kind of doing that type of thing, but to me, like, there's this, there's this gap in the market in terms of how they actually take that information and do something with it. Because like the reality is that like, you know, defenders and even triage teams— I've seen this at Bugcrowd, like HackerOne, like all of the other Folks that kind of sit in the middle, they're all getting completely slammed right now because the volume's just gone crazy. Part of that volume is just slop and like spam and spurious reports. But a big part of it that's actually pretty important is this idea that like the cost to discover certain issues has gone down. And then this sort of, you must be, you know, yay tall to ride barrier to entry has gone down. As well. So you've got like more people doing stuff and they're finding more things that are already there on top of more people just sending random reports because they don't understand what's valuable and what's not. Um, so like, I've wandered a little bit from the question there, but I think, you know, when it, when it comes down to fixing like the, you know, the unforgivable 10, um, I don't think that's going to come from just screaming at people and saying, you still suck at this. Like, now we're just going to tell you more often. I think it comes with actually helping people understand risk and starting to put tools in their hands to do, you know, basically reduce the cost of actually fixing stuff and doing like defense, you know, code patching, fixing all those different things, doing that sort of thing more proactively. So I don't sort of see that. I guess all that's to say that like, I've never really believed that you just kill a bug by finding it. And like, this is as, you know, the guy who started Bugcrowd, right? So I, I need to actually say that out loud from time to time because people assume that I do believe that. Um, I don't. I, I think really what it comes down to now is actually helping folk, you know, more effectively and more efficiently actually mitigate some of this stuff. If we do that, then yeah, I think we've got a good shot at clearing out some of the craft, and then we can, we can get to work on them, on the more gnarly stuff.

I think the exploitation, and this is my take, I think exploitation as pen testing or, you know, uh, yeah, bug bounty in general, it's about signal. It's like, hey, this is impact. I can, we can talk about impact, but normally it's outsourced, right? It is. I don't understand what I'm exposing or how I'm exposing.

Yep.

Don't you think in a way, this power shift or this knowledge shift will allow other people to hack themselves?

Yeah, I do. And what I do think is the more, like, the more folk, I mean, this is one of the things that is, you know, it's one of the reasons I'm so passionate about crowdsourcing, not just bug bounty, but like just vuln disclosure, period. It hits different as an organization when you can have a conversation with a human around what they've found. And what's done. And all of a sudden it's like, okay, they're friendly, but like, I wonder what their next door neighbor's like, because theoretically they, they could have done exactly the same thing. So like, as an organization or even as an individual, like this whole idea of like, I believe in the boogeyman now when it comes to the fact that this matters, like it's, it short circuits the path to that kind of realization. And I think, you know, I gotta say, like, it is a really common Um, yeah, people in security greatly overestimate the ability and the propensity for people to think like bad guys in the way that we do, right? Like, we think like that because we're like that. Um, but what we can forget is that not everyone's like that. In fact, most people probably aren't. So this whole idea of like, why don't they just fix this stuff? Don't they realize it's important? It's because we haven't done a good enough job of actually explaining it to them yet, usually.

And to be honest, sometimes as people in the offensive, we are more focused on how to break than how to fix. And we might be less empathic on, oh, this is obvious because it basically rewards the person who found the problem and not the person who is trying to have the ship afloat.

Yeah.

Yep.

Yeah, exactly. I mean, for us, like, Root is the product. Yeah. And we're trying to produce our end product and we're trying to make the product succeed. But for us, that's like, if we're just doing pure offense, then that's kind of job done for us at that point. And we've succeeded in shipping our product. Meanwhile, on the receiving end, they're like, I sell toasters. Like, this is not actually, you know what I mean? It's not my core business. This is like incidental. To what I'm trying to do. It's not core to it. Like, if it escalates and I get taken down, yeah, sure, that becomes core. Um, but that's not real yet. All I've seen is this kind of, you know, demonstration of impact. So you've got to get people kind of across that hump. And I think, yeah, spoken offense, actually, um, thinking that part through, this is something that like was really interesting to learn and to apply at scale. At Bugcrowd, it's, you know, half a million plus people with all sorts of different levels of skill, like their communication ability, their neurodivergence, like how, you know, pleasant or unpleasant are they as a human regardless of what they're like, all that stuff, right? And realizing like, this is actually a translation problem that we've got. Like it's on top of everything else, the whole idea of actually, you know, helping both sides of that conversation have better empathy. for where the other one's coming from. I think that's the single most powerful thing across the board in terms of consistent impact. Like, whatever happens on top of that's kind of gravy at that point. But that's not a thing that technologists necessarily think about a whole lot because we're so busy getting shell, which, by the way, is a ton of fun too. So it's like, it's both. It's not either or.

When I think both of us have this introduction into security and It was not a career. It's something that we will either figuring out or we made as we go, right? And, but I do think that now that ground is shifting and in many ways, not only about AI, I think you get threat actors, either government, crime, things that There weren't— it's not a group of teenagers having fun, having loads.

Right.

And so I sometimes, I think we have a good idea of hacking, but it's not the same hacking as we do. And probably it's because I'm just old and I'm missing some of these dates, but I see on the other side, people who are running businesses, suffer the impact of ransomware, you know? And when you go and help them, it's outdated software, it's— and I'm not talking about mom-and-pops, I'm talking about—

Right across the board.

Yeah.

Yeah.

So my question is, I have this sort of, you know, thing that I imagine a lot of technical debt Within security will be collected. It's not that we are finding new things. We are just finding things that were there for a long time.

Yeah.

Have you seen that in the Bug Bounty community, Flash, Discord?

Yeah, yeah.

Are you getting more traffic? Are you getting more people?

Oh yeah, 100%.

Reach out saying like, hey, how can I channel this?

Just to be clear too, in terms of like my vantage on this, like I actually finished up with Bugcrowd in January of this year and I've been working effectively full-time on the Disclose.io side of things. And like Disclose.io, they're related, but somewhat different because, you know, to me, like, vulnerability disclosure and security reporting is just literally a part of how the internet works, no matter what you're doing. It doesn't matter if someone's getting paid or not, if they're using a clanker or not, who cares?

Yeah.

It's like this whole idea of like, Hey, you're on the internet. Like your fly's undone. Like how do you? You know.

Can I pitch Disclose IO?

Sure. Yeah.

This is my take of Disclose IO. Yeah. Disclose IO. It's a website, a service that can allow people a good point of contact of assets that are on the internet. So if you, your agents are hacking, they can go to Disclose IO and either buy. TXT records on your DNS or by a security.txt on your website, you can see if something is within scope or not, or if that allows some security research. I don't know if, but that's what I— and by the way, I'm a really fan of that.

I appreciate that. Yeah, that's a good description. I think that's part of it. This has been going on since, like, I started working on that probably 2 years into Bugcrowd. And we actually, you know, rolled it into its own thing in probably 2018 or so. Um, that's, that's definitely a big part of it. Like, we've got, you know, a lookup tool that's, that's, um, like MCP and API capable and has, you know, connections into all of the different web tooling that people would use to do internet Safari type stuff. Um, Mm-hmm. There's a bunch of other things. I think the, the underlying idea of it is that, like, no matter who you are as a vendor, You should be anticipating getting security feedback from the outside world and like preparing for that. It's not like, you know, you can sort of block your ears and that'll go away, because if people find stuff, they'll find stuff. So like, how do we kind of make the internet look more like that? But the other side of it was to really kind of normalize this idea of safe harbor as well. So for organizations that have a proactive vulnerability disclosure policy, if they've got language in there that says, like, we don't think you're a criminal, you know, you can feel safe reporting this stuff to us, like, we're not going to prosecute. By the way, if you, like, ransomware our stuff, then yeah, that's going to be a different conversation. But, you know, we actually fundamentally believe in this idea of good faith research, and we're going to treat you in that way unless you give us a reason not to. The original goal was to get enough of that language out there on the internet to basically cause legislators to start to think about changing laws, which started to happen in Europe in like 2019. We had charging rule changes to the CFAA come through here in the US in '22. Like, it's a long road, but it's, it's one of those things where it's like, no, um, yeah, making the operating environment for hackers that do stuff in good faith safe for them to do that. Like we're coming out of this, this period where, you know, I feel like the, uh, the internet's sort of had an immune deficiency, right? And we're kind of trying to deal with that.

I, I like that way to portray it.

Yeah. Like if we're the immune system, we're attacking the immune system instead of the disease, then that's, that's literally an auto— autoimmune problem. So it's like, how do you, how do you deal with that? That's kind of the metaphor I like to use.

But let's say, I think a big part of your work has been trying to build this safe harbor.

Yeah.

For humans, for people who are experimenting. They're trying, they're trying to do good. Sometimes not in the best approach, but it's good faith. What happens when an agent goes a bit too far? What, and I know that it's not from a kind of a law perspective or policy, but I love having your, your vision on it.

Yeah, I appreciate, I appreciate that. Um, yeah, and this is where I'll throw in the, like, I'm not a lawyer and if I was, I, I'm not your lawyer. So if you're actually, you know, dealing with this, go get one and, and ask them about it. But I'm happy to opine on it. I think, yeah, I mean, obviously the first answer to that is like, it depends on where you are. Like jurisdiction matters a ton. You know, the, the fact that like the CFAA has charging rule changes doesn't mean that state laws don't apply, for example, in the US. And there's 50 different states. So like that matters, right?

Yeah.

Same if you're international, so on and so forth. I think—

I wonder where OpenAI, it's based.

Yeah, look, I think the other side of it is that with anti-hacking laws in general, there's a criminal end to it and then there's a civil end to it, right? So the criminal end to it is like, have you committed crime? In a way that law enforcement or DOJ or like Interpol or whoever it might be, um, are going to use that law to cloud up and rain on you because you've actually broken the law in a criminal sense. That's one half of it. The other half of it is, you know, basically civil. It's like you've caused damages to my organization and I'm actually going to sue you civilly, uh, in pursuit of, you know, recovery of that or whatever it might be, right? Um, and they're both really kind of up in the air with this whole agent question, I think, because like the reality of it is that like for, for security researchers, you know, what it comes down to is if the company that you're hacking on, um, gets sufficiently pissed off about what you're doing and, and has a sufficient resource base and a sufficient kind of legal team available to mount a case. against you, then they'll probably do that because that's usually what determines whether a civil suit happens or not. Do you know what I mean? Like, the law itself doesn't— it matters, but it's not as predictive as it is on the criminal side. Um, so if it's OpenAI, like, they've got a, you know, they've got a pretty big bank account and a decent-sized legal team.

Sorry for this, this, Orbán.

No, look, it's, it's one of those things where I'm sure there's a lot of stuff that went on in the background there to smooth things over. But in terms of, like, anyone who you know, a victim of that sort of clouding up and raining, like, you're probably going to lose that legal battle. So, like, why do it in the first place? Um, that's not a great answer, but in practice, that's really how it often does work. And I think that's why this whole thing is so much more important to me right now to kind of reinforce for individual security researchers, because we don't necessarily have deep pockets or legal teams, and it's a lot easier for an organization to impose that pressure On us than it is if you're talking like agent to agent at a frontier level. So that's the practical, you know, version of how this shit plays out for real. Um, I think legally, like everyone's scratching their head on that same question right now. Like Leonard, Leonard Bailey, who was like the lead for IP and cybercrime at DOJ for like 12 years, um, phenomenal ally of the community actually inside the wire at Department of Justice. He just retired. He gave a talk at BSides Las Vegas this year where he actually gets asked that question and he kind of gives his own, like, I don't work there anymore opinion on it at the end. And he's not a guy who's done that a lot before because you get into a lot of trouble if you do that.

Of course.

And you still, yeah. And yeah, it's worth listening to because I think, you know, really what he kind of called out is that This stuff has needed to be rewritten for a long time to kind of acknowledge the fact that the internet, you know, when it comes to the CFIA, that thing was written in 1986 and it hasn't really been amended since. And like the internet looks extremely different now.

We have been trying to catch up with that, but it has changed so fast. Even in the last few months, it has changed way faster. Exactly. I think I never talk so much about cybersecurity than in the last year because it has become from like non-cyber. Do you have that experience as well? Does people that, of course they know you, that you work in cyber besides the details, but I think the general public, it's a bit more concerned because of the marketing, concerned because the AI in general, How has been that experience for you?

Yeah, I mean, look, I've sort of, I've had that ever since Bugcrowd kind of got a tailwind because it's a noisy, like it was a noisy-ass business. And, you know, I definitely tried to take advantage of that to make sure some of those stories got told. So as a result, everyone's like, oh, you're that security dude. Like, what do you think about blah, blah? I do feel like that's gone up a lot. I feel like there's a lot of uncertainty. You know, the whole like the robots are going to come and hack all our stuff narrative is concerning for a layperson, which makes it a political issue, which is one of the reasons why a lot of that stuff's going on right now, especially heading into midterms here in the US. But you know, you think about like the reality to me of a lot of what's actually happening is people are realizing that no, like The hackers weren't lying this whole time. Like, there are a crap ton of vulnerabilities out there. And, you know, to use your kind of phrase before, like, the technical debt hasn't really been called in in the same way previously. So all of a sudden we're learning a whole bunch of new stuff and it's like, yeah, you can hack a PLC and like, you know, futz with a water plant if you happen to know the default password, because that's not even really an AI thing. That was just a preexisting problem that You know, we've, we've experienced recently here in the US, like there's a lot of those. And I think that, that realization has sort of entered the zeitgeist in a different way over the past year. That's, that's how I, that's how I'd frame it. And then you add to that, is it robots? Is it, and all of the kind of the hypey confusing parts of it.

Yeah.

You know, some people sort of follow the whole thing through to the, to the point where they actually get to a rational conclusion about things. But I think The noise doesn't help with that necessarily to what you're asking for.

I think we're in a definitely confusing times because it's wild.

Yeah.

And it's wild. And I even get anxiety by just looking at social media, right? Things that, like, I get excited because I know we are going to be better. I don't know if we're going to be better right now.

Right.

I don't know. We get all this conversation about this, you know, powerful models like Mythos, like they're going to— they're in a cage and they're going to be released. But at the same time, you see people using off-the-mill models that they host themselves and they are leveraging tools that we have like Burp Suite, SQLMap, and they just Ramming out. So, well, yeah.

And like this idea that, I mean, even in the technology space, you know, like the whole concept of like harness engineering is only a thing that people have really started to talk about over the past probably 6 months in a popular way. But like, I've seen people do some pretty crazy stuff with like DeepSeek 4R2, which is whatever, 3 and a half years old at this point in time. Like it's not— I think Mythos, Daybreak, like all of those conversations, like I said, like there's real capability there and I'm not arguing that part. But I think there was already real capability there and a real opportunity. And what they've done is kind of escalated this conversation to the point where everyone's talking about it now. And like, yeah, you know, again, like we said before, I think the fact that like that gives us the right kind of Momentum to actually deal with problems, or at least talk about dealing with problems that have been hard to talk about or deal with historically. I think that's a really good thing. I think the hype and the paralysis and the fear that can come with it, obviously that's, that's a pretty crappy side effect. So I think we're like, to your point, I think we're, we're in that place right now where it's just a bunch of both and everyone's like, yeah, what do I do?

There are people specifically in the offensive side, more on the vulnerability research area, that maybe in the 2000s and like 2010s, they were like super prolific and publicly. And now we see them coming back.

Yeah.

Mark Dowd could be a good example. Caliph could be a great example. People who were, of course, doing a lot of great stuff, but now they're going back to its origins, its roots. So I, in a way, people that were really good at finding bugs before are really good finding bugs now. And so that is something that I get also, you know, quite puzzled.

Yeah, I think that's a great way. I'd sort of frame, because I mean, people that, you know, if you know, if you know Dad, or if you know his work, you know, if you know like Halvar's work, and he's over at OpenAI now, like the Kleef guys and Ty, and like these folk that have done really, like, in terms of the bugs they've found and the stories they've been able to tell over the years, they're like doing really cutting-edge frontier stuff. But if you kind of peel the paint off how they're doing it, it's because they think about security At a system level, um, and not necessarily at a, at an individual kind of bug level, if that makes sense. And if you take someone who thinks like that, um, and give them like crazy tools to think like that in a million directions more quickly without needing to sleep, then yeah, like cool stuff happens is, is really what it comes down to. I think it's been really interesting watching that sort of like '90s VR crew, um, shift from like, this is BS, or this is all hype, or like, I don't really care, it's fancy autocomplete, like that kind of curmudgeon take to like, oh, okay, no, this is a big part of how, how things work in the future. Like, I'm actually going to get into it. And seeing them actually become effective, like that lag I thought was really interesting. Um, but they're all pretty much across the line at this point. There's some pretty cool stuff being worked on for sure.

The, the, the amount of new things coming in from people that we know and people we don't know. Uh, and in a few weeks from now, we have Unprompt Australia, which, uh, I'm— we know some, some people, some arbolists will be, uh, going there. Tell us a bit of, yeah, what are— what to expect, what's happening, what do you see? Yeah, new faces, old faces. Tell us all.

Yeah, so, um, yes, I'm on the review board for, for that and a variety of other things as well. But like, I got involved in this one because I've known, you know, Mark's been a friend for, for a decade or more at this point in time. And us Aussies like to stick close together, so there is also that. Um, but we were talking about it and he's like, well, you know, like, we need to sort of advance the state of thinking in the community around this stuff in Australia. Because something that he and I had both observed is that like in the US, you know, it's a lot, it's frankly, it's a lot further along, if that makes sense. And in the meantime, like Australia's always really punched above its weight from an offensive security standpoint. I think it's like a convict colony thing that just, shows up in computers or whatever. So the fact that we're kind of behind on, on where I— where AI actually fits into that, um, it's like, okay, that's a problem that we should probably try to fix, right? And that was really the origin of it. Um, and yeah, like, it was some phenomenal talks. Like, the, you know, the people that are, that are coming, um, as far as I can tell at this point, it's a combination of folks that are really on the cutting edge that are in Australia but aren't necessarily as assembled into communities as you see here in the US, as well as folks that are like, all right, I need to bone up on this stuff and understand the art of the possible. You got policymakers, you got folk from the security industry and intelligence and whatever else. Like, it's, it's going to be a really fun, it's going to be a really fun event just because it's, it's really the first of its kind in that part of the world. And, you know, I'm obviously biased on this, but Aussies are pretty, Like, if you tell us to go off and do a thing, we generally get it done with whatever's within arm's reach. So this idea of like innovation as a part of the culture, I think that's, that's going to show up at the event, which will be fun.

The, the, the amount of changes this industry is having, and I think it is also kind of a support group, right? It's like, let's hang out. Uh, and I saw this in Vegas when I think we, we last met. And it was mainly excitement and sharing like, hey, what are you doing? I'm doing this, you're doing that. Oh, that's great. So I see all this, you know, maybe I'm biased in this case, but I see the revival of many of the next thing. I think many of us, or I, I, at least I totally agree myself, the black pilled saying, oh, we cannot fix anything or this, it would never change where, and now I see Signal groups getting super live, chats, improv, unprompted. So in a way, I think it's a good stage, even it's hectic and chaotic.

Yeah, I agree with that. I think It has been a breath of fresh air. Like, I'm, I mean, personally, like, I'm, I'm hacking on stuff. Yeah, I, for me, it feels like kind of the early 2000s again in some ways in terms of like, oh, I can just do stuff. Um, and, you know, like, that's always been true, but like moving across into the business side of things and like the older I get, the better I was and all that other stuff. It's, you know, this sort of like breath of fresh air. into that like technical exploitation kind of mindset. And I've really enjoyed that. Um, and yeah, I agree. I think a lot of people have sort of had that same experience, especially the ones that have been around for longer. Um, you know, I do think like the whole idea of like nothing's ever going to change, it's an interesting one because on the entrepreneurship side, you know, one of the things I love about cybersecurity entrepreneurs in particular, and you and I've talked about this, um, is the idea that you can kind of stare like a really hard problem in the face and be like, yeah, you know what, actually, I think I could probably maybe do something about that. So now I need to find out whether or not that's true. I do think there are some black pill truths around security that, you know, need to be kind of reconciled. Like the idea that, you know, it's a, it's an afterthought. Like people build technology to do the thing that they want it to do. They don't build it to not do all the things that might give a bad guy the chance to do it. And that's an economics problem, right? That's not really a thing that you can kind of solve. But what you can do is make, you know, insecure easier and make secure more obvious. And when people kind of lean into that aspect of it, it's like, oh, I'm excited to actually work on that. Like, that's where I sort of see the, the whole thing kind of comes around full circle. And it's like, okay, we've got some pretty major problems to deal with here, but I actually think I've got some ideas that might help. Um, seeing that bubble up is, is really cool.

Thank you, Casey, for joining us in Offense Taken. Uh, it's been a pleasure talking about all these topics that, uh, I find so passionate about. And every time we chat and we have a minute, it's always refreshing to talk to you. So thank you for joining us here at Offense Taken. If it's your first time, Seeing us, you can find more chapters at expo.com. Catch you later and keep hacking.