AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more impactful vulns and why the combination of domain expertise and curiosity remains profitable.
Segment Resources
Vulnerability discovery and remediation gap in the AI era
AI-generated code is changing how vulnerabilities are created, discovered, and managed. This segment explores why finding more vulnerabilities doesn’t necessarily mean reducing exposure, how teams can validate exploitability and prioritize real risk, and where agentic AI can support defenders without replacing human security expertise. It also looks at what continuous threat exposure management means for enterprise security teams in practice.
Everyone's a Builder Now: Securing the AI-Powered Enterprise: Black Hat Interview with Gil Geron, CEO of Orca Security
AI is fundamentally changing software development, turning employees across the business into builders and reshaping how organizations think about innovation and risk. In this session, Orca Security CEO Gil Geron explores what this shift means for enterprise leaders and why security must evolve alongside the next generation of AI-powered software creation.
Segment Resources:
This segment is sponsored by Orca Security. Visit https://securityweekly.com/orcabh to learn more about them!
Bugcrowd Launches Pathseeker: Flipping the Script on Traditional Pentesting: Black Hat Interview with Braden Russell, CTO of Bugcrowd
Bugcrowd is launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line, which combines continuous agentic pentesting with on-demand human validation. The launch comes as the security industry grapples with a growing "AI slop" problem, where unchecked AI-generated vulnerability reports have overwhelmed bug bounty programs and even forced some, like Curl, to shut theirs down. Braden will unpack how Bugcrowd is positioning Savant Pathseeker as a response to that industry-wide trust problem, not just a new product launch.
Segment Resources:
- https://www.bugcrowd.com/products/pathseeker/
- https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/
- https://www.bugcrowd.com/products/platform
- https://www.bugcrowd.com/products/ai-powered-security-intelligence/
Apply for early access at https://securityweekly.com/bugcrowdbh
Nidhi Aggarwal is the Chief Product Officer at HackerOne, where she leads the execution of the company’s platform vision and strategy. She is a tech entrepreneur and business leader with over 15 years of experience driving growth and transformation at technology companies. She co-founded Qwiklabs, a cloud configuration management platform acquired by Google. Prior to that, she was part of the executive leadership team at Tamr, an AI and human-in-the-loop master data management platform, where she led product, marketing, and finance. Earlier in her career, Nidhi held roles at Wellington, Hewlett-Packard Labs, VMware, and McKinsey & Company. She holds a Ph.D. in Computer Science and received the Early Career Achievement Award from the University of Wisconsin–Madison, where she currently serves on the Computer Science Department’s Board of Visitors.
Gil Geron is CEO & Co-founder of Orca Security. Gil has more than 20 years of experience leading and delivering cybersecurity products. Previous to his role as CEO, Gil was chief product officer from the inception of Orca. He’s passionate about customer satisfaction and has worked closely with customers to ensure they are able to thrive securely in the cloud. Gil is committed to providing seamless cybersecurity solutions without compromising on efficiency. Prior to co-founding Orca Security, Gil directed a large team of cyber professionals at Check Point Software Technologies.
Braden Russell is a seasoned cybersecurity leader with over 20 years of experience across various disciplines, including Vulnerability Management, Risk and Compliance, Advanced Endpoint Protection, Cloud Security, and Digital Commerce. He has held key leadership roles at prominent companies like Foundstone, McAfee, Intel Security, and Cylance. At Cylance, Braden served as the founding SVP of Product Development and Engineering, where he built the teams and technologies behind all Cylance products, including the award-winning CylancePROTECT, the first Next-Gen Antivirus (NGAV).
Most recently, Braden was the CTO of the Falcon Platform and Next-Gen SIEM at CrowdStrike, where he led the vision and strategy for the first Security Cloud. His innovative contributions to the field are reflected in his patents for advanced techniques in automated vulnerability discovery and intelligent malware detection.
Before transitioning to cybersecurity, Braden was part of the Advanced Digital Systems Group at Sony Pictures Studios, where his team received a Technical Academy Award in 2000.
Braden holds an MBA from Pepperdine University and a BS in Electrical and Computer Engineering from the University of California, Irvine. He resides in Southern California with his wife and their five sons.
You shipped it, but is it still exposed? Shadow APIs, forgotten endpoints, and unmanaged services are expanding your attack surface beyond what AppSec teams can track.
So what’s still out there?
At the Attack Surface Management Virtual Cybersecurity Summit on September 16th, learn how to discover exposed applications and APIs and reduce risk across your environment.
Security Weekly listeners can register for free at https://securityweekly.com/asm using the promo code: CSS26-SW
Unlock the full InfoSec World experience with the All Access Pass, featuring premium workshops, exclusive content, VIP experiences, and expanded opportunities to connect with cybersecurity leaders across industries. Join us in Orlando, October 12–14. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026.
