Bug Bounties

Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding interconnected systems than fixing a single piece of software. We discuss how orgs can be more effective at securing their environment and what role LLMs might have in evaluating controls. Plus, we look to the future of bug bounty programs and how researchers can still excel through curiosity and expertise on a topic rather than relying on scanners, prompts, and luck.

Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding interconnected systems than fixing a single piece of software. We discuss how orgs can be more effective at securing their environment and what role LLMs might have in evaluating controls. Plus, we look to the future of bug bounty programs and how researchers can still excel through curiosity and expertise on a topic rather than relying on scanners, prompts, and luck.

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”15124″} podcast from PPWorks

Application security

AI benefits/risks

Going From Bug Bounty Bugs to More Secure Systems – Shlomie Liberow – ASW #402

Tech Explainer_Asset-management

Asset Management

Nexus

Patch/Configuration Management

Penetration Testing

Risk Identification/Classification/Mitigation

Vulnerability Management

Tech Explainer

Exposure decisions under incomplete evidence: prioritizing without treating unknown as safe

AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more impactful vulns and why the combination of domain expertise and curiosity remains profitable.

AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more impactful vulns and why the combination of domain expertise and curiosity remains profitable.

<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt">https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt</a></li>
</ul>

<ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt">https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt</a></li></ul>

Vulnerability discovery and remediation gap in the AI era

Vulnerability discovery and remediation gap in the AI era

AI-generated code is changing how vulnerabilities are created, discovered, and managed. This segment explores why finding more vulnerabilities doesn’t necessarily mean reducing exposure, how teams can validate exploitability and prioritize real risk, and where agentic AI can support defenders without replacing human security expertise. It also looks at what continuous threat exposure management means for enterprise security teams in practice.

AI-generated code is changing how vulnerabilities are created, discovered, and managed. This segment explores why finding more vulnerabilities doesn’t necessarily mean reducing exposure, how teams can validate exploitability and prioritize real risk, and where agentic AI can support defenders without replacing human security expertise. It also looks at what continuous threat exposure management means for enterprise security teams in practice.

Everyone's a Builder Now: Securing the AI-Powered Enterprise: Black Hat Interview with Gil Geron, CEO of Orca Security

Everyone's a Builder Now: Securing the AI-Powered Enterprise: Black Hat Interview with Gil Geron, CEO of Orca Security

AI is fundamentally changing software development, turning employees across the business into builders and reshaping how organizations think about innovation and risk. In this session, Orca Security CEO Gil Geron explores what this shift means for enterprise leaders and why security must evolve alongside the next generation of AI-powered software creation.

AI is fundamentally changing software development, turning employees across the business into builders and reshaping how organizations think about innovation and risk. In this session, Orca Security CEO Gil Geron explores what this shift means for enterprise leaders and why security must evolve alongside the next generation of AI-powered software creation.

<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/">https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/</a></li>


<li><a rel="noopener" target="_blank" href="https://orca.security/platform/ai-appgen-security/">https://orca.security/platform/ai-appgen-security/</a></li>
</ul>

<ul><li><a rel="noreferrer noopener" target="_blank" href="https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/">https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://orca.security/platform/ai-appgen-security/">https://orca.security/platform/ai-appgen-security/</a></li></ul>

This segment is sponsored by Orca Security. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/orcabh">https://securityweekly.com/orcabh</a> to learn more about them!

This segment is sponsored by Orca Security. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/orcabh">https://securityweekly.com/orcabh</a> to learn more about them!

Bugcrowd Launches Pathseeker: Flipping the Script on Traditional Pentesting: Black Hat Interview with Braden Russell, CTO of Bugcrowd

Bugcrowd Launches Pathseeker: Flipping the Script on Traditional Pentesting: Black Hat Interview with Braden Russell, CTO of Bugcrowd

Bugcrowd is launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line, which combines continuous agentic pentesting with on-demand human validation. The launch comes as the security industry grapples with a growing "AI slop" problem, where unchecked AI-generated vulnerability reports have overwhelmed bug bounty programs and even forced some, like Curl, to shut theirs down. Braden will unpack how Bugcrowd is positioning Savant Pathseeker as a response to that industry-wide trust problem, not just a new product launch.

Bugcrowd is launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line, which combines continuous agentic pentesting with on-demand human validation. The launch comes as the security industry grapples with a growing "AI slop" problem, where unchecked AI-generated vulnerability reports have overwhelmed bug bounty programs and even forced some, like Curl, to shut theirs down. Braden will unpack how Bugcrowd is positioning Savant Pathseeker as a response to that industry-wide trust problem, not just a new product launch.

<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://www.bugcrowd.com/products/pathseeker/">https://www.bugcrowd.com/products/pathseeker/</a></li>


<li><a rel="noopener" target="_blank" href="https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/">https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/</a></li>


<li><a rel="noopener" target="_blank" href="https://www.bugcrowd.com/products/platform">https://www.bugcrowd.com/products/platform</a></li>


<li><a rel="noopener" target="_blank" href="https://www.bugcrowd.com/products/ai-powered-security-intelligence/">https://www.bugcrowd.com/products/ai-powered-security-intelligence/</a></li>
</ul>

<ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.bugcrowd.com/products/pathseeker/">https://www.bugcrowd.com/products/pathseeker/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/">https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.bugcrowd.com/products/platform">https://www.bugcrowd.com/products/platform</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.bugcrowd.com/products/ai-powered-security-intelligence/">https://www.bugcrowd.com/products/ai-powered-security-intelligence/</a></li></ul>

Apply for early access at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/bugcrowdbh">https://securityweekly.com/bugcrowdbh</a>

Apply for early access at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/bugcrowdbh">https://securityweekly.com/bugcrowdbh</a>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14858″} podcast from PPWorks

Generative AI

Fixing Software Weaknesses Rather Than Just Finding More Flaws – Nidhi Aggarwal, Gil Geron, Braden Russell – ASW #398

Magnifying glass red bug bounty, green binary code, identify and submit vulnerability reports

Bug Bounties

Going From Bug Bounty Bugs to More Secure Systems – Shlomie Liberow – ASW #402

Exposure decisions under incomplete evidence: prioritizing without treating unknown as safe

Fixing Software Weaknesses Rather Than Just Finding More Flaws – Nidhi Aggarwal, Gil Geron, Braden Russell – ASW #398

Vercel offers $1 million in bounties for sandbox hacks

Why responsible vulnerability disclosure is now a boardroom issue

GitHub to implement two-tier bug bounty program amid AI-generated report surge

What Executive Exposure Risk Reporting Actually Requires

How to Evaluate Risk-Based Vulnerability Prioritization Platforms

Fast Five

Selected by the SC Media Editorial team every Tuesday.