More The Secure Disclosure episodes
Published 2 Apr 2026
Duration: 00:35:05
Ethical hacking evolved from underground communities to enterprise-driven security frameworks, addressing stigma and legacy systems, AI's dual role in threat detection and synthetic risks, and the need for secure-by-design practices, hybrid human-AI strategies, and managing supply chain vulnerabilities amid evolving cyber threats.
Casey Ellis, founder of Bugcrowd, joins the show to talk about the evolution of bug bounty, how hackers went from outsiders to strategic assets, and w...
The text explores the evolution of ethical hacking and its integration into enterprise security, tracing Caseys journey from an early interest in hacking during the digital transition of the 1980s to founding Bug Boundary (originally Bug Crowd) in 2012. This platform aimed to bridge the gap between ethical hackers and organizations by legitimizing their role in addressing vulnerabilities, moving away from the stigma of labeling them as criminals. Challenges discussed include the limitations of traditional security models, such as outdated payment structures for penetration testing and the lack of centralized scaling for early bug bounty programs. The text emphasizes how Bug Boundary accelerated the adoption of crowdsourced security testing, positioning ethical hacking as a strategic enterprise solution.
A significant focus is placed on AIs transformative impact on cybersecurity, both as a threat and a tool. AI amplifies existing vulnerabilities by accelerating exploitation and report generation, compressing the OODA loop (observe, orient, decide, act) to a point where human response is insufficient. This has introduced challenges like AI-generated synthetic reports, which blur the line between genuine and fake threats, straining automated triage systems. The text also examines the scalability issues in bug bounty programs, including managing floods of vulnerability submissions, differentiating valid reports from noise, and balancing public vs. private program risks. Proposed solutions include leveraging AI for triage, improving community-driven accountability, and refining incentive structures to prioritize high-value, hard-to-find bugs over low-effort or AI-generated ones.
The discussion extends to future trends in cybersecurity, such as the unresolved risks of supply chain vulnerabilities, the evolving role of AI in coding and security (as a "force multiplier" for human engineers), and the persistent human factors in securitylike error-prone behavior and over-permissioning. The text highlights the need for organizations to adopt mature vulnerability management practices, secure-by-design systems, and adaptive strategies to address emerging threats, including quantum computing and AI-driven robotics. Ultimately, it underscores the hybrid necessity of combining AI automation with human creativity to navigate the complex, ever-evolving landscape of cybersecurity, while ensuring ethical and effective community engagement.
12 Aug 2026 GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
"Exposed NASA Slack API key highlights credential leaks, with GitGuardian using AI to detect and prevent secrets in repositories and developer machines, while addressing evolving threats, AI risks, and proactive security practices."
14 Jul 2026 How to Stop Supply Chain Attacks Without Destroying Developer Productivity
"Cybersecurity threats, especially supply chain attacks on developers and open-source packages, demand balanced mitigation strategies, AI-driven security challenges, and early integration of security in development, with collaboration and adaptability key to addressing evolving risks."
1 Jul 2026 Solving the Supply Chain Security & Malware Crisis w/John Amaral
Escalating software supply chain threats target open-source ecosystems through credential exploitation, AI-fueled malware, and upstream compromises, with challenges in dependency management and outdated libraries driving AI-driven remediation strategies like automated patching and version pinning, though human oversight remains critical for validating fixes.
25 Jun 2026 AI is an Amplifier: Why Bad Infrastructure Gets Wronger Faster w/ Abdel SGHIOUAR
AI agents in cloud-native ecosystems like Kubernetes offer automation and monitoring benefits but face skepticism, security risks, trust issues from hallucinations, and require safeguards and human oversight to balance innovation with control and ensure reliability.
16 Jun 2026 Your Microphone Became a Keylogger w/ David vonThenen
Machine learning analyzes keystroke acoustic signatures to infer typed characters over remote platforms, highlighting high accuracy with known keyboards, privacy risks from surveillance, and challenges in noise and variability, while proposing defenses and noting AI's dual-use implications.