More The Secure Disclosure episodes
Published 2 Apr 2026
Duration: 00:35:05
Ethical hacking evolved from underground communities to enterprise-driven security frameworks, addressing stigma and legacy systems, AI's dual role in threat detection and synthetic risks, and the need for secure-by-design practices, hybrid human-AI strategies, and managing supply chain vulnerabilities amid evolving cyber threats.
Casey Ellis, founder of Bugcrowd, joins the show to talk about the evolution of bug bounty, how hackers went from outsiders to strategic assets, and w...
The text explores the evolution of ethical hacking and its integration into enterprise security, tracing Caseys journey from an early interest in hacking during the digital transition of the 1980s to founding Bug Boundary (originally Bug Crowd) in 2012. This platform aimed to bridge the gap between ethical hackers and organizations by legitimizing their role in addressing vulnerabilities, moving away from the stigma of labeling them as criminals. Challenges discussed include the limitations of traditional security models, such as outdated payment structures for penetration testing and the lack of centralized scaling for early bug bounty programs. The text emphasizes how Bug Boundary accelerated the adoption of crowdsourced security testing, positioning ethical hacking as a strategic enterprise solution.
A significant focus is placed on AIs transformative impact on cybersecurity, both as a threat and a tool. AI amplifies existing vulnerabilities by accelerating exploitation and report generation, compressing the OODA loop (observe, orient, decide, act) to a point where human response is insufficient. This has introduced challenges like AI-generated synthetic reports, which blur the line between genuine and fake threats, straining automated triage systems. The text also examines the scalability issues in bug bounty programs, including managing floods of vulnerability submissions, differentiating valid reports from noise, and balancing public vs. private program risks. Proposed solutions include leveraging AI for triage, improving community-driven accountability, and refining incentive structures to prioritize high-value, hard-to-find bugs over low-effort or AI-generated ones.
The discussion extends to future trends in cybersecurity, such as the unresolved risks of supply chain vulnerabilities, the evolving role of AI in coding and security (as a "force multiplier" for human engineers), and the persistent human factors in securitylike error-prone behavior and over-permissioning. The text highlights the need for organizations to adopt mature vulnerability management practices, secure-by-design systems, and adaptive strategies to address emerging threats, including quantum computing and AI-driven robotics. Ultimately, it underscores the hybrid necessity of combining AI automation with human creativity to navigate the complex, ever-evolving landscape of cybersecurity, while ensuring ethical and effective community engagement.
7 Apr 2026 Open Source Malware, Supply Chain Risk, and Contagious Interviews: w/ Paul McCarty and Jenn Gile
Cyberattacks exploit developers and non-technical roles via social engineering and malware, with inadequate detection systems, state-sponsored threats targeting open-source ecosystems, and proposed solutions like the Open Source Malware Initiative and registry reforms to enhance tracking, accountability, and threat intelligence sharing.
25 Mar 2026 Are Humans the Weakest Link in Security? w/ Sean Juroviesky
Securing organizations requires aligning human-centric workflows and communication with embedded, frictionless security practices, addressing human error through behavior monitoring and training, managing shadow IT/AI via collaboration and inventory, balancing usability with targeted access controls, and fostering proactive security culture through education and storytelling rather than enforcement.
17 Mar 2026 AI Agents Must Have Identity & Access Control w/ Johannes Keienburg
Autonomous AI agents, with transformative productivity potential, pose significant security, accountability, and governance challenges requiring dynamic access controls, human oversight, and industry-wide standards to ensure safe and regulated integration.
16 Mar 2026 The Creator of Curl on Why AI Is Breaking Bug Bounties w/ Daniel Stenberg
The Curl project's evolution from a 1996 currency tool to a prominent open-source library highlights community-driven growth, open-source maintenance challenges, AI's impact on security reporting, sustainability issues, and tensions between innovation and unresolved technical risks.
9 Mar 2026 LLMs Will Never Be Fully Secure w/ Brooks McMillin
Security oversights in AI/MCP server development, mirroring historical flaws like SQL injection, include unsafe practices such as `eval` usage and weak authorization, risking remote code execution and data leaks, while stressing the need for layered defenses against AI-amplified exploits in untested ecosystems.