More The Secure Disclosure episodes
Published 2 Apr 2026
Duration: 00:35:05
Ethical hacking evolved from underground communities to enterprise-driven security frameworks, addressing stigma and legacy systems, AI's dual role in threat detection and synthetic risks, and the need for secure-by-design practices, hybrid human-AI strategies, and managing supply chain vulnerabilities amid evolving cyber threats.
Casey Ellis, founder of Bugcrowd, joins the show to talk about the evolution of bug bounty, how hackers went from outsiders to strategic assets, and w...
The text explores the evolution of ethical hacking and its integration into enterprise security, tracing Caseys journey from an early interest in hacking during the digital transition of the 1980s to founding Bug Boundary (originally Bug Crowd) in 2012. This platform aimed to bridge the gap between ethical hackers and organizations by legitimizing their role in addressing vulnerabilities, moving away from the stigma of labeling them as criminals. Challenges discussed include the limitations of traditional security models, such as outdated payment structures for penetration testing and the lack of centralized scaling for early bug bounty programs. The text emphasizes how Bug Boundary accelerated the adoption of crowdsourced security testing, positioning ethical hacking as a strategic enterprise solution.
A significant focus is placed on AIs transformative impact on cybersecurity, both as a threat and a tool. AI amplifies existing vulnerabilities by accelerating exploitation and report generation, compressing the OODA loop (observe, orient, decide, act) to a point where human response is insufficient. This has introduced challenges like AI-generated synthetic reports, which blur the line between genuine and fake threats, straining automated triage systems. The text also examines the scalability issues in bug bounty programs, including managing floods of vulnerability submissions, differentiating valid reports from noise, and balancing public vs. private program risks. Proposed solutions include leveraging AI for triage, improving community-driven accountability, and refining incentive structures to prioritize high-value, hard-to-find bugs over low-effort or AI-generated ones.
The discussion extends to future trends in cybersecurity, such as the unresolved risks of supply chain vulnerabilities, the evolving role of AI in coding and security (as a "force multiplier" for human engineers), and the persistent human factors in securitylike error-prone behavior and over-permissioning. The text highlights the need for organizations to adopt mature vulnerability management practices, secure-by-design systems, and adaptive strategies to address emerging threats, including quantum computing and AI-driven robotics. Ultimately, it underscores the hybrid necessity of combining AI automation with human creativity to navigate the complex, ever-evolving landscape of cybersecurity, while ensuring ethical and effective community engagement.
17 Sept 2026 Practical AI Security & Adversarial Machine Learning with Dr Harriot Farlow
"Examines unique AI security risks, industry misconceptions, governance gaps, ethical concerns, and the urgent need for tailored solutions and global cooperation."
3 Sept 2026 Email Security in the Age of AI | Josh Kamdjou, Sublime Security CEO
"Email security faces growing threats from AI-driven phishing, prompt injection, and malicious calendar invites, outpacing traditional defenses; Sublime Security's real-time, agentic approach offers a solution, while cyber warfare increasingly exploits human cognitive vulnerabilities."
27 Aug 2026 Can We Actually Fix Software Supply Chain Security? 6 AppSec Leaders Debate
"Software security faces critical challenges due to prioritizing developer speed over safety, rising supply chain attacks on open-source packages, industry silos, and AI-driven threats, requiring urgent collaboration, education, and stronger security measures."
19 Aug 2026 Tearing Down Vendor Fluff: The Real State of AI Security | James Berthoty
"AI's rapid adoption in cybersecurity, driven by executive pressure and fear of obsolescence, contrasts with slower cloud security uptake, as vendors overpromise solutions while breaches persist; AI both enables attacks (like supply chain malware) and enhances defenses, reshaping security roles and workflows, with governance and real-world gaps (e.g., Hugging Face breach) remaining critical."
12 Aug 2026 GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
"Exposed NASA Slack API key highlights credential leaks, with GitGuardian using AI to detect and prevent secrets in repositories and developer machines, while addressing evolving threats, AI risks, and proactive security practices."