A (2:46)

This is really the power of the crowd. This is the ingenuity and the creativity that exists among all of these security researchers. Unlike traditional security scanning companies or security vendors that have to keep up with the pace of R and D, we're able to tap into the latest and greatest knowledge that exists within that community. So they're finding zero day vulnerabilities before anybody else's. We're seeing that these folks are developing skill sets and tactics for identifying vulnerabilities that would take weeks or months to put into a scanner. So it's helping from a bug crowd perspective that we can stay a step ahead. But the more important part is that we're helping our customers identify these vulnerabilities before a bad actor does. You talked earlier about nation state versus kind of cybercriminal gangs, how that's playing out. One of the really interesting things for us is we're seeing that there's a narrower gap and it's becoming harder to identify a nation state actor from a cyber criminal gang. And a big piece of that is that the sophistication is growing really quickly due to AI. You have more amateur actors that are able to come off or appear more sophisticated because of the ability to tap into AI and our customers are feeling the same thing. So we're helping to bring the right experts at exactly the right time to help them solve whatever challenge it is that they're facing. You can drive, most importantly, the cyber security outcomes that they care about.

B (4:13)

Thank you. And I like your model again, that crowdsourced cyber teams. You know, you're sharing knowledge, you've got a knowledge base, you have tools that you obviously share, and this allows you to stay a step ahead of the criminals. Now, of course, we know AI and some of these other tools are making it even more difficult to prevent attacks because of the sophistication that's coming down the pike. So I appreciate you highlighting that. Dave, what are some of the biggest misconceptions companies still have about vulnerability, disclosure, and working with ethical hackers?

A (4:45)

For a long time there's been this connotation of a hacker sitting in a dark room with a hoodie, typing furiously over a computer. Right. That vision's been baked in since the days of the hackers movie all the way through Mr. Robot. Right. And you see this view of hackers as the proverbial bad guy. And I think organizations today are really starting to realize that this is a really diverse, amazing group of individuals that come from all Walks of life, right. We release what we call our inside the mind of a hacker for it every year. And then the metrics continue to change, right. In terms of the age of the hacker community, the skill sets that they have, how they're furthering and bettering themselves, how many of them are actually working in household brands on a day to day basis as security engineers or in some cases security leadership. And then they're doing this in their free time because they actually care about it. Right. If you look at the motivations, we all have this perception that they're doing it for the money, right. You think about ransomware, gangs and even nation states some instances. I think as organizations come together, they're realizing that there's a ton of talent that exists. I think a lot of this was normalized in the 2015, 2016 range. When the Pentagon came out and said that they were going to run that, the first hack Pentagon program and start to tap into the ingenuity of the crowd. I think that's really where we started to see this industry shift. And today the fear has somewhat gone away, right? There's a trepidation sometimes around, well, how do I know that it's not going to be disclosed and we can walk them through the controls that are in place there. But fundamentally they're looking at the crowd as an extension of their team, I think is the regulatory environment continues to shift and more government agencies are starting to acquire vulnerability disclosure programs or responsible disclosure. That's going to help further this mission of let's tap into the most elite talent when we need it and be able to solicit feedback from the public and most importantly, again, help us find these vulnerabilities before a bad actor does.

B (6:50)

Thank you. I really like that. And I like that you produce that report, I think you call it Inside Mind of a Hacker. I think that's great. And of course, you know, tapping into this most elite group of people again, I think crowdsourcing is one of the biggest things that we can do to be stronger, especially in this space. But I like how many professionals in every industry are working or volunteering their time to make the world a safer place. So I appreciate that. And Dave, looking ahead, what innovations or market shifts do you believe will define the next era of cybersecurity and how is bugcrowd preparing for them?

A (7:24)

Without a doubt, it's this AI era, right. And there's been a lot of hype around AI in terms of the benefit that it's gonna provide and it's gonna revolutionize Everything we do. But from a cybersecurity standpoint, we're seeing some really actionable things coming out of it. So if you think about, for example, from a defender point of view, they're able to now within milliseconds, detect unusual behavior in their environment, whether that's coming from an internal or an external source, and be able to act upon that by leveraging AI, whether it's agentic AI or in some cases, they're leveraging homegrown model that they built. Now what's equally impressive, what's scary on the bad actor side, is that they're also leveraging AI, right? They're becoming more sophisticated in terms of attacks. Right. One of the things and changes we've seen over the past 12 to 18 months has been the speed of zero day identification to exploit. If you think back, we used to have Patch Tuesday and the patches would come out, folks would start bad actors would start to reverse engineer those. They built an exploit package and ultimately deploy that. And that would be about a week. We're now seeing this and we're confirming this by talking with our customers. We're now seeing that this is happening in under 24 hours. So bad actors are moving faster, they're leveraging AI and it's incumbent on us as an industry to start to empower our defenders with this. If you look at how AI is being used across every organization, right. We think about it's helping sales and marketing, it's helping finance, it's helping legal, it's helping development, and we're seeing a level of productivity. But in all of those cases, it also does introduce potential risk into the environment, continues to expand that attack surface. So it's a really delicate balance for a chief security officer, in some cases a chief data officer today to sit where you're trying to control the privacy, safety and security risks that happens when you introduce AI into the environment. At the same time, you're trying to keep pace with the speed of business. And organizations want to grow and they want to continue to develop their capability. And now you have this third cohort of the employee where we can all go sign up for the latest and greatest AI tech and realized how much more productive or efficient it makes us as individuals. But business does need to move a little bit slower. They do need to have more controls in place. So it's a really delicate balance. And I think as we see the industry start to shift, you'll see more and more of the security vendor market start to shift to how do we accelerate the pace of our own innovation to stay one step ahead of the bad actor and make sure that our customers have the tools that they need to be able to deploy some of these AI solutions with confidence and in a really safe through what?

B (10:09)

Thank you, I appreciate that. You know you've highlighted something, you know defenders obviously they've got some great tools now including AI tools on the networks. Again agentic AI is is really coming out now but it's nice that we can detect things within milliseconds but as you know with these zero day vulnerabilities we've got to be on the lookout and ever so vigilant. You highlighted a point that I think is important is businesses do need to really slow down a little bit more, make sure there are controls in place so we can minimize that privacy, security and risk that is so important in these days. As you know. Dave, it was such a pleasure having you on today and I look forward to speaking with you real soon.

A (10:46)

Yeah, this was a ton of fun. Thanks again.

B (10:49)

Bye for now.