In this episode, I sit down with Bugcrowd founder and disclose.io co-founder Casey Ellis to discuss what AI is actually doing to vulnerability discovery, bug bounties, and open source security. Casey helped create the bug bounty platform category, and these days he advises and invests through Tall Poppy Group while working deep in security research policy. Few people have a better vantage point on this moment, where AI-assisted findings are flooding intake pipelines that were already struggling.
We chatted about:
Casey’s path from 13 years building Bugcrowd to advising, investing, and policy work
Why more practitioners need to get involved in policy, and Casey’s framing of law as code and policy as a trailing indicator of technology
The “slopdemic” vs. the “vulnpocalypse,” and what actually changed in the submissions hitting bounty and disclosure programs
AI lowering the bar for a broader and less predictable pool of threat actors
Daniel Stenberg’s arc with cURL, and what sustainable vulnerability handling looks like for maintainers below the security poverty line
The lightning rod vs. rockets distinction between a VDP and a bug bounty, and how leaders know which one they’re ready for
The pentest market correction underway from AI pricing pressure
Collapsing OODA loops, planning to fail, hack-back, CFAA reform, SRLDF, and disclose.io
Prefer to listen? Catch the audio on Spotify and Apple Podcasts.
Please be sure to leave a rating and review, as it makes a big difference for the show!
The vulnpocalypse was already here
Casey pushed back on the idea that AI created a vulnerability crisis. As he put it, “the vulnpocalypse was already here, it just sort of wasn’t evenly distributed.” What AI changed is the economics. The cost of discovering vulnerabilities dropped, and the cost of reporting them dropped at the same time, so both signal and noise went up roughly 10x and the delta between them got wider. That gap is the slopdemic.
I think the nuance matters here. CVE volume is on track for somewhere between 66,000 and 100,000 this year, while exploitation has stayed relatively flat. Discovery and exploitation are not the same thing, and Casey noted the cost of chaining bugs into an actual campaign has trailed the discovery work, but not by much. Vulnerability management spent years as the tedious activity nobody wanted to own, and suddenly it is at the center of the conversation again.
Everyone has a VDP, whether they like it or not
We spent a while on Daniel Stenberg and curl, which has gone from drowning in AI slop to drowning in legitimate findings. Casey gave curl full credit for running an incentivized intake program for as long as it did, and pointed out that attaching rewards was already a 10x multiplier on attention before AI arrived. His baseline is blunt. “The reality is that everyone has a VDP, whether they like it or not, they’re just maybe not getting the report.”
He was empathetic toward projects that respond by shutting everything off, but he called it what it is, “ostrich risk management.” That resonates with me. The security technical debt doesn’t go away because we put blinders on, and the maintainers carrying this load are often below what Casey calls the security poverty line, with no triage team behind them.
A lightning rod is not a rocket into a thundercloud
Casey’s readiness test for the VDP versus bug bounty question is simple. A VDP is putting up a lightning rod, anticipating the strike and routing it around damage. A bounty is proactively firing rockets with wires attached into the thundercloud. If your organization can honestly say yes to 10xing your intake, triage, remediation, and patch deployment overnight, you may be ready for a bounty. Most organizations are still struggling with the lightning rod.
He also made a point I appreciated, which is that what a bug is worth to a researcher is a separate conversation from whether a vendor is prepared to receive and act on a report. Being able to take security feedback is, in his words, part of the core social responsibility of being on the internet.
The pentest correction and our value problem
Casey said a correction is already underway in the pentest market, with AI as a big part of the downward pricing pressure because it forces buyers to ask whether they are getting value for money. His less popular theory cuts deeper. “We’ve built a lot of the cybersecurity industry on this idea of selling to people that actually don’t really care.” Buyers with a real risk reduction mandate will pay for value they can see. Everyone else is compression waiting to happen.
This hits on something I’ve long felt about our field. We struggle to communicate the value security provides because we are often trying to prove a negative. The segments of the industry that can’t defend their value are the ones most exposed to this correction.
Policy is where this all lands
We closed on the legal layer. The 2022 DOJ charging policy changes to the CFAA were real progress, but Casey noted that “intent is really difficult to discern at wire speed,” and that problem gets worse as agentic systems and even good-faith hack bots do things that look like exceeding authorized access. The Security Research Legal Defense Fund exists for the cases where a company sues good-faith researchers simply to intimidate them, and disclose.io is building the rules of the road to normalize disclosure at internet scale. Casey even went somewhere uncomfortable, saying that given our current trajectory he doesn’t see us avoiding ideas like hack-back and non-cooperative defense forever.
This is exactly why I wanted Casey on. These look like technical topics, but they carry policy, legal, and economic implications, and we need more practitioners in those rooms.
Big thanks to Casey Ellis for coming back on.
You can follow his work at cje.io, at disclose.io, and on LinkedIn.
