Fixing Software Weaknesses Rather Than Just Finding More Flaws - ASW #398

AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and protect their software. LLMs might be effective assistants in generating code, but only when they have the context of secure patterns to follow. We also talk about what some of the bug bounty data reveals in terms of successful researchers finding more impactful vulns and why the combination of domain expertise and curiosity remains profitable.

Segment Resources
- https://www.hackerone.com/blog/finding-fast-fixing-slow-rising-exposure-debt

Vulnerability discovery and remediation gap in the AI era

AI-generated code is changing how vulnerabilities are created, discovered, and managed. This segment explores why finding more vulnerabilities doesn’t necessarily mean reducing exposure, how teams can validate exploitability and prioritize real risk, and where agentic AI can support defenders without replacing human security expertise. It also looks at what continuous threat exposure management means for enterprise security teams in practice.

Everyone's a Builder Now: Securing the AI-Powered Enterprise: Black Hat Interview with Gil Geron, CEO of Orca Security

AI is fundamentally changing software development, turning employees across the business into builders and reshaping how organizations think about innovation and risk. In this session, Orca Security CEO Gil Geron explores what this shift means for enterprise leaders and why security must evolve alongside the next generation of AI-powered software creation.

Segment Resources:
- https://orca.security/resources/press-releases/orca-security-extends-its-platform-to-the-new-generation-of-ai-builders/
- https://orca.security/platform/ai-appgen-security/

This segment is sponsored by Orca Security. Visit https://securityweekly.com/orcabh to learn more about them!

Bugcrowd Launches Pathseeker: Flipping the Script on Traditional Pentesting: Black Hat Interview with Braden Russell, CTO of Bugcrowd

Bugcrowd is launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line, which combines continuous agentic pentesting with on-demand human validation. The launch comes as the security industry grapples with a growing "AI slop" problem, where unchecked AI-generated vulnerability reports have overwhelmed bug bounty programs and even forced some, like Curl, to shut theirs down. Braden will unpack how Bugcrowd is positioning Savant Pathseeker as a response to that industry-wide trust problem, not just a new product launch.

Segment Resources:
- https://www.bugcrowd.com/products/pathseeker/
- https://www.bugcrowd.com/press-release/bugcrowd-introduces-savant-pathseeker-delivering-continuous-agentic-pentesting-across-the-attack-surface/
- https://www.bugcrowd.com/products/platform
- https://www.bugcrowd.com/products/ai-powered-security-intelligence/

Apply for early access at https://securityweekly.com/bugcrowdbh

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-398

00:00:00 Halting Problem, HackerOne's Mission, and Growing Vulnerabilities
00:02:44 Outpacing Vulnerabilities with Systemic Bug Class Elimination
00:07:53 Balancing Mitigation with Faster, Contextual Remediation
00:16:30 How AI and Data Drive Impactful Bug Bounty Findings
00:30:57 Defining Machine Speed in Security Operations
00:37:16 Bugcrowd's Agentic Offensive Testing with Human Insight
00:41:15 Accelerating Vulnerability Detection with AI Copilots
00:46:40 Overcoming Tech Debt with Continuous Internal Network Testing
00:52:37 Securing the Enterprise as Everyone Becomes a Software Builder
00:58:10 Adapting Security for New Builders and Episode Conclusion