Our AI strategy for preemptive security
Almost 15 years ago, Bugcrowd launched with a simple idea: Put enough good hackers on a problem and they’ll find what the scanners and the once-a-year pen test missed. It worked. It leveled the playing field between offense and defense, built a category and, I’d argue, changed how many security teams think about who gets to find their bugs.
Over the last few years, though, I’ve been watching something shift underneath all of it. The arc is the move from reactive security to preemptive security, and AI is changing the field again as the contest shifts between good agents and bad ones.
When teams take a reactive approach to security, they are inherently playing from a disadvantage. Teams find out about a vulnerability the hard way: through an incident, an outage, or even a reporter. Most security budgets are still built around that model, and I understand why. It’s easy to justify spend on a problem that already happened, and much harder to justify spend on something hypothetical.
AI changes the math. Exploit windows that used to be measured in weeks are now under a day in some cases. LLMs are writing real code and finding real bugs, and the researchers on our platform use them every day to move faster.
The thing is, finding bugs was never the whole job. When Dr. David Brumley’s team won DARPA’s Cyber Grand Challenge with Mayhem Security, what impressed me was that the system found vulnerabilities, proved they were exploitable and patched them, autonomously, with the clock running. Most of the AI conversation today still stops at the first step; knowing which findings an attacker can actually use, and having proof you can hand to an engineer at 4pm on a release day, is where it gets hard.
There have been millions of vulnerabilities submitted on the Bugcrowd Platform over the years. Every single one of these vulnerabilities started somewhere. And every single vulnerability eventually gets found.
The question is by whom.
If an attacker gets there first, you learn about it through impact. If your team gets there first, you get time, and you get to decide what happens next. I’d rather my customers hear it from us, even when it’s bad news, and I suspect most of them would too.
There’s a cost to getting this wrong, and we’ve watched it play out over the past year. cURL shut down its bug bounty because AI-generated junk was burying the legitimate reports. That’s a serious, widely used project walking away from offensive testing because the signal disappeared. On our own platform we’ve put mandatory identity verification and submission throttling in place, and we’ve banned accounts that were farming submissions. Ultimately, a VDP without operations is just an inbox, and in an AI world that inbox fills up fast.
To find the vulnerability first and sift through the noise, teams must shift away from a calendar, with periodic tests and findings scattered across tools. Exposure doesn’t wait for the annual pen test. Leaders need to know what can actually be exploited, with evidence, early enough to act before risk becomes impact.
Bugcrowd enables teams to shift towards preemptive security so leaders can see risk while it’s still manageable.
It may seem like semantics, but the distinction is important. Crowdsourcing the world’s best hackers changed how organizations find what automated tools and one-off tests miss. But crowdsourced security is a method.
Preemptive security is a posture or strategy. It means looking for exposure on purpose and continuously, as your environment changes.
Gartner projects that by 2028 more than 60% of enterprise pen test programs will run as continuous validation inside DevSecOps pipelines, with that replacing the annual assessment as the primary way organizations prove resilience. I think that’s conservative.
The Crowd is still at the center of how we do this, because our hackers find things no model would think to look for. They’re now working alongside AI agents and pentesters, with asset context and telemetry underneath, and our job is pulling all of that into one view that tells a team where to act first and backs it up with evidence.
So how does a company actually approach a preemptive security strategy? I’ve had many conversations with customers over the years, and the insights from these conversations helped us develop a three-pronged framework: Avoid, Discover, and Validate.
Hackers, agents, pentests, assets and telemetry each see part of your exposure. Savant, Bugcrowd’s AI, connects them into one view, validates the risk with evidence, and shows your team where to act first.
The result is being first to know. You hear it before an attacker, an auditor or the news does. You get evidence that shows what can be exploited and what to fix first.
Building and sustaining that advantage is hard. That’s the gap Bugcrowd closes. It takes continuous discovery, human and AI validation, and one place where the signals come together, so you’re never relying on a single test, a single tool or a single point in time.
Every vulnerability starts somewhere. When you can see how it starts, you have a chance to change how it ends.
That’s the moment a vulnerability becomes an advantage. Bugcrowd reveals what can actually be exploited while there’s still time to act.
15 years ago, Bugcrowd built the crowdsourced security category, and we’ve never stopped building since. I’m excited to continue our legacy as we move into our next chapter, and more importantly, help our customers shift from reactive to preemptive.