Our AI strategy for preemptive security
Every vulnerability eventually gets found. The question is who finds it first.
For most of this industry’s history, we’ve built security programs to respond. We learn about a weakness through an incident, an outage, help desk load, or a reporter’s phone call, and then we respond. That model was always expensive. Now it’s structurally broken. AI has compressed the time between a published flaw and active exploitation from months to hours, and we’re shipping code faster than any annual assessment can track.
Preemptive security is the answer, and it’s a posture, not a product. It means looking for your own exposure on purpose, continuously, as your environment changes. At Bugcrowd we break it into three moves: avoid unnecessary exposure before release, discover what’s been missed across your attack surface, and validate which vulnerabilities an attacker can actually use.
If that sounds like strategy, it is. Which is why I keep a chessboard in my office (and it’s Bugcrowd orange!).
I use chess with the people I coach and mentor. Chess is a model of warfare, an extension of your will. Cybersecurity is stressful work, and when you put the tension on the table, people start talking openly about how to improve their position. Dani Woolf, CEO of Audience First and long-time friend, and I recently sat down over a game to dig into the parallels. You can watch the full match here.
Go back to the Old West. Wells Fargo built the strongbox because stagecoach robbers kept taking the money. Before that, merchants armed ships because pirates kept boarding them. Security has always evolved in response to an attacker stimulus.
That’s not a weakness to apologize for. It’s a fact to plan around. A good defense understands the offense. A preemptive defense goes further: it actively attacks its own position to find exactly where it’s soft, then decides how to manage it.
In chess, the whole game is the king. In security, the king is whatever must remain impossible: the loss scenarios your business can never tolerate. You can’t defend the king without understanding how you’d be attacked.
Penetration testing became the standard measure of defensive strategy, and for good reason. But we built that cadence for a world that shipped code a couple of times a year.
Today, developers turn caffeine into code and code into revenue, continuously, across hundreds of services. The annual pen test is a once-a-year Christmas card: a lovely picture of where you were at a single point in time. By the time you print and ship that report, it’s out of date.
Most programs at scale test their .com, their store, and whatever the auditor, regulator, or customer requires. Everything else gets light remedial testing or relies on pipeline tooling. That’s not offensive testing. Not meaningful, not adaptive, not creative, and certainly not frequent.
In the land of the blind, the one-eyed human is king. If we’re operationally blind, we can’t defend.
Offensive findings are a lightning rod. They bring clarity on what absolutely must be done. Vulnerabilities are everywhere; vulnerabilities with working exploits demand prioritized attention.
If I hand you a theoretically possible vulnerability and a verified, remotely exploitable one, you already know which you’re patching first. You’re putting out the fire.
This matters because CISOs don’t get to make the risk call alone. We organize the risks, but the decision to accept or mitigate belongs to the business, through the risk committee. Validated offensive findings give that committee an absolute unit of measure for everything else we’ve invested in: developer training, tooling, architecture. The final measuring stick is simple. What’s available to the attacker, and what can they do with it?
One thing I love about chess: you find out right away whether a move was wise or foolish, if you saw the whole picture, or missed something.
Security research doesn’t give us that luxury, so we build it in. Not every bug is a vulnerability. Not every vulnerability is exploitable or repeatable. Not every verifiable vulnerability turns into an exploit. Avoid is the work you did before you shipped. Discover is finding what slipped through. Validate is proving what’s real, so your team isn’t chasing theory.
Here’s the uncomfortable truth from my years doing pen tests in the late 2000s: in the vast majority of them, I wasn’t the first one in. The engagement turned into an incident response the moment we found someone else’s tools. That’s the cost of not seeing the whole board.
During the game, Dani extended her will, I had a piece exposed, and I pulled it back. Sometimes the right move is backward.
In a ransomware event, you’ll roll back patches, segment networks, or take entire environments offline. You’ll decide whether the business can operate degraded while you contain and eradicate. You might blow some SLAs. That’s what a good custodian does.
Despite public opinion, the mission was never “don’t get hacked.” The mission is to make attacking you expensive and dangerous, and to have sacrificial pieces you can trade so you detect quickly, contain quickly, and keep the business online. Two years out, the leaders who win will be the ones who think in systems and architect with failure in mind. While this isn’t new, it’s more important than ever.
I’m excited about AI removing a mountain of toil from security work: the tiring, focus-expensive tasks that burn people out. I’m especially excited about AI learning from your best threat hunters and putting that capability in the hands of your entry-level analysts.
But watch for bias. Decide you’re buying a red Jeep, and suddenly every car on the road is a red Jeep. When FireEye hit the market, a lot of us stopped doing broad security operations and chased malware detonations phoning home. AI-assisted testing carries the same risk. It finds more of what it was trained to find. Are those the only vulnerabilities out there, or just the ones being reported?
It’s Friday afternoon. A product ships Monday. Nobody has pen tested it. Revenue is committed, partners are waiting, and someone has to make the call. Check.
Or it’s hour 30 of an incident and you’re deciding whether to bring systems back online. Nobody makes good decisions on no sleep. Strong incident command sends people home to rest so the next shift can pick up the work. For executives, sometimes the right move is a walk, a workout, or simply touching grass to get distance from the problem.
Chess teaches the same discipline. When you’re under attack, pause. Give yourself grace to think. Do only that which a leader can do.
Evaluating risk through the offensive lens is the most honest, pragmatic measure of everything else we’ve done. It scores and informs every investment decision.
I want every organization to see its whole board: its entire estate, cost-effectively, continuously. When something you couldn’t see before lights up like a Christmas tree, you want to know first, with evidence, while there’s still time to act. And I want to do that in a way that creates value for our customers and for the research community that has always been at the heart of Bugcrowd.
Dani, thanks for the game. Next time, I’ll start with a weaker hand.
Want to see how the game ends? Watch the full conversation. To learn how Bugcrowd helps organizations shift from reactive to preemptive, talk to an expert.