Bugcrowd

But from 2015 to 2020, it was like I was constantly doing something.

Was traveling nonstop to do HackerOne events, Bugcrowd events, or Synack events, was...

When I wasn't doing that, I was just running around doing whatever the hell I wanted to do just because I could.

And it's like, I'm old now.

That's called bedtime, when I get to that stage.

[laughs]

You never know, 'cause 2018, October of 2018 was right in the middle of when I was making the most out of the time that I was doing the, uh, bug bounty stuff full time, and had gone to Vegas for H1702 and Bugcrowd's event and stuff like that.

Got all of that done, and I love gambling, I love Vegas, so I just stayed there afterwards.

It feels like a massive cop-out.

But why do you think major platform gatekeepers, companies like HackerOne or BugCrowd who manage these bug bounty programs, why do they often side with the vendors on this? Why do they reject these AI submissions?

It comes down to a fundamental paradigm shift in how the tech industry defines the word vulnerability.

How so?

I'm on Twitter.

But I'm at BugCrowd.

So bugcrowd.com is how best to find us.

And we're a community company.

And I'm wondering...

You know, what was the genesis for that idea? Was it something along the lines of what you see with like HackerOne or BugCrowd when it comes to bug bounties? Or was it something entirely different based on the fact that, you know, the HackerOne and BugCrowd comparison really isn't one-to-one?

Yeah, so it really isn't, it wasn't anything like HackerOne or BugCrowd.

I think platforms like that have been very successful at, you know, providing incentives and, you know, kind of structure a system for getting people invested in finding vulnerabilities.

And the thing about a traditional, you know, kind of software vulnerability is, well, I found the thing, it either like gets me into the system, like gets me root level access or what have you, or it doesn't.