Dave Gerry

Security teams already drown in vulnerability data, but they're missing the context that makes the difference between a triaged backlog and an actual decision. Today, @Bugcrowd announced Savant - the AI fabric of the Bugcrowd Platform - and with it, the ability to deliver actionable results across appsec, bug bounty and vdp, red-teaming or pentest results in a single platform. You'll see Savant across many of our current products and future releases: - Savant Vista (formerly Asset View), helps teams understand what’s exposed. - Savant Triage (formerly AI Triage Assistant), validates and prioritizes findings faster, cutting through noise so teams focus on what’s real. - Savant Analytics (formerly AI Analytics), surfaces patterns across program data and supports clearer, more confident reporting. - Savant Match (formerly CrowdMatch), activates the right hackers and connects them to customers for better results over time. - Savant Forge (formerly Mayhem Code Security), supports autonomous testing for code. - Savant Probe (formerly Mayhem API Security), supports live API testing. - Savant Runtime (formerly Mayhem Dynamic SBOM), adds context from running software. bugcrowd.com/blog/savant-bug…

Well, it’s been an interesting 24 hours to watch this play out and there’s been a lot of conversation about using submission data for training. I want to be very clear on Bugcrowd’s position. Hackers are and continue to be the heart of @Bugcrowd. We are a part of the community and value the work the researcher community does to help customers identify vulnerabilities. AI is here to stay and will play a large role in cybersecurity going forward. However, that doesn’t change our commitment to the hacker community. We’ve been exploring ways to bring hackers along for the journey - not replace them with AI - and have been working in conjunction with members of the community, our own team & our Hacker Advisory Board to figure out the right way to incentivize and monetize AI-driven products for the hackers contributing. We won’t get everything right, but you have our commitment to be transparent as we strive to get this right and chart a path towards a human+AI future.

We've heard it from customers across the EU for years: they want access to the @Bugcrowd Platform for the global researcher community, world-class triage capability, & AI-augmented and autonomous testing, but the vulnerability data has to stay in-region. Previously an EU data residency requirement meant they had to choose other niche local providers which met some, but not all of their needs. On the heels of our FedRAMP authorization, today, we launched the EU Data Residency Option which runs in @awscloud Frankfurt, generally available July 1. bugcrowd.com/press-release/b…

Most AI security training stops at detection. That’s pattern matching, not skill. We just launched RL Environments at @Bugcrowd. Hundreds of thousands of real open-source vulnerabilities. Find, exploit, patch, audit. The full loop. Frontier labs are already training on them. prnewswire.com/news-releases…

Exciting new research from @thedavidbrumley and Seunghyun Lee: ExploitBench, the first benchmark measuring how far AI models climb the exploitation ladder. Not "did it find a bug," but "could it weaponize one." On V8, GPT-5.5 bypassed the sandbox ~50% of the time and hit full code execution on two vulnerabilities. Mythos went further than published human experts on several CVEs. Public frontier models are past crash-finding. They are exploit-development accelerators, and, that should change how you think about patch priority. Through our acquisition of @MayhemSec, @Bugcrowd builds the RL environments that teach models these skills. bugcrowd.com/blog/ai-benchma…

Fun chatting with @angusloten from @WSJ about the impact of Mythos (& AI more broadly) on the bug bounty space. tl;dr vuln detection is becoming easier with AI, human researcher's aren't going away, and the hard part now is prioritization and triage. wsj.com/pro/cybersecurity/my…