Fixing Software Weaknesses Rather Than Just Finding More Flaws - Gil Geron, Nidhi Aggarwal, Braden Russell - ASW #398
Summary
Niti Agarwal, CPO at HackerOne, discusses how AI has exploded vulnerability discovery, creating a critical "exposure debt" that outpaces remediation efforts. She advocates for shifting from individual bug fixes to systemic bug class elimination and secure-by-design practices to address root causes. The episode highlights the need for continuous loops of discovery, validation, and remediation, emphasizing that while AI accelerates defense, human creativity remains essential for finding complex, high-impact vulnerabilities.
Topics discussed
Intro: Halting problem, episode 398, and All Access Pass
Guest introduction: Niti Agarwal of HackerOne
The shift from finding vulnerabilities to fixing them
Exposure debt: The compounding backlog of critical vulns
Systemic bug class elimination vs. whack-a-mole
AI as a force for good in defense and remediation
Researchers enabling systemic remediation and context scaling
The continuous loop: Find, validate, remediate, retest
Anti-patterns and the limits of 'do not do this' lists
Organizational trade-offs: Mitigation vs. remediation speed
Secure documentation and contextual training for teams
Why do vulnerabilities keep happening? Pattern analysis
The role of researchers in the AI era: Sophistication
Getting started: Economics and domain expertise for newbies
Community, mentorship, and the spirit of bug bounties
Machine speed: Human judgment in automated defense
Sponsor: ThreatLocker and Black Hat 2026 coverage
Guest intro: Braden Russell of Bugcrowd and PathSeeker
AI pen testing: Human creativity vs. trained models
Guardrails, EASM, and the gap in LLM-generated code
Proof of exploitation and universalizing vulnerability reports
Customer drivers: Continuous testing and prioritization
The 'fix it' button: Integrating security and dev teams
Mitigation strategies and post-exploitation mapping
Prompt injection in pen testing and tech debt outlook
Guest intro: Gil of Orca and the 'everyone is a builder' shift
Shadow AI, data access, and the mesh of infrastructure
Security team strategies: Blocking vs. enabling AI devs
Agent-based remediation and developer adoption
Finding vibe coders and expanding appsec coverage
Maturity of AI security and closing thoughts
Listen ad-free on Castria