Casey Ellis
Needle problem? Just drop a haystack on it
AI cut the cost of sending a submission to almost nothing, so signal and noise both went up by a factor of ten. The triage queues were built to never miss, and that's exactly what's breaking. Some empathy for triagers, a bit of ownership, and what I'd actually change.
Systems, not bugs
The folk doing really cutting-edge vulnerability research right now: if you peel the paint off how they're doing it, it'
Security is an afterthought, and that's economics
There are some black pill truths around security (the "nothing's ever going to change" kind) that need to be reconciled.
I can just do stuff
Personally, I'm hacking on stuff again. With AI in the toolkit it feels kind of like the early 2000s in some ways:
The law matters less than the legal team
I'm not a lawyer, and if I was, I'm not your lawyer. With anti-hacking laws there's a
The hackers weren't lying
A lot of what's actually happening right now is people realizing that, no, the hackers weren't lying this whole time.
Fixing everything is a fool's errand
Vulnerability management is a bit of a fool's errand if your goal is to make sure that everything's fixed. We&
Root is the product
For those of us on offense, root (full control of the target) is the product. If we're just doing pure offense, that&
We think like that because we're like that
People in security greatly overestimate the ability and the propensity for people to think like bad guys in the way that we do. We
![Title slide: Don't be the tooling, build the tooling. Casey Ellis, [un]prompted.au, Sydney 2026, on a purple disclose.io background.](https://storage.ghost.io/c/ec/8a/ec8abb38-39b9-4422-95b9-695b2a5e652e/content/images/size/w240/2026/09/dont-be-the-tooling-build-the-tooling-header.png)
Don't be the tooling, build the tooling: [un]prompted.au talk
Slides from my [un]prompted.au talk on using AI to build deterministic tooling, with lookup.disclose.io as the worked example.
You don't kill a bug by finding it
I've never really believed that you just kill a bug by finding it. This is the guy who started Bugcrowd, so I
AI and bug bounties: notes from 68 minutes on Across the Pondcast
68 minutes with Tib3rius and Andy Swift on Across the Pondcast, cut down to the salient points and timestamped: how Bugcrowd started, what AI has actually done to bug bounty, why a VDP is the sane fallback, and where researchers should point next.