Surviving and thriving in the AI Vulnpocalypse

Katie Moussouris on AI's Vulnerability Deluge, Bug Bounties, and Smart Regulation

In this Cybersecurity Today on the Weekend feature interview, host David Shipley interviews cybersecurity entrepreneur and long-time hacker Katie Moussouris about today's surge in AI-driven vulnerability discovery and the growing strain on disclosure and patching ecosystems.

Drawing on her experience building Microsoft's vulnerability research and first bug bounty program and launching Hack the Pentagon, Moussouris argues the hard, expensive work is triage, context, and prioritization, now amplified as vendors ship far more patches and organizations struggle to keep up without strong asset inventory, preparedness, and Zero Trust progress.

She warns AI model capabilities are outpacing monitoring and containment, especially with open-weight models, and says regulation should focus on requirements like real-time monitoring without harming defenders.

The conversation also covers the reemergence of the old tool-access debates, Microsoft's clash with researcher "Nightmare Eclipse," the rise-and-fall of "security civilizations," Luta Security's work improving internal maturity, concerns about shrinking entry-level talent pipelines, and a closing call to consider universal basic income as part of our strategy to deal with AI's impact on the world.

00:00 Weekend Show Intro
00:07 Katie Moussouris Background
02:00 Bug Bounties Then and Now
03:31 AI Hype and Model Escapes
05:06 The Real Cost of Fixing
08:36 Smart AI Regulation
12:34 Tools for Defenders vs Rogues
15:53 Metasploit and Agentic Risk
17:25 Nightmare Eclipse and Microsoft
21:53 Luta Security Today
24:28 Training the Next Generation
27:46 Hope, UBI, and Wrap Up