[00:05.210 --> 00:06.050]  All right.
[00:06.050 --> 00:07.790]  Thank you, everybody, for joining us today.
[00:07.790 --> 00:15.890]  And I would like to thank HackerOne not only for sponsoring the Red Team Village this year, but you have been a very, very good partner throughout the years.
[00:15.930 --> 00:18.430]  So thank you for your support.
[00:18.510 --> 00:23.370]  And with that said, I'm going to pass it to my colleague, Greg, to ask you a couple of questions.
[00:27.170 --> 00:27.570]  Hey, Dane.
[00:27.570 --> 00:31.290]  Thanks again for sponsoring the Red Team Village.
[00:31.290 --> 00:35.990]  We only have three or four hundred questions that we're going to go over with.
[00:35.990 --> 00:37.130]  No, I'm kidding.
[00:37.170 --> 00:45.350]  So for the thousands and thousands of viewers that we don't have, if you would tell us a little bit about you and what you do for HackerOne.
[00:45.670 --> 00:46.570]  Yeah, happy to.
[00:46.570 --> 00:49.850]  I'm very happy to be here and glad to be supporting Red Team Village.
[00:50.230 --> 00:54.790]  First off, my name is Dane Sheritz, and I'm a senior solutions architect with HackerOne.
[00:54.970 --> 01:07.190]  As a solutions architect, I serve on the security advisory team and help our customers improve their security posture with our platforms and services, with a focus on working with the hacker community.
[01:07.270 --> 01:11.350]  And in my free time, I also enjoy doing some bug bounty hunting a bit myself.
[01:11.710 --> 01:12.690]  That's awesome.
[01:12.690 --> 01:19.190]  So why does your company believe that the Red Team operations that everyone does is so important in the industry?
[01:19.730 --> 01:20.130]  Yeah.
[01:20.130 --> 01:30.510]  So in general, I think any kind of adversarial type of testing is essential for organizations once your assets reach a certain level of security maturity.
[01:30.690 --> 01:38.110]  It's having those SAS, DAS, security scans, and the compliance-focused pen tests are important for hardening your attack surface.
[01:38.250 --> 01:46.430]  But at a certain point, you're going to need that weaponized curiosity of skilled hackers to find novel and elusive bugs in your assets.
[01:46.590 --> 01:57.030]  And when you have a well-run bug bounty program, specifically, you're going to find unique vulnerabilities that are much more similar to what an adversary would exploit in the real world type of attack scenario.
[01:57.610 --> 01:58.410]  That's so true.
[01:58.410 --> 02:06.730]  And I've got to ask, because it's all the rage, with AI shaking up the industry, how is it affecting you and your industry?
[02:06.870 --> 02:11.530]  Yeah, it's impossible to make it through a talk without talking about AI these days, right?
[02:12.070 --> 02:23.850]  So really, when I think about the AI of today, I'm not going to talk about 10 years, 20 years down the line, but the AI of today, there's typically three groups I think about as it relates to cybersecurity.
[02:24.230 --> 02:27.350]  It's the attackers, defenders, and implementers.
[02:27.350 --> 02:33.690]  So attackers, I'm typically talking about bug bounty hunters, pen testers, red teamers, etc.
[02:33.750 --> 02:45.210]  I'll start by saying I think we're a long way from AI fully replacing the attacker, but I think today it's already incredibly helpful as an assistant or a helper, right?
[02:45.210 --> 03:07.290]  For doing things like generating payloads, generating word lists, helping you understand code in maybe a language you don't already know, for writing code and quickly spinning up some TLCs, and for report generation, I think it's also pretty helpful, especially for some hackers in our community that English might be their second language and they're reporting vulnerabilities to a primarily English-speaking team.
[03:07.290 --> 03:13.670]  I think that there's a lot of value in using AI for those kinds of cases.
[03:14.070 --> 03:29.630]  For defenders, I mean, I think it's just impossible to overstate how impactful it's going to be as we have tools to quickly sift through the mountains of data that come in when dealing with incidents or responding to things that come through a SOC.
[03:29.630 --> 03:39.470]  Now you're looking at the simplicity of the logs that Windows generates, yeah, because they're so small, especially, anyway, no.
[03:39.470 --> 03:44.150]  But how does your company see red teaming evolving and making impact?
[03:45.090 --> 03:59.110]  Yeah, so really when I think about how it's going to make an impact, I'm going to keep my answer focused on the bug bounty world, but I think there's going to be an evolution in what is tested and how it's tested.
[03:59.410 --> 04:13.710]  So starting with what is tested, I think today a lot of programs might put their web app or mobile applications in scope, and maybe sometimes they'll allow for all subdomains of a given domain to be in scope as well.
[04:13.770 --> 04:19.110]  But philosophically, does that fully capture your entire attack surface?
[04:19.350 --> 04:25.790]  I think as bug bounty evolves, we'll start to see the concept of scope evolve as well.
[04:26.370 --> 04:33.530]  And we're already seeing today that the more mature a customer becomes, the more they treat their brand as part of their scope.
[04:33.790 --> 04:39.270]  So these customers treat anything that could impact the trust of users as something that they'd want to defend against.
[04:39.590 --> 04:50.010]  So this could look like them paying more for vulnerabilities further down in their supply chain, or a video game company paying for hackers for bypassing some of their anti-cheat implementations.
[04:50.390 --> 04:55.310]  We see a little bit of this today, but I think it's going to become a little bit more widespread as the years go on.
[04:55.870 --> 05:01.530]  And I think we're also starting to see organizations wanting to work with hackers further left in their SDLC.
[05:01.670 --> 05:09.370]  So having people find bugs in code before it's pushed to production, and it's something we try to help facilitate with our code review products.
[05:09.610 --> 05:18.770]  But generally speaking, I think there's going to be a desire for organizations to have folks with a hacker mindset help them in ways that are different than what organizations have done in the past.
[05:19.370 --> 05:27.870]  Going on to the how it's tested piece, I think as scope evolves, so will the tools and techniques that hackers use to find vulnerabilities.
[05:28.090 --> 05:37.490]  So I gotta say, working at HackerOne, it's really fascinating to see the kind of recon arms race that has been happening with recon automation setups over the years.
[05:37.490 --> 05:47.270]  And I think as compute is getting cheaper, becoming more widely available, it's making me pretty bullish on the kind of vulnerabilities and assets hackers are going to be able to find.
[05:47.590 --> 06:00.490]  And going back to the AI piece here, I think it's often been the case that you could be really recon data rich, but insights poor, but AI and LLMs change all that.
[06:00.490 --> 06:04.050]  Now everyone has their assistant that can help them code.
[06:04.810 --> 06:16.590]  Yeah, I think that HackerOne is an invaluable service to companies that you really want to... it's worth paying a little bit as you go as opposed to being in the news and costing yourself a fortune later on.
[06:17.090 --> 06:25.090]  So you have any words to all the thousands of red teamers watching that you might want to suggest or advise, or especially if they ever come to work for HackerOne?
[06:26.290 --> 06:36.210]  Yeah, so I think that the main piece of advice for hackers, red teamers, anyone in general is staying curious, right?
[06:36.210 --> 06:41.570]  I think as technology is constantly evolving, so are the vulnerabilities.
[06:41.830 --> 06:55.370]  So whether it's learning more about GraphQL, smart contracts, LLMs, I just encourage everyone to poke around and build things and break things and just kind of always try to stay ahead of the attackers.
[06:55.890 --> 07:01.930]  And I mean, anyone that's watching this today can start working with HackerOne by signing up and becoming a hacker on our platform.
[07:02.210 --> 07:03.850]  It's really quick and easy.
[07:03.850 --> 07:15.050]  And at least even without logging in or creating an account, you can check out our activity page and see some of the really cool types of vulnerabilities hackers in our community are finding every day.
[07:15.830 --> 07:17.310]  And that's HackerOne.com.
[07:17.310 --> 07:19.790]  I'm a proud member, I must say.
[07:19.870 --> 07:20.530]  Very cool.
[07:20.550 --> 07:22.230]  I do love the HackerOne.
[07:22.550 --> 07:28.290]  So what do you think about the importance of sponsoring community-driven villages like the RTV?
[07:29.170 --> 07:34.630]  Yeah, I mean, at the end of the day, we're a platform with a two-sided marketplace, right?
[07:34.630 --> 07:40.230]  So we obviously have our customers, but the other half of that marketplace is the hackers.
[07:40.390 --> 07:45.490]  And that's why we're really proud and excited to sponsor community-driven events like Recon Village.
[07:45.490 --> 07:50.410]  And you know, we want to give back to the community and help them in their journey as they grow their skill set.
[07:51.190 --> 07:51.970]  Yeah, that's awesome.
[07:51.970 --> 07:56.030]  Do you have any final words before we wrap this one up?
[07:56.030 --> 08:02.530]  Well, yeah, I would just say we're helping out with a number of events this DEF CON in Black Hat.
[08:02.530 --> 08:09.670]  We had a Black Hat session on AI at a booth there, both Wednesday and Thursday.
[08:09.870 --> 08:16.390]  We will also be hosting a hands-on hacking workshop with Meta at the Red Team Village on Saturday morning.
[08:16.530 --> 08:24.330]  And we are also co-hosting an AI and policy happy hour at the Policy Village on Friday evening.
[08:24.390 --> 08:28.590]  And I'll also be at the conference, so if you see me around, please say hey.
[08:29.270 --> 08:31.170]  Well, I'll be in the village.
[08:31.170 --> 08:33.130]  So yeah, you won't be able to miss me or Omar.
[08:33.130 --> 08:36.050]  We'll be the strange guys pointing at stuff.
[08:37.630 --> 08:38.670]  That's awesome.
[08:38.670 --> 08:39.410]  Excellent.
[08:39.510 --> 08:45.890]  So once again, Dane, on behalf of the DEF CON Red Team Village, I want to thank you from the bottom of my heart.
[08:45.890 --> 08:50.230]  Thank you, HackerOne, for supporting us throughout the years.
[08:50.230 --> 08:57.310]  Our village has been very successful throughout the years, and it would have been possible definitely without your support and commitment.
[08:57.650 --> 09:04.570]  So before I lose my voice, thank you again, everybody, for tuning in, and I'll hope to see you next week in Vegas.
[09:04.710 --> 09:06.350]  Yep, we'll see you at DEF CON.