Manage Your AI Security Debt

In this episode of "Full Tech Ahead," host Amanda Razani interviews Nidhi Aggarwal, Chief Product Officer (CPO) of HackerOne. They discuss the paradigm shift in cybersecurity risks caused by AI-accelerated software development. Aggarwal introduces HackerOne’s new continuous threat exposure management platform, H1, designed to bridge the "find-to-fix" lifecycle gap. 

She reveals that following the release of advanced AI models, vulnerability report volumes surged by over 90% in April 2026 alone. This influx has dramatically shortened the "zero-day clock", the time between vulnerability discovery and adversary exploitation, from an average of one month down to mere hours or minutes. 

To combat the resulting 25X spike in critical vulnerability backlogs and build up "exposure debt," Aggarwal emphasizes that organizations must abandon seasonal compliance checks in favor of continuous, AI-driven adversarial pen testing combined with human discernment.

Key Quotes

• "Remediation has not kept pace... most CISOs are not looking for more vulnerabilities. Everybody's inundated with vulnerabilities."
• "The zero day clock... has steadily gone down from it used to be about a month last year to a matter of a few hours now in this year with AI."
• "Defense has to operate at that AI offensive scale... We have a concept called exposure debt... you have to think of it like technical debt or something sitting on your balance sheet."
• "The big advice would be offense is defense. So you have to think offensively."

Takeaways

• Automate Defense at Machine Scale: Since generative AI has driven the marginal cost of cyberattacks close to zero, adversaries can now launch massive, automated exploits in under ten minutes. Security defense can no longer operate at human speed; prioritization and remediation must scale up to match offensive AI.
• Manage Your "Exposure Debt": Unremediated high-risk vulnerabilities function like technical debt on an enterprise balance sheet. Organizations must treat this exposure as a board-level risk conversation and design a continuous drawing-down plan rather than letting critical backlogs accumulate.
• Filter out "AI Slop" via Bifurcation: The explosion of automated AI scanning has altered risk distribution. Security teams are experiencing a bifurcation: they are flooded either with informational "AI slop" (false positives that existing controls block) or hyper-critical zero-days. Rapid automated validation is mandatory to isolate true exposure.
• Shift to Continuous Risk-Based Pen Testing: Move away from compliance-driven, checkbox security architectures. True defensive resilience requires automated, 24/7 white-box and black-box pen testing, paired with the creative adversarial judgment of ethical human researchers using AI.

Find Amanda Razani on LinkedIn.  https://www.linkedin.com/in/amanda-razani-990a7233/

Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/

Visit the FTA website: https://fulltechahead.com/

Check out the Substack Channel: https://fulltechahead.substack.com/

Episode Transcript

SPEAKER_00 (00:19):
Hello and welcome to Full Tech Ahead.
I'm your host, Amanda Razzani,and I'm so excited to be here
today with Nitty Agerwal.
She is the Chief Product Officerof Hacker One.
How are you doing today?
I'm doing very well, Amanda.
Thank you so much.
Thank you for having me.
Yes, happy to have you on theshow.
Can you share first a little bitabout Hacker One and the

(00:41):
services that you provide?

SPEAKER_01 (00:43):
Yeah, sure.
Hacker One is a continuousthreat exposure management
platform, and uh we help uh thebiggest companies to help find
vulnerabilities and validatethem and remediate them.
So it's the find to fix uh lifecycle.
That's uh those are the serviceswe provide.
Wonderful.

SPEAKER_00 (01:03):
Well, our topic for today is AI and software
development and all thecybersecurity risks that are new
and have been introduced becauseof it.
But first, I want to give you achance to share your news.
You recently uh put out a newproduct, so I'd love for our

(01:24):
audience to hear about that.

SPEAKER_01 (01:26):
Sure, thank you.
Yes, we launched our H1platform.
Uh, it is the continuous threatexposure management platform.
And the problem, as you talkedabout, is AI is accelerating
software development andvulnerability discovery, but
remediation has not kept pace.
So, like most CISOs are notlooking for more

(01:49):
vulnerabilities.
Everybody's inundated withvulnerabilities.
In fact, we saw that on ourplatform in April, the report
volume surged more than 90%following the release of all of
these advanced AI models, andthat forced a deliberate
conversation about what qualityactually means on the platform.

(02:09):
And not all AI assisted volumeis equal.
So we had to really validatewhat is true exposure, what out
of these all of these reportsare the kinds of vulnerabilities
that uh represent true exposurefor you, which means that they
can be exploited, and which onesare already stopped by your
security controls.

(02:30):
And then how do you prioritizethem?
And the ones that areprioritized for you, how do you
actually remediate or fix them?
Because that's the real thing,right?
If you are not going to fixsomething, knowing the problem
doesn't solve the problem.
So that's the H1 platform,bridges the gap between finding
the risk and fixing the risk.
That's the defining platform.

(02:51):
And H1 platform is built forcontinuous discovery, validated
exploitability, prioritizedaction, and remediation at AI
scale.
That's what we launched.

SPEAKER_00 (03:04):
Wonderful.
Well, that will certainly behelpful.
And I feel that that is a goodsegue then into that topic.
So, from your experience, whatare some of the newer or more
recent cybersecurity risks orchallenges that business leaders
are facing with the use of AIand software development?

SPEAKER_01 (03:24):
So the whole cybersecurity paradigm itself
was built on the premise that uhuh security vulnerabilities,
once they were discovered, youhad a little bit of time uh
before they could be exploited,and you had time to remediate
them.
But that paradigm itself haschanged with AI.
We have something called thezero-day clock, which means that

(03:45):
that is tracking how much timeuh there is now between when a
vulnerability is discoveredbefore it is exploited.
That time has steadily gone downfrom it used to be about a month
last year to a matter of a fewhours now in this year with AI.
Because the moment it isdiscovered, it can be exploited.
In some cases, there areadversaries who've exploited

(04:08):
vulnerabilities in less than 10minutes.
So that's the scale.
And now you can do it at scale.
Everybody, every adversary whohas an access to a model can try
an attack.
So now you have to try and doyour security defense also at
machine scale.
You cannot operate at human uhspeed.

(04:29):
So now defense has to operate atthat AI offensive scale.
And with uh what we're seeing isthe moment we are in is the cost
of an attack is going down uhfaster and faster.
It's almost coming down to zero.
Meanwhile, the attack surface isalso growing uh really fast
because uh recent surveysindicate that 73% of engineering

(04:52):
teams now use AI coding toolsdaily, and AI-powered security
tools are surfacing thosevulnerabilities.
So now that remediation gap isincreasing.
In fact, on our platform, wepublished this research that uh
even as we are fixingvulnerability, the time to fix
vulnerabilities is gettingfaster.

(05:12):
We can fix vulnerabilities now80% faster.
The critical vulnerabilitybacklog has grown 25x.
That's the gap that uh CISOs andorganizations are facing.
So we need a complete redesignof our security architecture for
this AI era.

SPEAKER_00 (05:34):
Wow.
So what you're sayingessentially too is we've got to
fight AI with AI.
Yes.
Yeah.
So what is the the first placeto start when it comes to better
protection of companies andtheir software and and and their
tools?

SPEAKER_01 (05:52):
So the first place uh to start, I would say, uh, is
do the basics right.
Take stock of what assets do youhave?
Uh, do you know uh what assetsare vulnerable in the sense of
uh uh what is connected to theinternet, what is your attack
surface, what are the thingsthat are uh most important uh to

(06:13):
you?
For example, what are the crownrules?
And that is the first uh placeto start.
Uh do an after doing theinventory for your code, uh have
a static analysis of your code.
Uh do the analysis, what is mycode vulnerability?
It's a defense in-depthapproach.
Then move up the stack and say,how can I now see when this code

(06:34):
is dynamically?
How do I test for that?
Then test it adversarially.
Okay, I've tested itdefensively, but an attacker is
going to use uh is going to testit adversarially.
How do I test it in that motionadversarially?
And do that continuously withAI.
Don't do periodic testingbecause the periodic testing was

(06:54):
maybe quarterly or annually,that speed doesn't work anymore.
And then at the end, you stillhave to have like you do all of
this with AI.
The ultimate test is how do youthink like adversely, who is a
human with powered with AI,right?
There is a human with AI.
That's where the ethicalresearchers, the security

(07:16):
researchers come into play.
The security researchers arealso adopting AI.
On our platform, we see that.
Like a lot of our uh most of ourresearchers are now finding
vulnerabilities using AI.
That's the test.
Like, how are they uh testingyour environment so that
defense-in-depth approach helpsyou protect at multiple layers?

(07:36):
There is no silver bullet.
You have to use AI to scale, andyou have to use human creativity
and discernment to find thenovel and edge cases.
And that those two loops have towork together.

SPEAKER_00 (07:49):
Yeah, the human is still a very important part of
the process.

SPEAKER_01 (07:53):
Yeah.
The human cannot be in thecritical path, but the human is
very important for that uhcreativity and the adversarial
judgment.

SPEAKER_00 (08:03):
Absolutely.
Well, so AI is advancing andit's evolving.
And so, what is the next thingthat business leaders need to be
on the lookout for and preparedfor?

SPEAKER_01 (08:16):
So, business leaders need to be on the uh lookout for
one, the it's not about aparticular model, right?
We hear a lot about this modelor that model, this model has
gotten this capability.
From now on, the models aregoing to get better and better.
We are in an era where mostmodels, uh, right, and open

(08:38):
source models or frontier modelswill have the capability to
discover new vulnerabilities.
So we have to prepare for thatworld.
Um, it's uh uh so we have toprepare for a world where
attacks will come faster,attacks will come at scale, and
it's continuous.
So defense has to be continuous.
This is where to your pointearlier: fight AI with AI.

(08:59):
Prepare for that world where youare defending yourself
continuously, you are testingcontinuously, you are validating
what is actual riskcontinuously, and then you are
prioritizing continuously andthen remediating continuously.
So you can't afford to havecycles where remediation takes
longer and longer, and you arenot uh making security a

(09:23):
priority.
So security becomes aboard-level conversation.
Uh, we have a concept calledexposure debt.
Uh, so the exposure debt is howmany critical high
vulnerabilities are sitting inyour staff that you haven't yet
remediated.
You have to think of it liketechnical debt or something that
is sitting on your balancesheet, and that is the risk

(09:45):
you're taking in the business.
And you have to have plans todraw it down.
And that's the conversation,that's the world we have to
prepare for.

SPEAKER_00 (09:55):
Do you think that it's important to do regular,
like deep dive pen testing tojust test to test and make sure
there's no vulnerabilities?

SPEAKER_01 (10:06):
So when I talk about continuous testing, continuous
testing is uh pen testing.
Okay.
Uh it is AI-driven pen testing,it is uh right, a combination of
human and AI pen testing, andyou have to do both what we call
black box pen testing, which isoutside in, thinking like an
adversary, and then acombination of what we call
white box pen testing, where youhave access to the source code.

(10:29):
So you do it deeper because youknow the context of the code,
and then you can have a muchdeeper analysis of what is the
application trying to do.
So, what are the kinds ofvulnerabilities that you should
remediate?
Uh, so you have to do both ofthose continuously and not do
the pen test as a mechanism forcompliance checkbox, but for

(10:50):
truly security-orientedoutcomes.
You're trying to draw down the,you're trying to manage your
exposure.
So you have to take a risk-basedapproach now versus a
compliance-based approach.

SPEAKER_00 (11:02):
And how has, I know in the past, you know, and
probably still, companies lookat risk and they determine,
okay, can they let this riskslide?
Okay, this risk is moreimportant.
But how has that changed whereit's a little bit more difficult
to say, oh, we're okay with thislevel of risk because, you know,

(11:23):
AI introduces so many differentchallenges?

SPEAKER_01 (11:27):
It has changed because now the number of
critical vulnerabilities thatyou're going to get has risen
up.
What we saw early on with AI wasthere was a lot of what's called
AI slot, which meant that AI wasfinding a lot of
vulnerabilities.
Uh, but when you actually lookedthrough it, uh, most of those
vulnerabilities you couldn'tactually exploit them in the

(11:50):
environment.
Your security rules would have,right?
Your security controls wouldhave stopped them.
Uh, or uh those vulnerabilitieswere low-level vulnerabilities,
they didn't really matter.
They were informational.
But over time, uh, what we'veseen on our platform is almost a
bifurcation.
Either we see vulnerabilitiesthat are false positives.

(12:11):
You can't truly uh exploit them.
Or we've seen some really goodquality vulnerabilities.
Those are critical, they reallyare something you should pay
attention to and remediate uhreally quickly.
So now you have to take thatrisk into account much faster
and do the remediation.
So that's where now you have tohave the ability to identify

(12:34):
that risk much faster,prioritize it, and remediate it
much faster.
So that's how it has changed.
It is no longer that evendistribution of you get a few
vulnerabilities that arecritical, once in a blue moon,
and then the rest are sort ofyour medium grade risk and you
can fix them over time.

(12:55):
It used to be that finding azero-day vulnerability required
a lot of talent, expertise, andfinding that used to be once you
found them, it was like, wow,something big has happened.
Now it's becoming way morecommon.
Right.

SPEAKER_00 (13:12):
Yeah.
Well, if there was one keytakeaway or piece of advice that
you could give to businessleaders in this day and age,
what would it be?

SPEAKER_01 (13:20):
The big advice would be offense is defense.
So you have to thinkoffensively.
You have to get into the mindsetof the adversary and think how
they would be attacking you.
So you have to do continuousdiscovery on your own perimeter.
You have to have continuousvalidation that are you testing
for the right things?
Are you prioritizing the rightthings?

(13:40):
And are you then remediatingthem at machine speed while at
the same time keeping the humanjudgment and discernment in that
process so that you are ahead ofthe adversaries?

SPEAKER_00 (13:54):
All right.
Well, thank you so much forsharing your insights with us
today.
Thank you so much for having me.
And thank you to our audience.
If you have questions about thisor comments, please leave them
and I will try to respond assoon as possible.
And have a wonderful week.