No Trust Podcast: Trey Ford – From Blackhat to AI:How CyberSecurity is Changing

In this special edition of the No Trust Podcast, recorded in Las Vegas during Black Hat, Jaye Tillson and John Spiegel sat down with Trey Ford from Bugcrowd to talk about the changing cybersecurity industry, the impact AI will have on software security, and what security professionals need to learn as traditional career paths begin to change.

Trey has seen more than a few changes during his career. He started out working for an ISP in the early 1990s before moving through penetration testing, web application security, compliance, and conference leadership. Today, his work at Bugcrowd focuses on strategy and trust around offensive security research, including vulnerability disclosure, bug bounty, red teaming, and penetration testing.

That experience made for a conversation that moved naturally between where the industry has come from and where it might be heading next.

Listen Here - - https://on.soundcloud.com/1axJVpPHIb3ZMuIwd1

Black Hat: The People Matter as Much as the Talks

Trey has been involved with Black Hat for almost two decades, as a speaker, trainer, vendor, general manager, and review board member. In that time, he has watched cybersecurity grow from a relatively small industry into the enormous commercial ecosystem visible on the Black Hat show floor today.

For anyone trying to navigate that environment, his advice is to start by understanding why you are there.

Some attendees want to learn about a particular technology. Others have been sent by their employer to return with something actionable. Some are looking for their next career move. Whatever the objective, Trey recommends having a plan without scheduling every minute of the week.

His phrase for this is to “weaponize serendipity.”

Choose the talks you really want to attend, but do not focus exclusively on what happens on stage. Pay attention to the people asking questions, the conversations outside the room, and the communities forming around particular areas of research.

Those hallway conversations can be where much of the real value of a conference emerges. You meet people solving similar problems in different companies, industries, and countries. Those connections can become future colleagues, thought partners, or friends.

Black Hat is also an opportunity to challenge assumptions about your own career. Talk to people doing jobs you might want to do in two or three moves' time and ask how they got there. The product manager may have started as a sysadmin. The executive may once have been a developer or network engineer. There is rarely one prescribed route through cybersecurity.

AI Is Accelerating Everything

It did not take long for the conversation to turn to AI.

Walk around almost any cybersecurity conference today and AI appears everywhere. Trey is less interested in the label than in the underlying capability.

AI gives us the ability to perform certain types of work at machine speed. That is powerful, but it comes with an obvious catch: we can also make bad decisions at machine speed.

The technology is improving rapidly. AI-generated code has moved from being unreliable toward becoming genuinely useful, and Trey expects that progression to continue. Developers may increasingly spend less time manually producing code and more time directing, reviewing, and product-managing what AI creates.

Longer term, that could produce better software.

Getting there could be painful.

Trey expects the next 18 to 36 months to bring a substantial increase in vulnerabilities as organizations dramatically increase the amount of software they produce with AI assistance.

More code means more attack surface. Even if the average quality of AI-generated code improves, the sheer volume being created creates more opportunities for vulnerabilities to enter production.

At the same time, AI will increasingly be used to find those vulnerabilities.

That means both sides of the equation are accelerating.

The Vulnerability Window Is Shrinking

Security teams already face a difficult patching problem. The period between a vulnerability being discovered and a working exploit becoming available has compressed dramatically.

AI has the potential to reduce that window even further.

That leaves organizations facing an uncomfortable choice. Do you patch extremely quickly and risk deploying a change that has not been sufficiently tested in your environment, or do you wait and leave a known vulnerability exposed for longer?

For organizations operating critical or 24/7 services, that is not a theoretical problem. Downtime has to be negotiated, patches have to be tested, dependencies understood, and availability commitments maintained.

Trey believes the bigger concern may ultimately be vulnerabilities in widely used software libraries. When a library used across hundreds of applications is found to be vulnerable, the first challenge is simply understanding where it exists.

That is where software bills of materials and dependency visibility become increasingly important. Security teams need to be able to answer questions such as: Are we using this component? Which applications depend on it? Is it exposed? And how quickly can we fix it?

More Vulnerabilities — and More Noise

AI is also changing vulnerability research itself.

It has dramatically lowered the barrier to creating vulnerability reports and proof-of-concept exploits. The problem is that lowering the barrier does not necessarily increase the number of people who genuinely understand what they have discovered.

Open-source maintainers and vulnerability disclosure programs can therefore receive AI-generated reports that look credible but cannot be reproduced by the person submitting them.

Trey described this as a combination of “slop” and a genuine step change in vulnerability discovery.

That distinction is important. Security teams are not simply facing more noise. They are potentially facing more noise andmore legitimate vulnerabilities at exactly the same time.

For organizations managing their own bug bounty or disclosure programs, filtering those two populations becomes another significant operational burden. Part of the value of platforms such as Bugcrowd, Trey explained, is providing that intermediary layer between organizations and the researcher community.

Can AI Eventually Make Software More Secure?

Despite predicting a difficult few years, Trey is optimistic about the longer-term direction.

AI is getting better at writing code, but it is also getting better at attacking and defending software. If those capabilities continue developing together, we could eventually reach a point where AI-assisted development produces increasingly secure code while automated testing continually challenges it.

The key is the check-and-challenge process.

Trey used flying as an analogy. When the autopilot in his small aircraft is working correctly, it is smoother and more precise than he is. But the important part of that sentence is when it is working correctly.

The same applies to AI.

Organizations may use multiple agents to perform different jobs and check each other's work, but humans still need to provide the sanity check. Are we heading in the right direction? Has something been missed? Is there bias in the data or assumptions? Does the result actually make sense?

The future is therefore less about AI replacing humans and more about deciding which jobs machines should perform and where human judgment remains essential.

Stop Fixing Vulnerabilities One at a Time

One of the most interesting possibilities discussed in the episode is using AI to change how vulnerabilities are remediated.

Today, security teams often operate vulnerability by vulnerability. A weakness is discovered, somebody proves it is exploitable, a ticket is raised, a developer fixes it, and everyone moves on.

That model becomes difficult to sustain if vulnerability volumes increase dramatically.

Instead, Trey believes organizations need to think systemically.

If one remotely exploitable vulnerability is discovered, could AI find every other place where the same vulnerable pattern has been reused? Could it identify a common library, reference architecture, or development practice responsible for an entire class of problems?

The goal changes from fixing a vulnerability to eliminating the conditions that repeatedly create that vulnerability.

That requires a different type of thinking from security professionals.

What Happens to the Cybersecurity Career Ladder?

This led to one of the biggest questions of the episode: what happens to people trying to enter cybersecurity?

Historically, many professionals learned their craft through operational jobs. Help desk roles, networking, systems administration, and SOC positions provided places to build foundational skills before moving into more advanced engineering or security roles.

AI is particularly well suited to reducing the repetitive work associated with some of those entry-level positions.

If those jobs shrink, where do future senior engineers and security architects gain their experience?

Trey believes the answer lies partly in putting greater emphasis on systems thinking, architecture, troubleshooting, and debugging.

Modern applications rarely exist in isolation. They consist of networks, APIs, identities, libraries, cloud services, repositories, and potentially hundreds of microservices. A single vulnerable condition could emerge from the interaction of multiple systems and require changes from several different teams to resolve.

Someone needs to understand that bigger picture.

Learn the Fundamentals

Jaye raised a related concern: are people entering the industry today missing some of the fundamentals that earlier generations were forced to learn?

Many experienced security professionals built computers, configured networks, learned TCP/IP, and figured out how packets moved from A to B because there was no easy abstraction available to them.

Modern developers can build extremely capable applications without necessarily understanding what is happening beneath the application layer.

Does that matter?

Trey's answer was that it depends on the career somebody wants, but the best specialists usually have a strong general foundation.

He would still encourage people to spend time in IT, understand networking, learn to troubleshoot, and build empathy for users. Security professionals need to understand not only the technology they are protecting but the organizations and people that technology exists to serve.

The industry's job is not simply to find vulnerabilities. It is to help organizations deliver their products and services efficiently while managing risk and minimizing disruption.

That broader perspective becomes increasingly valuable as AI takes over more tactical tasks.

Cybersecurity Needs More Systems Thinkers

Trey also questioned whether cybersecurity has become too focused on specialization.

There will always be a need for people with extremely deep technical expertise, but the industry also needs practitioners who can move between different disciplines and understand how they connect.

When vulnerability volumes are manageable, teams can spend time proving and fixing individual issues. If AI produces the vulnerability wave Trey expects, that approach becomes increasingly difficult.

Security professionals will need to look for patterns.

Are these vulnerabilities coming from the same stack? The same architecture? The same library? The same development team? Is there a larger problem that can be fixed once instead of hundreds of times?

Those questions require people who can step away from the immediate ticket and understand the system.

That may ultimately be one of the most durable cybersecurity skills in the AI era.

And Finally: Surviving Black Hat

As any good No Trust conversation should, the episode eventually moved from AI and vulnerability management to Las Vegas restaurants, steakhouses, sushi in the desert, and the divisive subject of chicken and waffles.

But Trey also had some serious advice for anyone attending Black Hat.

Prioritize wellness.

Black Hat is a marathon. The days are long, Las Vegas is brutally hot, conference rooms can be freezing, and the endless combination of meetings, dinners, parties, and networking can quickly wear people down.

Hydrate, eat properly, exercise, sleep, and be selective about the events you attend.

Sometimes the best networking opportunity is not the biggest party. It is a quiet dinner with a handful of people where you can actually have a conversation.

There is also a career lesson hidden in that advice. The people you meet at Black Hat could become future colleagues, employers, customers, partners, or lifelong friends. Vegas may encourage people to believe that what happens there stays there, but professional reputations tend to travel.

Trey's advice is to play the long game.

The Bigger Picture

Perhaps the biggest takeaway from the conversation is that AI does not make cybersecurity fundamentals less important. It may make them more important.

AI will write more code. It will find more vulnerabilities. It will help remediate more vulnerabilities. It will automate work that people previously spent years learning to perform manually.

The value of the human practitioner therefore begins to shift.

The people who thrive will be able to understand systems rather than individual components, troubleshoot when automation fails, recognize patterns across seemingly unrelated problems, and challenge an AI-generated answer when it does not make sense.

Instead of simply asking, “How do we fix this vulnerability?”, the more valuable question may increasingly become:

“What is it about our system that allowed this class of vulnerability to exist in the first place?”

And if Trey is right about what the next 18 to 36 months will bring, that is a question security teams are going to be asking a lot more often.