Just over 8 years ago bug bounty was a shiny security thing that crazy tech companies did sometimes, the concept of a digital locksmith hadn't been established in the consumer yet, and the Internet was generally a smaller and less politicized place. Casey Ellis decided it might be a good idea to "release the hounds" into the status quo, launching Bugcrowd and kicking off the crowdsourced security as a service market category, and it's safe to say that a fair bit has happened since. This keynote is for infosec practitioners and budding cybersecurity entrepreneurs, talking through what we've learned, what's changed, where I think it's all going next, and where we can position ourselves to continue making the Internet a more resilient place.

1. https://bugcrowd.com/try-bugcrowd
Release The Hounds: Part 2
“8 Years Is A Long Ass Time”
Casey Ellis - IsolationCon 2 Keynote 2021

2. https://bugcrowd.com/try-bugcrowd
#rip @dakami
:’(

3. https://bugcrowd.com/try-bugcrowd

4. https://bugcrowd.com/try-bugcrowd
whoami
Founder/Chairman/CTO of Bugcrowd and
Founder of disclose.io
20 years in infosec
Pioneered Crowdsourced Security as-a-Service
Proud Australian, husband, and father of two
Lives in San Francisco, California IDK
$ sudo hack.sh $ sudo hustle.sh
@caseyjohnellis
https://cje.io

5. https://bugcrowd.com/try-bugcrowd
what are we talking about?
what we’ve been up to
what we’ve seen the industry do
where crowdsourcing/multisourcing is up to now
what comes next
q&a

6. https://bugcrowd.com/try-bugcrowd
1 March 2013
https://www.slideshare.net/bugcrowd/release-the-hounds-a-look-inside-bugcrowd-ruxmon-1-march-2013

7. https://bugcrowd.com/try-bugcrowd

8. https://bugcrowd.com/try-bugcrowd
0.1 1.0

9. https://bugcrowd.com/try-bugcrowd

10. https://bugcrowd.com/try-bugcrowd

11. https://bugcrowd.com/try-bugcrowd
2012
(RIP GOOD TIMES)

12. https://bugcrowd.com/try-bugcrowd

13. https://bugcrowd.com/try-bugcrowd
nekkminnit…

14. https://bugcrowd.com/try-bugcrowd
“All security is the product of
something bad happening”
…Magical SF Lyft driver

15. https://bugcrowd.com/try-bugcrowd
2013
“Hacking happens”

16. https://bugcrowd.com/try-bugcrowd
…followed by

17. https://bugcrowd.com/try-bugcrowd
2014
“Hacking happens to me”

18. https://bugcrowd.com/try-bugcrowd
2015
“Hacking happens to me and it hurts”

19. https://bugcrowd.com/try-bugcrowd
2016
“Hacking happens to my country”

20. https://bugcrowd.com/try-bugcrowd
2017
to
2020
“Software is eating
the world and bad
guys are eating the
software”

21. https://bugcrowd.com/try-bugcrowd
2020
“My employee’s 5 year old responsible for my corporate attack surface”

22. https://bugcrowd.com/try-bugcrowd
2021
“It’s turtles all the way down”

23. https://bugcrowd.com/try-bugcrowd
If it’s repeated enough at the dinner table,
it’ll end up in the board room.

24. https://bugcrowd.com/try-bugcrowd

25. https://bugcrowd.com/try-bugcrowd
…2021?

26. https://bugcrowd.com/try-bugcrowd

27. https://bugcrowd.com/try-bugcrowd
What was Bugcrowd
doing?

28. https://bugcrowd.com/try-bugcrowd
2.0

29. https://bugcrowd.com/try-bugcrowd
3.0

30. https://bugcrowd.com/try-bugcrowd
4.0

31. https://bugcrowd.com/try-bugcrowd
198 employees
$80M USD raised
157,194 vulns nuked
50M USD paid out
~200k signed up
1,000s of programs

32. https://bugcrowd.com/try-bugcrowd

33. https://bugcrowd.com/try-bugcrowd

34. https://bugcrowd.com/try-bugcrowd

35. https://bugcrowd.com/try-bugcrowd
Australian-based ASG
…also, we’re hiring ;)

36. https://bugcrowd.com/try-bugcrowd
#thoughtops

37. https://bugcrowd.com/try-bugcrowd
“I need security to be useful to
my business”
…Most CISOs in 2021

38. https://bugcrowd.com/try-bugcrowd
Business/Finance
Risk
Technical
Political
CISO

39. https://bugcrowd.com/try-bugcrowd
Humility
Skill
Empathy
h4xors

40. Broke:
“Rub some blockchain/
automation/ML on it and it’ll go
away”
Woke:
“Cybersecurity is a people
problem, the technology just
makes it go faster.”

41. Broke:
VDP as a marketing stunt
Woke:
VDP to show that failure is a part
of being human, and to jump-start
vulnerability remediation
processes

42. Broke:
Bug bounty as a vulnerability
swatting silver-bullet
Woke:
Bug bounty as a way for the
business to internalize that the
boogeyman is real

43. Broke:
Total payouts as a vanity metric
Woke:
Required payout as a business metric for
cost of attack

44. Broke:
Pentest as an assurance-only model
Woke:
Assurance & impact to create builder/
breaker feedback loops

45. Broke:
“China wouldn’t bother with my stuff”
Woke:
“How do I detect and contain a nation-
state assuming they are successful”

46. Broke:
security@domain.com > /dev/null
Woke:
disclose.io

47. disclose.io - Fixing the Internet’s Auto-Immune Problem
- Open Source Disclosure Policy Framework
- Safe Harbor logo recognition
- Public directory of adopters and search
tools for hunters
- Legal standardization of vulnerability
disclosure language
- Safe Harbor for good-faith hackers
- Rewarding proactive behavior on the
company
Get involved: Ping us at hello@disclose.io

48. https://bugcrowd.com/try-bugcrowd
In summary
The cybersecurity industry is only just getting started
Hackers have a seat at almost any table now
Good things happen when you step out
…so hence forth and be rad.

49. “A ship in
port is
safe…
…but
that’s not
what ships
are for”

50. https://bugcrowd.com/try-bugcrowd
Questions?
@caseyjohnellis
casey@bugcrowd.com
https://cje.io
Greetz to stu, sasquatch, jack, chloé, phil, fred, the TMHC
crew, bugcrowders, the disclose.io posse. Special greetz to
bitquark, n0x00, zephyr, zseano, and the OG #britcrowd
crew
#RIP @dakami