Loading story…
Bugcrowd has acquired Mayhem Security, an AI-powered offensive security firm, to enhance its application security testing platform by combining automated vulnerability discovery with human-led expertise. The acquisition brings together Mayhem Security’s autonomous security testing technology—recognized for its real-time vulnerability detection and repair capabilities—with Bugcrowd’s established crowdsourced bug bounty and vulnerability disclosure programs. All Mayhem Security employees, including co-founder David Brumley, have joined Bugcrowd, with Brumley taking on the role of chief AI and science officer.
The unified platform aims to provide organizations with continuous, end-to-end application security coverage, spanning autonomous scanning, dynamic SBOM profiling, red-teaming, and bug bounty services. This strategic move is positioned as a response to the increasing complexity of software development and the need for security solutions that integrate artificial intelligence with the creativity of skilled security researchers. The acquisition is expected to accelerate the delivery of advanced, programmatic security testing throughout the software development lifecycle.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Bugcrowd announced its acquisition of Mayhem Security to expand its application security testing capabilities and advance AI-powered security testing. Multiple outlets reported the deal as a strategic move to enhance Bugcrowd's platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HackerOne has expanded beyond its roots as a bug bounty marketplace and live hacking community into a broader enterprise security platform focused on validation, AI-assisted testing, and Continuous Threat Exposure Management (**CTEM**). Earlier company messaging highlighted its large global hacker community and events such as live hackathons, but newer reporting says the business is increasingly oriented toward enterprise-scale security operations and automated workflows. The shift is being driven by both business pressure and the operational impact of AI on vulnerability intake. According to the reporting, HackerOne recorded **46,947 submissions** in March 2026, a **76%** year-over-year increase, while only about **25%** were valid and exploitable; remediation throughput reportedly rose just **19%**, pushing backlog to a record high. The same reporting says controversy has emerged around HackerOne's AI terms and data governance, with company documentation indicating researcher and customer data may be processed as inference context in authorized workflows but is **not** used to train or fine-tune underlying generative models, leaving trust, triage capacity, and researcher compensation as key unresolved issues.
Aug 10, 2026
Security leaders and practitioners are shifting away from traditional, checklist-based approaches and the reliance on bug bounty platforms as the primary means of vulnerability discovery. At the Picus Breach and Simulation (BAS) Summit, experts emphasized that modern cyber defense requires continuous, real-world testing of security controls, not just periodic pentests or compliance exercises. BAS has emerged as a critical tool, enabling organizations to simulate adversarial behaviors in live environments and validate their defenses in real time, moving beyond the limitations of static design and certification. Simultaneously, the bug bounty ecosystem is facing significant challenges, with platforms struggling to manage the overwhelming volume of low-quality and duplicate submissions. The operational burden of triage and validation has exposed the inefficiency of the middleman model, prompting organizations to seek more targeted, expert-driven approaches to security testing. The future of offensive security is increasingly programmatic and continuous, focusing on actionable risk reduction rather than managing crowdsourced noise.
Jul 12, 2026
Bug bounty programs have significantly enhanced software security by leveraging a global network of ethical hackers to identify vulnerabilities that internal teams may overlook. Organizations have benefited from cost-effective, continuous security testing, with real-world examples showing that even critical flaws missed by experienced engineers can be discovered by external researchers, sometimes preventing losses in the millions. The diversity and scale of the bug bounty community have enabled companies to access a wide range of skills and perspectives, making digital systems safer and more resilient. However, the operational complexity of managing bug bounty programs has led to new challenges. The rise of bug bounty platforms as intermediaries was intended to filter out noise and streamline vulnerability management, but these platforms now struggle with overwhelming volumes of low-quality, duplicate, and AI-generated reports. The triage process has become bogged down by administrative burdens, reducing the effectiveness of these platforms and prompting a shift toward more targeted, expert-driven security testing as part of continuous offensive security programs. Organizations are increasingly seeking solutions that prioritize actionable risk reduction over sheer volume of findings.
Jul 12, 2026