Why AI Can’t Replace Human Security Researchers

AI is accelerating vulnerability discovery. The harder question for security leaders is how to separate real signal from everything else.

In this Black Hat edition of Exposed by HackerOne, Maggie Miller speaks with Tony Lee, VP of Operations at HackerOne, to talk about why bug bounty programs matter more in the AI era. They cover how AI-assisted vulnerability discovery is increasing noise, why a well-run bug bounty program helps security teams find higher-quality signal, and why the human process behind submissions, triage, and validation still matters.

Tony also shares what makes a successful bug bounty program today, why researcher community and partnership are essential, the biggest mistakes organizations make when they ignore best practices, and how teams should think about responsible AI use in security research. For security leaders building or maturing a bug bounty program, this episode gives a practical view of what it takes to move from discovery to remediation to reward.

If you’re a CISO, AppSec leader, or security practitioner trying to understand why bug bounty programs still matter as AI accelerates vulnerability discovery, this episode of Exposed by HackerOne breaks down how a well-run program helps separate real signal from noise, build stronger researcher partnerships, and move from discovery to remediation with more confidence.

Key Points:
00:02 - Welcome to the Black Hat edition of Exposed
00:32 - Introduction to Tony Lee, VP of Operations at HackerOne
00:52 - Why AI is accelerating vulnerability discovery
01:04 - How bug bounty programs help security teams find signal above noise
01:29 - Tony Lee’s inside-outside perspective on bug bounty operations
02:13 - Why successful bug bounty programs start with researcher community
02:24 - Common mistakes security teams make with bug bounty programs
03:24 - How AI is changing the way security researchers work
04:30 - Why executive sponsorship matters from discovery to remediation to reward

Tony Lee is Vice President of Operations at HackerOne. He brings both an operator's and a former customer's perspective to what makes bug bounty programs work, from building researcher community to improving signal, triage quality, and the path from discovery to remediation.

Before joining HackerOne, Tony held senior security leadership roles at Amazon Web Services, BlackBerry, Cylance, Mandiant, and FireEye, giving him firsthand experience running programs from the enterprise side of the table. He also serves as a Review Board Member and Lab Manager for Black Hat Arsenal and is a longtime instructor and public speaker in the security community. Tony holds a Master of Science in Computer Engineering from Johns Hopkins University and a Bachelor of Science in Computer Engineering from Virginia Tech.

LinkedIn: https://www.linkedin.com/in/tonyleevt/

Maggie Miller is Sr. Director of Corporate Marketing at HackerOne and host of Exposed. She brings a sharp editorial instinct to the conversations that matter most in security - translating complex shifts in the threat and development landscape into the practical framing that security leaders actually need. Maggie has a talent for asking the question that surfaces the insight, and this episode is one of the clearest examples of that.

Learn more about HackerOne:
https://www.hackerone.com

LinkedIn:
https://www.linkedin.com/company/hackerone

Twitter/X:
https://twitter.com/hacker0x01


#cybersecurity #bugbounty #AIsecurity #vulnerabilitydiscovery #securityresearch #ethicalhacking #vulnerabilitymanagement #AItriage #securityleaders #HackerOne #AppSec #infosec #responsibleAI #securityresearchers #discoverytoremediation