Episode Details

In this live recording of Security Tech Talk, host Steve Kenny explores the rapidly evolving world of offensive cybersecurity with Kevin Kersley, Regional Director for EMEA at Bugcrowd. Fresh off being featured by the BBC, Kevin shares how Bugcrowd connects global organizations with a massive network of ethical hackers to identify hidden vulnerabilities before malicious actors can exploit them.

Steve and Kevin dive deep into the fundamental shift from traditional penetration testing to continuous crowdsourced security. They unpack the real-world implications of the UK’s Product Security and Telecommunications Infrastructure (PSTI) Act, examine how malicious actors are moving from "AI as a threat" to "AI as a target" via data poisoning, and discuss why leading physical security manufacturers like Axis Communications are championing transparent public and private bug bounty programs.

About Our Guest:

• Kevin Kersley: Regional Director across EMEA for Bugcrowd. Kevin is an expert in crowdsourced threat intelligence, helping enterprises navigate compliance, manage vulnerability disclosure programs (VDPs), and harness the ingenuity of the global ethical hacking community to secure both hardware and software systems.

Chapters:

• (0:00:06) – Introduction & The Limits of Pen Testing

Steve welcomes Kevin to the show. Kevin breaks down the core difference between a standard penetration test (a rigid, time-boxed checklist of known flaws) and a bug bounty program, which unleashes creative human ingenuity to find completely unknown vulnerabilities.

• (0:02:40) – Inside Bug Bounty Programs & Vetting Ethical Hackers

Kevin highlights Axis Communications’ forward-thinking stance on public and private bug bounty programs. He addresses common misconceptions about the hacking community and explains how Bugcrowd monitors and maintains strict trust frameworks.

• (0:04:30) – The PSTI Act & Online Neighborhood Watch

A deep dive into the UK's Product Security and Telecommunications Infrastructure (PSTI) Act. Kevin explains the mandatory shift toward Vulnerability Disclosure Programs (VDPs) and why giving security researchers a clear, non-monetary path to report bugs is essential for modern business transparency.

• (13:18) – AI as a Target: Data Poisoning and Chatbot Hallucinations

The conversation shifts to large language models (LLMs) and the emerging threat of data poisoning. Kevin shares a fascinating case study on breaking multilingual logic and reviews the infamous Air Canada chatbot legal precedent, demonstrating why organizations must treat AI systems as highly exploitable targets.

• (18:37) – Offensive AI: Lowering the Barrier to Entry?

Steve and Kevin discuss whether generative AI tools allow anyone to become a hacker. They analyze how automation is boosting efficiency in offensive security while simultaneously lowering the technical bar for entry-level malicious cybercriminals.

• (22:22) – Proactive Hardening & The Rise of Hardware Hacking

Kevin outlines the future of Bugcrowd, underscoring the critical necessity of keeping a "human in the loop." He details the surging industry trend of hardware hacking, including real-world stress tests on retail point-of-sale (POS) systems, vehicles, and network-connected physical cameras.

Resources:

• Learn more about the Bugcrowd Platform and crowdsourced security solutions.
• Read about the landmark legal ruling:

  Listen Now