OWASP LA October In Person Meetup

TOPIC: Build vs. Buy: What We Learned Building an Autonomous AI Pentester at Commercial Scale ABSTRACT: Every security team is asking the same question right now: can we just point a frontier model at our own attack surface and skip the vendor conversation? A capable engineering team can wire an LLM to a proxy and produce something that looks like agentic pentesting in a demo over a weekend. Getting a CISO to actually run that agent against a production estate is a different problem entirely. This talk walks through what we learned building Bugcrowd's Savant Pathseeker, an autonomous AI pentesting agent that performs real reconnaissance, exploitation, and evidence-based validation against live web apps and APIs — and what separated a working demo from something enterprises would trust with production access. We'll cover the non-obvious infrastructure a commercial-grade AI red teamer actually needs: runtime safety architecture and kill switches, a human-validated skill catalog that keeps pace with real-world attack techniques (not just whatever a foundation model happened to learn in training), audit-grade logging for compliance, and — critically — a continuous feedback loop from human offensive practitioners that keeps the agent's tradecraft sharp as defenses evolve. We'll also get candid about the build-vs-buy tradeoffs from the other side of the table: where proprietary data feeds and platform backing genuinely matter, where they don't, and where "just use Claude/GPT with some tools" is a perfectly reasonable answer. Expect real lessons (including some things we got wrong), a practical framework for evaluating agentic security tools, and an honest conversation about what it actually takes to make autonomous exploitation safe enough to point at systems people care about. SPEAKERS: Ari Schorr, Staff Product Manager, Bugcrowd Ari Schorr is a Product Manager at Bugcrowd, where he drives strategy across the company's agentic pentesting line (Savant Pathseeker) and its next-generation platform experience, reimagining how security leaders visualize their attack surface and prioritize risk in real time. Since joining Bugcrowd, Ari has led product for Pathseeker from early access through its upcoming general availability trajectory, working directly on the architecture, safety controls, and skill catalog that make autonomous exploitation viable at commercial and enterprise scale, while also shaping the platform's evolution toward a unified view correlating agentic, human pentest, and bug bounty signal. Prior to Bugcrowd, Ari spent almost 13 years at Microsoft in various marketing, evangelism, and engineering roles across the Productivity, Education, Security & Compliance, and Identity product areas. Most recently, as a Senior Product Manager in the Identity & Network Access (Microsoft Entra ID) team, he drove capabilities helping identity administrators and SOC teams secure their environments from application identity-related threats, including new generative AI features for Application Risk in Security Copilot. He previously led the Identity Strategic Alliances team's work with third-party ISV partners in productivity and healthcare to expand the Microsoft app ecosystem. Ari graduated from the University of Michigan (Go Blue!). In his spare time, he's an avid long-distance runner who has completed a few marathons, and now spends his energy chasing his two young girls around the house. Hemang Thakkar, Staff Product Manager, Bugcrowd Hemang Thakkar is a Product Manager at Bugcrowd, where he leads the Core Platform & Infrastructure team, owning the core Human Led business, Infrastructure, and Hacker Experience. He brings more than 11 years of product management experience across identity, security, APIs, developer platforms, and integrations. At Bugcrowd, Hemang has worked across the CrowdControl platform (bug bounty, pentest, VDP) and is leading the effort to launch Bugcrowd’s FedRAMP and EU environments. Prior to Bugcrowd, Hemang held product leadership roles at Securiti AI, Veza, Okta, and SailPoint, where he built and managed products across identity and access management, data security, API platforms, and integrations. At Okta, he led products including Okta Access Gateway, resource management, and policy capabilities, and worked closely with customers on areas such as policy testing and migration to Okta Identity Engine. Earlier in his career, he led developer platform and integration initiatives at SailPoint and Veza, and at Securiti AI he focused on building and scaling an integrations platform connecting security and data ecosystems. Hemang began his career as a software engineer at ACI Worldwide, where he worked on real-time payment gateways and mobile banking solutions. He holds a degree in Computer Engineering and an MBA from UCLA (Go Bruins!!) Outside of work, Hemang enjoys traveling with his wife and two kids, exploring national parks and beaches, and playing pickup basketball.