Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
Bugcrowd Security Flash: Breaking Down H.R. 872
Bugcrowd released a video on H.R. 872 featuring founder Casey Ellis and Americas CISO Trey Ford discussing the legislation's implications for cybersecurity. Ellis and Ford examine what the bill means for the industry and outline anticipated next steps in regulatory and security policy development.
In-House Evaluation Is Not Enough: Towards Robust Third-Party Flaw Disclosure for General-Purpose AI
arXiv.org published a research paper examining gaps in how flaws in general-purpose AI systems are reported and evaluated compared to established software security practices. The paper, developed by collaborators across security, machine learning, law, and policy, proposes standardized flaw reporting formats, broad disclosure programs with legal protections for researchers, and improved infrastructure for coordinating reports across AI providers.
AI Wars Playing Out in Application Attacks and Defenses
A CyberRisk TV video segment features an interview between host Deb Radcliff and Bugcrowd founder Casey Ellis about artificial intelligence's role in application security attacks and defenses. Ellis discusses how AI is reshaping both offensive and defensive strategies in the evolving landscape of application security threats.
Lawmakers propose DeepSeek ban on government devices
This Security Magazine article from February 10, 2025 covers a bipartisan congressional bill that would bar DeepSeek use on government devices. Casey Ellis, founder of Bugcrowd, says the ban reflects geopolitics and trust as much as technical vulnerabilities, calling it a defensive step that still needs a proactive approach.
Casey Ellis: Pioneering The Bug Bounty Platform
The Phillip Wylie Show features an interview with Casey Ellis, founder of Bugcrowd, discussing his background in technology and the development of bug bounty platforms. Ellis describes how Bugcrowd connects organizations with ethical hackers to identify security vulnerabilities, and explains his approach to leveraging the white hat hacker community to enhance internet security.
Trump administration disbands Cyber Safety Review Board
This Security Info Watch article from January 27, 2025, reports on the Trump administration's decision to disband the Cyber Safety Review Board, an advisory body. Casey Ellis, founder of Bugcrowd, says the move follows a pattern seen after past administration changes and is not a huge surprise, noting that threats and vulnerabilities persist regardless.
Trump Has Had a Light Touch on Cybersecurity – So Far
Security Boulevard published this January 2025 article on how early executive actions from the new Trump administration treated cybersecurity. Bugcrowd founder Casey Ellis told the outlet he is encouraged, noting the administration has an established track record of understanding cybersecurity's role in national security, resilience, and prosperity.
Biden’s Final Cybersecurity EO Could Put Demands on MSSPs
This MSSP Alert article from January 21, 2025 examines how Biden's final cybersecurity executive order could require managed security providers to adjust their practices. Casey Ellis, founder of Bugcrowd, says the order is a clear effort to keep the past four years' core cybersecurity and international relations conclusions part of U.S. policy.
Security leaders weigh in on Biden’s new cybersecurity executive order
Security Magazine's January 2025 article gathers security leaders' reactions to Biden's new cybersecurity executive order, which covers AI in cyber defense and quantum-resistant encryption. Casey Ellis of Bugcrowd notes the order circulated in draft among a limited Washington audience for weeks and credits the White House and ONCD with substantial technical expertise.
Biden signs executive order to strengthen national cybersecurity in last days in office - SiliconANGLE
This SiliconANGLE article from January 16, 2025 reports on President Biden signing an executive order to strengthen national cybersecurity in his final days in office. Casey Ellis, founder of Bugcrowd, told the outlet the order was an open secret, though he doubts it would last past the administration change.
Security flash: Salt Typhoon | @Bugcrowd
Bugcrowd published a Security Flash video featuring founder Casey Ellis and America's CISO Trey Ford discussing the Salt Typhoon threat. The 20-minute broadcast covers Salt Typhoon's background, organizational impact, and implications for security teams.
Hackers Launch a Supply Chain Attack by Injecting Malicious Code into Hijacked Chrome Extensions - CPO Magazine
This CPO Magazine article, published January 9, 2025, covers a supply chain attack that injected malicious code into over 35 hijacked Chrome extensions to take over Facebook Ad accounts. Casey Ellis, founder of Bugcrowd, warns that because Cyberhaven's Chrome extension counts enterprise and business users as regular users, a compromise could affect business accounts.
China cyber threats: What businesses can do to protect themselves
This IT Pro article, published January 9, 2025, examines rising China-linked cyber threats and what business leaders should do to strengthen their defenses. Bugcrowd founder Casey Ellis says Chinese cyber operations shifted from covert espionage to openly aggressive spray-and-pray tactics around 2019, and he calls Flax Typhoon the noisiest group.
Cybersecurity in 2025: Global conflict, grown-up AI, and the wisdom of the crowd - Help Net Security
This January 9, 2025 contributed article from Help Net Security presents predictions on new cyberattacks and greater community collaboration. Casey Ellis, Bugcrowd's founder, contributes as a guest author, arguing organizations increasingly rely on crowdsourced talent for offensive testing and that the community will collaborate more to counter growing threats.
Crowdsourced Security & Vulnerability Disclosure with Casey Ellis
Delinea's 401 Access Denied podcast features a discussion on crowdsourced security and vulnerability disclosure practices. Ellis explains how crowdsourced models improve security outcomes and discusses the role of coordinated disclosure in modern threat management.
Member of Blackhat Review Board
Casey Ellis has been accepted as a member of the Black Hat Review Board for 2025. In this role, he will serve as a judge evaluating submissions for the annual information security conference.
Internet-exposed HMIs are a risk to water facilities, CISA warns
This Security Magazine article, published December 19, 2024, reports on a CISA advisory urging water and wastewater facilities to secure internet-exposed human-machine interfaces. Casey Ellis, founder and advisor at Bugcrowd, argues that safety-critical control systems like these should never be exposed to the internet, since any failed safeguard becomes a risk once connected.
Nearly 400,000 WordPress credentials stolen
Security Magazine's December 2024 press article reports that threat actor MUT-1244 stole more than 390,000 WordPress credentials in a year-long campaign. Casey Ellis, founder and advisor at Bugcrowd, is quoted saying that targeting red-teamers and researchers with fake proof-of-concept code is an old troll tactic that can also work as an effective watering-hole approach.
SAINTCON 2024 - Adam Marre - So, you want to be a CISO
SAINTCON 2024 released a video featuring Adam Marre discussing the path to becoming a CISO on YouTube. The talk covers career development, responsibilities, and practical insights for security professionals aspiring to chief information security officer roles.
US Copyright Office states common AI research does not violate DMCA
This Security Magazine article reports that the U.S. Copyright Office clarified that common AI trustworthiness research and red teaming do not violate the DMCA. Casey Ellis, Founder and Advisor at Bugcrowd, says the ruling lets good-faith security researchers use these techniques without fear of DMCA reprisal.
Library of Congress Offers AI Legal Guidance
This December 2024 Dark Reading article, titled Library of Congress Offers AI Legal Guidance, explains how researchers testing generative AI can use prompt injection without running afoul of copyright law. Casey Ellis, founder and adviser to BugCrowd, says clearer copyright guidelines favor security researchers and that unclear rules create a chilling effect.
SmokeLoader attack targets organizations in Taiwan
The Security Magazine article from December 3, 2024, covers Fortinet FortiGuard Labs research into a SmokeLoader malware attack targeting organizations in Taiwan. Casey Ellis, Bugcrowd's founder and advisor, says Taiwan has long considered advanced persistent threats and that this SmokeLoader use fits a wider pattern of pre-positioning.
Security Breach: Casey Ellis
Security Breach, a podcast from Manufacturing Business Technology, featured Casey Ellis as a guest in December 2024. Ellis discussed vulnerability management and coordinated disclosure practices with host on the program.
CISA Director Easterly to Leave When Trump Assumes Presidency
This Security Boulevard press item from November 19, 2024, reports on CISA Director Jen Easterly's departure, tied to Donald Trump's incoming presidency. Bugcrowd founder Casey Ellis is quoted praising Easterly's work during a turbulent period for U.S. cybersecurity, and he says it is too early to judge the agency's direction under the incoming administration.
What a second Trump term means for the future of ransomware | TechCrunch
TechCrunch published this November 2024 article examining how a second Trump administration could shape U.S. efforts against ransomware, including possible shifts toward offensive cyber operations. Casey Ellis, founder of Bugcrowd, expects U.S. offensive cyber capabilities to ramp up, including more hack-back activity like recent FBI and DOJ disruption efforts.
Zero-Day Exploits Surge in 2023, Cisco, Fortinet Vulnerabilities Targeted
This Security Boulevard article from November 2024 covers a Five Eyes report, released by CISA, finding most top exploited vulnerabilities in 2023 were initially zero-days. Casey Ellis, founder and advisor at Bugcrowd, says the zero-day label wrongly implies defenders cannot act, and urges treating these flaws as patch management problems.
500,000 people impacted by ransomware attack on Columbus, Ohio
Security Magazine reported that the City of Columbus, Ohio, notified 500,000 people that a July 2024 ransomware attack stole their personal data. Casey Ellis of Bugcrowd praises the city's decision to drop its lawsuit against researcher David Leroy Ross and warns the suit could chill others who report such thefts.
Strengthening AI Accountability Through Better Third Party Evaluations
Stanford HAI published a piece on strengthening AI accountability through improved third-party evaluations on November 6, 2024. Casey Ellis participated as a panelist in the discussion on evaluation frameworks and accountability mechanisms for AI systems.
City of Columbus acknowledges data theft after lawsuit against security researcher - SiliconANGLE
This SiliconANGLE article reports that the City of Columbus dropped its lawsuit against a security researcher after he accepted a permanent injunction limiting data sharing. Casey Ellis, founder and adviser at Bugcrowd, told SiliconANGLE it is good to see the case dropped, partly due to security community outcry.
Privacy Anxiety Pushes Microsoft Recall AI Release Again
This Dark Reading article from November 1, 2024, examines Microsoft's decision to delay its Recall AI feature, which records images of on-device activity, amid privacy and security concerns. Casey Ellis, founder of Bugcrowd, says Microsoft appears to be moving cautiously, possibly learning from market reaction to Anthropic's similar computer use feature.