mckinsey -HackerOne 首席执行官卡拉・斯普拉格谈人工智能如何重塑网络安全行业 HackerOne CEO Kara Sprague on how AI is reshaping cybersecurity

May2026

Mckunsey

&company

McKinseyTechnology

HackerOneCEOKara

SpragueonhowAIis

reshapingcybersecurity

HackerOneCEOKaraSpraguediscusseshowAIisreshapingthe

cybersecuritylandscapeandwhysecurityteamsmustshiftfromfindingvulnerabilitiestoreducingexposure.

1“Fromvulnerabilitytoexploitation,”ZeroDayClock,accessedMay1,2026.

2AfrontierAImodelwithadvancedcybersecuritycapabilities.

HackerOneCEOKaraSpragueonhowAIisreshapingcybersecurity2

AsfrontierAImodels—themostadvancedgenerationofAIsystems—makecyberattacksfasterandmoresophisticated,organizationsareincreasinglyturningtocompaniessuchasHackerOnetoenhancetheirdefenses.InaconversationwithMcKinseySeniorPartnerMartinHarrysson,

HackerOneCEOKaraSpragueexploredhowAIischangingtherisklandscapeandwhytherealchallengeisnolongerfindingvulnerabilitiesbutremediatingthembeforeattackerscanact.

Thisinterviewhasbeeneditedforlengthandclarity.

MartinHarrysson:WeareatamomentwhereAIisreshapingmanypartsoftechnology.Howdidyouenterthetechnologyfield,andwhatisstructurallydifferentincybersecuritytoday

comparedwithbeforetheriseofAI?

KaraSprague:IstartedmycareeratMcKinsey,advisingclientsacrossthetechstack,then

movedintoindustryatF5,whichfocusesonapplicationdeliveryandsecurity.NowI’mCEOofHackerOne,workingwithsomeoftheworld’sbiggestcompaniestofindandfixsecurity

weaknessesbeforetheycanbeexploited.

Today,we’reseeingthreethingshappeningatonce.First,theattacksurfaceisgrowingbecausemoreAImodelsandsystemsarebeingdeployedacrossmoreenterprises,andAIcode

generationisacceleratingthepaceatwhichcompaniesbuildanddeploysoftware.Second,thatattacksurfaceismorevulnerablebecausesecurityforAIdeploymentsisstillnascent,andAI-

generatedcodestilltendstobelesssecurethanhuman-generatedcode.Andthird,attackersaregettingmorecapablebecausetheyarequicklyadoptingandweaponizingfrontierAI

capabilities.

Defenseisbehind,anditwilltaketimetocatchup.Enterprisesecurityoperationswillhavetoretoolforspeed.Andthat’snotjustaboutadoptingnewtechnology.It’saboutrethinkingthe

operatingmodel,talent,andgovernance.Thefind-to-fixworkflowhastobereimaginedwithAIattheforefront.

MartinHarrysson:Shouldleadersseethecurrentlandscapeasastepchangeinriskoranaccelerationofexistingtrends?

KaraSprague:Iwouldcallitanaccelerationoftrendsthathavebeenvisibleforsometime.Thetimebetweenvulnerabilitydiscoveryandexploitation,forexample,hasbeensteadilydecreasingfromovertwoyearsin2018tolessthanadaytoday.1

Whatfeelsnewinrecentweeks,followingAnthropic’searlyAprilannouncementofMythos,2is

thestepchangeincyber-specificcapabilities.Modelscannowbuildeffectiveexploitsthatchainmultiplevulnerabilitiestogether,meaningevenunsophisticatedattackerscanidentifyandtargetcriticalissues.

MartinHarrysson:Thecompressionintimelinesandtheemergenceofnewattackvectorsissignificant.Howwellareorganizationskeepingup?

HackerOneCEOKaraSpragueonhowAIisreshapingcybersecurity3

KaraSprague:AtHackerOne,wehaveabroadviewacrossthemarketbecauseweworkwith

closeto20percentoftheFortune500andalmost40percentoftheFortune50.Whatwe’re

seeingacrossourplatformisthatvulnerabilityreportshaveincreased76percentyearonyear.3Youmightassumethosereportsarejustmorenoise—whatsomerefertoas“AIslop.”Wehaveseenthatinthepast,butthat’snotwhatwe’reseeingnow.Thesignal—theshareofreportsthatturnintovalidfindings—hasheldsteady,whichmeanstheincreaseisreflectedinreal

vulnerabilitiesaswell.

Defendersarestrugglingtokeepupwiththreats.Backlogsaregrowing.Thegapbetweennewthreatsandtheabilitytorespondisstillmeasuredinmonths,andsometimesyears.

Itreallydependsonhowquicklysecurityorganizationsareabletoretooltheiroperationsfor

speed.Thereareemergingblueprintsforwhatthatlookslike—forexample,theCloudSecurityAlliance’srecentworkonbuildingMythos-readysecurityoperations4—butclosingthatgapwillrequiresignificantchangestohoworganizationsoperate.

MartinHarrysson:Inpracticalterms,whatstepscanorganizationstaketobridgethedefensegapyou’reoutlining?

KaraSprague:TomeetthissurgeinAI-ledvulnerabilitydiscovery,weneedtomeaningfullyacceleratevalidationandremediationatscale.

AtHackerOne,we’reinvestinginhelpingorganizationsovercomeafewbottlenecks.First,

agentictestingcapabilitiesthatincorporatethelatestfrontiermodelscanfindthesame

vulnerabilitiesthatadversariesusingmodelssuchasClaudeOpusandMythoswouldfind—butagentictestingdoesitsooner.Second,agenticvalidationcapabilitieswillbeneededtoabsorbthecomingsurgeinvulnerabilityvolumewhilemaintaininghighsignalrates.Andthirdis

remediationsupport—helpingorganizationsmovefromfindingtheproblemtoimplementingaverifiedfixfasterandatscale.

Humanexpertiseiscriticalforimplementingthesecapabilitiessuccessfully.AtHackerOne,

nearly90percentofourglobalcommunityofsecurityresearchersusesfrontiermodelstofindnovelandelusiveissues,andtheytestfixestoensuretheyfullyremediateexposure.

MartinHarrysson:Toyourpointontheresearchercommunity,howdoyouseetheroleofhumanresearchersevolvingasAIbecomesmorecapable?

KaraSprague:Humanresearchersareshiftingfrommanualbughuntingtohigher-level,morestrategicwork.AIistakingoverthediscoveryofcommon,high-volumevulnerabilities,while

researchersareincreasinglyfocusedonbuildingtoolsandsystemsthatuseAItofinddeeper,morecomplexissuessuchaslogicflaws,architecturalweaknesses,andnovelattackpaths.

Youcancompareautonomouscodefixestoself-drivingcars:Forcriticalsystems,thetoleranceforerrorisessentiallyzero.AlthoughAIcanreliablyproposefixesingreenfieldprojects,it

3“HackerOneintroducesH1validationtohelpenterprisesmanagesurgeinAI-discoveredvulnerabilities,”HackerOne,April21,2026.

4The“AIvulnerabilitystorm”:Buildinga“Mythos-ready”securityprogram,CloudSecurityAlliance,April12,2026.

HackerOneCEOKaraSpragueonhowAIisreshapingcybersecurity4

cannotsafelyuntanglecomplex,legacyarchitecturalissues.Fixingthesesystemsrequiresexperthumanoversight.

Ultimately,thisevolutionwillleadtothemarketplacingamuchhigherpremiumonidentifyingcomplex,high-impactvulnerabilitiesandguidingcriticalfixeswhiledecreasingthepayoutsforlower-complexityissueshandledautonomouslybyAI.

MartinHarrysson:Wheredoorganizationstendtobreakdownasvulnerabilitydiscoveryaccelerates?Whatdoesittaketoprioritizeandacteffectively?

KaraSprague:Organizationstendtobreakdownatthehandoffpoints.Thetypical

workflow—findinganissue,filingaticket,triaging,prioritizing,andpatching—involvesmultiplehandoffs,whichcreatebacklogsofworkwaitingtobeprocessed.Thosebacklogsdon’tholdupundervolume.Theorganizationsthatperformwellaretheonesthatshortenorminimizethosehandoffsandensurefindingsarrivewithenoughcontext.

Thisistricky.Asthepaceofdiscoveryandexploitationaccelerates,traditionalboundaries

betweenAppSec,DevOps,andSecOps5becomehardertosustain.Separatingthesefunctionsalsocreatesadditionalhandoffsacrossteams,slowingresponsetimes.Instead,organizationsmaymovetowardmoreintegratedworkflowswithshareddataandpriorities.Overtime,this

couldmeanshiftingsecurityfromaseparatefunctionthatinspectssoftwareafteritisbuilttosomethingembeddeddirectlyintohowsoftwareisdevelopedandrun.

MartinHarrysson:Giventhosechallengesarounddata,tooling,andorganizationalalignment,whatwillseparatetheorganizationsthatgetthisrightfromthosethatdon’t?

KaraSprague:Thebiggestdifferencewillbehowquicklyorganizationscancleartheirbacklogsandtheextenttowhichtheycancompresstheirfind-to-fixworkflows.Manyarestilloperatingasiftheyhavetimebetweenwhenavulnerabilityisdiscoveredandwhenitisexploited—but

withAI,thattimeisgone.

Organizationsthatgetthisrighttreatitasatime-basedproblem.Thosethatfallbehindarestillmanagingvolume—generatingmorefindingsthantheycanacton.Thisiswhereprioritizationisimportant.Traditionalvulnerabilityscoringsystemsprovideastandardizedviewofseverity,buttheydonotreflectactualriskinaspecificenvironment.Thesamevulnerabilitycanhavevery

differentimplicationsdependingonwhetheranassetisinternet-facing,whatdataitprocesses,andwhatcontrolsareinplacearoundit.

Effectiveprioritizationdependsoncontext—combininganunderstandingoftheas