AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business. In this Help Net Security interview, Kara Sprague, CEO of HackerOne, talks about business logic bugs, what AI does to the crowd model, and why routine medium-severity findings may pay less.

She also covers the growing pile of AI-assisted submissions, how programs sort useful reports from spam, and which parts of a researcher’s work are hardest to automate, with figures from the 2026 HackerOne Security Research Report.

OPIS

When an AI system can find a vulnerability in minutes, what is the human hacker still better at, and how long do you expect that to hold?

Humans still have an advantage in judging what a vulnerability means for the organization affected by it. AI can help find more bugs, but deciding which ones deserve attention takes an understanding of how the system is used and what could go wrong.

AI is good at finding familiar types of bugs at scale. It’s less reliable when the weakness depends on how a business operates: a refund process someone can abuse, an approval they can bypass, or several seemingly harmless behaviors that together let them take over an account. Recognizing those problems requires understanding the intended process and imagining how an attacker might use it differently.

Researchers are already shifting their work in that direction. In the 2026 HackerOne Security Research Report, 85% of respondents say they are actively building their AI skills, 68% say AI has pushed them toward more complex bugs with higher bounties, and 72% identify business logic flaws as their fastest-growing category.

I wouldn’t put a date on how long that advantage will last. As models improve, researchers will need to keep adapting how they use them and where they focus their efforts. Understanding the organization, assessing the consequences of a flaw, and making a defensible recommendation about what to fix will remain a substantial part of the work.

HackerOne built its business on the idea that many eyes find more bugs. If machines become some of those eyes, does the crowd model get stronger or does it start to look like a legacy approach?

AI makes the crowd model stronger, although it reduces the value of routine findings.

The benefit of “many eyes” has always been the different perspectives researchers bring. People have different skills and different ideas about how to attack a system. Adding more models doesn’t necessarily offer the same variety, especially when they’re trained on similar data and asked to examine the same targets.

Paying researchers for valid findings still works when they use AI. We have seen researcher payouts rise 26% year over year in the first half of 2026 and accelerate further in the third quarter. There’s also more to investigate. According to the research, the number of programs with AI assets in scope doubled in two years, while valid AI vulnerability reports rose 222%.

Routine, pattern-based findings will become harder to earn money from. As automated tools make those bugs easier to find, programs have less reason to pay researchers to report them.

The case for the crowd still rests on people who approach a problem differently and find something others missed. AI helps them do that work and its ability to produce more findings makes their judgment about which ones matter more valuable.

Bounty payouts reward scarcity. If AI makes routine findings abundant, what happens to the price of a medium-severity bug?

Routine medium-severity bugs will likely earn less. Findings that take deeper investigation and judgment may hold their value or earn more.

Programs pay bounties to reduce risk. If AI makes a familiar type of bug cheaper to find, programs have less reason to offer the same reward. Researchers also face more competition to submit it first. That lowers their chances of getting paid even when the advertised bounty hasn’t changed.

The bug bounty platforms are showing signs of this shift. Since January 2025, submissions have grown 2.8 times, while valid reports have grown 1.9 times. Programs are paying more for critical and novel findings and less, or nothing, for low-severity issues, duplicates, and findings that can be automated. Total payouts have still increased.

But cheaper discovery also helps attackers, which could make leaving a medium-severity vulnerability unfixed more costly. Fixing the problems already reported remains a challenge, with about 70% of security leaders say validated findings reach their backlog faster than their teams can address them. As reports become more plentiful, more of the value lies in confirming the risk and helping teams resolve it.

Program owners already complain about low-quality reports. How much of the AI-generated submission volume you see is useful, and how much is noise that a triager has to wade through?

I can’t give you a reliable split. It’s difficult to tell whether a report was written by a person, generated by a model, or developed using both. Many good reports now involve AI. We can measure the overall volume and the results.

Bug bounty platforms have seen submissions grow 2.8 times since January 2025, while valid reports have grown 1.9 times. We’re receiving more valid findings than ever, but they make up a smaller share of submissions. Most of the other reports are duplicates, informative, out of scope, or spam. A growing share is also awaiting more information from the researchers or a final decision from the program.

Those numbers don’t tell us how much of either increase comes from AI. For programs reviewing reports, the question is whether the evidence demonstrates real security impact. AI makes it easy to produce a convincing-looking report, but checking its claims can still take considerable time.

Programs are responding with submission limits based on researchers’ track records and private access tiers. They also need to get through reviews faster. That will take both people and automation; otherwise, useful findings will spend longer waiting alongside reports that don’t warrant action.

Which parts of a researcher’s work do you believe are hardest to automate: creativity in chaining flaws, understanding business logic, or something else? What is your evidence?

I’d put business logic first, followed by chaining vulnerabilities into an attack.

Chaining involves searching for ways that weaknesses can work together, and models are getting better at that. Business logic depends more on understanding what a system is supposed to allow. The code may not tell you why a refund needs approval, who should be able to authorize a payment, or when an exception creates an opportunity for abuse. A model can help test those situations, but someone needs to provide the relevant context. Knowing which details matter takes experience.

The evidence is suggestive rather than conclusive. 72% of researcher respondents identify business logic flaws as their fastest-growing vulnerability category. That tells us where researchers are finding opportunities; it doesn’t establish how long humans will retain an advantage over models.

I’d also include the judgment involved in deciding which findings need attention now. In the same report, 58% of security leaders say product delivery or business priorities delay fixes for critical and high-severity vulnerabilities. Resolving those competing demands takes discussion with the people responsible for the product and a clear understanding of the consequences. Someone has to take responsibility for the decision.

Download: The IT leader’s guide to AI code sprawl