In this episode of "Full Tech Ahead," host Amanda Razani interviews Nidhi Aggarwal, Chief Product Officer (CPO) of HackerOne. They discuss the paradigm shift in cybersecurity risks caused by AI-accelerated software development. Aggarwal introduces HackerOne’s new continuous threat exposure management platform, H1, designed to bridge the "find-to-fix" lifecycle gap.
She reveals that following the release of advanced AI models, vulnerability report volumes surged by over 90% in April 2026 alone. This influx has dramatically shortened the "zero-day clock", the time between vulnerability discovery and adversary exploitation, from an average of one month down to mere hours or minutes.
To combat the resulting 25X spike in critical vulnerability backlogs and build up "exposure debt," Aggarwal emphasizes that organizations must abandon seasonal compliance checks in favor of continuous, AI-driven adversarial pen testing combined with human discernment.
Key Quotes
- "Remediation has not kept pace... most CISOs are not looking for more vulnerabilities. Everybody's inundated with vulnerabilities."
- "The zero day clock... has steadily gone down from it used to be about a month last year to a matter of a few hours now in this year with AI."
- "Defense has to operate at that AI offensive scale... We have a concept called exposure debt... you have to think of it like technical debt or something sitting on your balance sheet."
- "The big advice would be offense is defense. So you have to think offensively."
Takeaways
- Automate Defense at Machine Scale: Since generative AI has driven the marginal cost of cyberattacks close to zero, adversaries can now launch massive, automated exploits in under ten minutes. Security defense can no longer operate at human speed; prioritization and remediation must scale up to match offensive AI.
- Manage Your "Exposure Debt": Unremediated high-risk vulnerabilities function like technical debt on an enterprise balance sheet. Organizations must treat this exposure as a board-level risk conversation and design a continuous drawing-down plan rather than letting critical backlogs accumulate.
- Filter out "AI Slop" via Bifurcation: The explosion of automated AI scanning has altered risk distribution. Security teams are experiencing a bifurcation: they are flooded either with informational "AI slop" (false positives that existing controls block) or hyper-critical zero-days. Rapid automated validation is mandatory to isolate true exposure.
- Shift to Continuous Risk-Based Pen Testing: Move away from compliance-driven, checkbox security architectures. True defensive resilience requires automated, 24/7 white-box and black-box pen testing, paired with the creative adversarial judgment of ethical human researchers using AI.
Find Amanda Razani on LinkedIn. https://www.linkedin.com/in/amanda-razani-990a7233/
Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/
Visit the FTA website: https://fulltechahead.com/
Check out the Substack Channel: https://fulltechahead.substack.com/
