Episode 67 of The Security Podcast of Silicon Valley aired on April 22, 2025, with Jon McLachlan and Sasha Sinkevich hosting. The guest was Gadi Bashvitz, co-founder and CEO of Bright Security, the company that started in 2018 as NeuraLegion and builds dynamic security testing for developers. He came dressed for the name.
“If this is a formal recording, then we have to be in our formal bright attire.”
Gadi Bashvitz, at 0:24
The conversation was recorded in early 2025. The tape places it: Gadi talks about launching a new product “in the first half of this year,” calls its auto-remediation “just in some pilot customers right now,” and says Bright is sponsoring RSA. Bright launched that product, Bright STAR, at RSA Conference 2025 on April 28, six days after the episode aired. Since then Bright has won a startup competition run by Google at HumanX, been picked for GitHub’s AgentHQ program, and brought back the AI fuzzer it started with in 2018. The last section below covers that.
This page is the rest of it: a section for each part of the conversation with the sources beside it, thirteen figures, fourteen clips from the tape, a LinkedIn card, the full transcript, and four tools: a quiz, a scorecard for how early your team fixes what it finds, a calculator that runs Gadi’s 120 findings through his numbers, and a timeline from the 1988 class project that named fuzzing to Bright’s fuzzer coming back.
A note on the numbers before the sections. Gadi gave several figures on the tape: sixty times the effort to fix a bug in production, one AppSec person for 200 or 300 developers, AI-generated code four times as prone to vulnerabilities. Those are his, from his work with customers, and each is labeled that way below, with what the public record says beside it where it says anything.
From the 8200 unit to a fourth startup
Sasha asked what inspired Bright Security, and Gadi started further back than the company.
“Started my way in cyber many, many moons ago when I was in the Israeli military.”
Gadi Bashvitz, at 0:49
“But I was in the 8200 unit, dealing with all sorts of fun stuff around encryption and decryption of voice over network, if those of you who are old enough to remember, the predecessor of voice over IP.”
Gadi Bashvitz, at 1:00
Unit 8200 is the Israeli Intelligence Corps unit of the Israel Defense Forces responsible for signal intelligence and code decryption, among other work (Wikipedia). Voice over IP is the set of technologies that carry voice calls as data over IP networks (Wikipedia), and it had ancestors. The Network Voice Protocol, for one, was a pioneering protocol for carrying human speech over packet networks, an early example of the same idea (Wikipedia). Gadi didn’t say which system he worked on, and the page doesn’t guess.
He summed up the decades after that in one line, and his LinkedIn fills them in (LinkedIn). He spent six years at Verint from December 2001, managing product managers and then pre-sales and post-sales work with large enterprises on workforce optimization, speech analytics and data mining. He ran business development and then the Asia Pacific and Latin America business at Merced Systems from 2008 to 2011, and was vice president of solution marketing at NICE Systems. In August 2012 he founded OLSET, a big data company that personalized travel booking, and went through the 500 Startups accelerator with it from October 2013. 500 Startups, now 500 Global, is an early-stage venture fund and seed accelerator founded in 2010 by Dave McClure and Christine Tsai (Wikipedia). He ran Deem’s car service business from 2016, and in April 2018 he became chief revenue officer at Stitch Labs, which made inventory software for growing brands.
That was the job he had when the next company started.
“But I was the CRO of another company at the time. We were just about to sell that company, and I started discussions with my two co-founders, Shoham and Bar, who had an idea.”
Gadi Bashvitz, at 1:34
His LinkedIn has him as president and chief customer officer of NeuraLegion from November 2019, the month his Stitch Labs role ended, and as CEO of Bright from January 2022. Later in the episode he put a number on the habit.
“I actually tell my co-founders this all the time, I must be much dumber than you guys, because this is my fourth startup, and I keep on doing it again and again and again, despite how hard it is.”
Gadi Bashvitz, at 22:33
An AI fuzzer in 2018
The idea wasn’t Gadi’s, and he said so first.
“So the idea actually came from Bar, who’s our CTO, an experienced both CTO and CISO.”
Gadi Bashvitz, at 1:47
“And he was seeing the writing on the wall that AI is going to start becoming a very interesting thing, way back in 2018.”
Gadi Bashvitz, at 1:53
“And the original idea was, can we create an AI-driven fuzzer that will use biological evolution techniques in order to find zero-day vulnerabilities?”
Gadi Bashvitz, at 2:02
Each piece of that sentence has a plain meaning. Fuzzing is an automated testing technique that feeds a program invalid, unexpected or random inputs and watches for crashes and failing assertions (Wikipedia). The name goes back to a 1988 class project in Barton Miller’s graduate operating systems course at the University of Wisconsin, which fed random input to UNIX utilities. Borrowing from biology is an old move in computing too. Evolutionary algorithms reproduce essential elements of biological evolution to solve hard problems (Wikipedia), and a genetic algorithm is one kind, a method inspired by natural selection (Wikipedia). A zero-day is a vulnerability unknown to the people who could fix it (Wikipedia).
Bar Hofesh wrote the company’s own version of this in October 2026. After about a year of research into what he calls bio-mimicry and evolutionary behavior, NeuraLegion released “an AI guided fuzzer way before AI was cool,” a structural fuzzer that needed no dictionary and used an evolutionary algorithm to home in on hard-to-find bugs (Bright Security). The product, NexPloit, won first place as the most interesting technology at Israel’s CyberTech conference in 2019, by Bright’s account. TechCrunch’s account of the company’s start matches: NeuraLegion launched in 2018 with an AI-powered fuzzer that helped developers find and fix potential exploits (TechCrunch).
How the founders met got its own moment. Gadi met Bar through Shoham Cohen, the third co-founder and COO.
“And Shoham and I go back to kindergarten.”
Gadi Bashvitz, at 2:23
“That’s awesome. I’ve heard a lot of different ways the founders have met their co-founders, and I think that might be a first.”
Jon McLachlan, at 3:58
Bright’s About Us page lists the three today as co-founder and CEO, co-founder and CTO, and co-founder and COO (Bright Security). When the company renamed itself in 2022, Gadi’s own post named a fourth founder, Art Linkov, alongside them (Bright Security).
Cool technology, no market
The fuzzer was good, and it didn’t sell. Gadi didn’t soften it.
“What we learned in the first couple of years is that, well, we were building really cool technology, that it was cool technology. And unfortunately, the market wasn’t really there, but it was a very small team of people, the fanatics in the positive way, that were very passionate about working together and solving real problems.”
Gadi Bashvitz, at 2:45
He told TechCrunch in 2022 what the problem was. The people who used the original product loved it, he said, but it “crashes any target that it runs against,” so few customers could run it against anything close to production without a lot of coordination (TechCrunch). Bar’s 2026 post adds the other half: the tool drew security agencies and offensive security firms, while the founders wanted to build for enterprise teams. “The only problem was, the world was not yet ready,” he wrote (Bright Security).
So in 2020 they changed direction, toward what customers kept saying. Gadi gave it in the customer’s voice.
“And that was, I’ve been deploying application and API security solutions for many, many years, and yet I’ve not been able to reduce the number of vulnerabilities in my applications, and I’m still getting data breaches, et cetera, et cetera.”
Gadi Bashvitz, at 3:14
“It would be great if there was a solution that could run much earlier in the development lifecycle and have fewer false positives and enabled me to find these vulnerabilities and remediate them before we got into production.”
Gadi Bashvitz, at 3:29
That’s three asks in one sentence: earlier, quieter and fixed before production. The rest of the episode is how Bright went after each one. TechCrunch dates the shift to the company’s 2020 seed round of $4.7 million, by which point it had moved to dynamic application security testing. Bar’s version is shorter: “So we listened to our customers and shifted toward developer-centric DAST.”
Three problems
Jon asked for the magic sauce, and Gadi answered with the problems first. There were three, and the first was timing.
“by the time I found vulnerabilities with the tools that I have in place, which were either dynamic scanning or real-time protection, et cetera, it was too late.”
Gadi Bashvitz, at 4:59
“The vulnerabilities were already in production. And now I’m playing a defense game instead of an offense game, trying to find them and fix them early on.”
Gadi Bashvitz, at 5:10
The second was noise, from tools that read code before it runs.
“Problem number two was that they were deploying other tools like static analysis, and those had a lot of false positives because they’re looking at the code itself.”
Gadi Bashvitz, at 5:45
“They’re not looking at the compiled code. So you’re not looking at true vulnerabilities that exist in a production environment.”
Gadi Bashvitz, at 5:55
Static application security testing reviews source code to find vulnerabilities (Wikipedia). Dynamic application security testing is a process for finding security weaknesses and vulnerabilities in an application (Wikipedia), and TechCrunch’s 2022 story on Bright spells out the dynamic part: finding vulnerabilities in web apps and APIs “by simulating attacks by outside users” (TechCrunch). A false positive, in any test, is a result that says a condition is present when it isn’t (Wikipedia). For a developer, it’s a ticket for a bug that can’t happen.
The third problem was people, and Gadi said the arrival of AI had made it worse. More on that below.
“But the third problem was really around the fact that engineering practices had changed and application security had not kept up.”
Gadi Bashvitz, at 6:12
Sixty times longer
The first problem came with a number, and it’s the number the episode is known for.
“There’s also a fact that if you’re finding a vulnerability in production and you’re trying to fix it, it will take you 60x the amount of time to fix it in production, because the developer is no longer in the code.”
Gadi Bashvitz, at 5:19
“They’ve forgotten what’s in there. Sometimes you don’t even know who wrote that code, et cetera.”
Gadi Bashvitz, at 5:30
Sixty is Gadi’s figure, from his work with customers, and he didn’t cite a study for it. The reason he gave is the part worth keeping, because it doesn’t depend on the multiplier. A fix is fast while the person who wrote the code still has it in their head. Weeks later, someone has to find the code, learn it again and change it without breaking what grew on top of it, and sometimes nobody knows who wrote it.
The practice of moving tests earlier has a name. Shift-left testing means testing earlier in the lifecycle, the first half of the maxim “test early and often,” and Wikipedia credits the term to Larry Smith in 2001 (Wikipedia). Gadi used the idea in 2022 when Bright raised its Series A. For security to shift left, he said in the announcement, “developers need to be comfortable with such tools” (Dark Reading).
One person for two hundred developers
The third problem was arithmetic.
“if you look at a very large financial institution, the ratio between AppSec people and developers is 1 to 200, 1 to 300.”
Gadi Bashvitz, at 6:22
That ratio is Gadi’s, from the banks he sells to. Picture it as a queue. Every developer who needs help with a finding is waiting on the same person, and that person can’t review everything that ships. Gadi said the fix began with a change in how Bright thought about the problem.
“And the big change in our mindset came when we realized that, yes, this is a security concern, but it needs to be addressed as an engineering problem.”
Gadi Bashvitz, at 6:40
“And if you can fix it and address it as an engineering problem, you’ll be able to actually fix it in a much more comprehensive way.”
Gadi Bashvitz, at 6:51
An engineering problem gets engineering answers: put the check where the work happens, make it fast enough that nobody routes around it, and make its output something the person doing the work can act on. The next section is what that meant for a scanner.
Fifteen minutes, not four days
Doing it as engineering meant breaking rules customers still defend, Gadi said. Bright had to take “a completely new approach that nobody had taken before, ignore all of the rules that existed,” and the argument hasn’t ended.
“And they say, no, it’s impossible. In the last 20 years, it was impossible to do it.”
Gadi Bashvitz, at 7:16
“And that means that instead of running scans to find vulnerabilities that will take three days or four days, no, those scans can only run for 15 minutes. That’s the whole time you have.”
Gadi Bashvitz, at 7:23
Fifteen minutes is about what a step in a build pipeline can take before developers start skipping it. Gadi listed what it takes to fit a dynamic scan into that window.
“You have to separate your discovery from your scanning and make sure that you’re discovering continuously in the background and just running incremental or delta scans.”
Gadi Bashvitz, at 7:36
“You have to only scan for the vulnerabilities that could actually manifest based on the technology.”
Gadi Bashvitz, at 7:46
Then he got to the part developers see.
“You have to provide proof of vulnerability for every vulnerability, because, guess what? A developer is not an AppSec specialist.”
Gadi Bashvitz, at 7:54
“They don’t know what it is if you tell them it’s an XSS, right? So you have to give them proof of vulnerability. You have to give them remediation guidelines and really work with them.”
Gadi Bashvitz, at 8:00
XSS is cross-site scripting, a vulnerability that lets an attacker inject scripts into pages other users see (Wikipedia). A proof of vulnerability shows the request that worked and what came back, which turns a label into something a developer can reproduce. Gadi described the same goal when Bright raised its Series A in 2022: “We created a tool that caters to developers as well as AppSec teams” (Dark Reading).
“And that was the initial solution that we launched in late 2021, was really that dev-centric dynamic solution.”
Gadi Bashvitz, at 8:09
From SRE to DevOps
Sasha answered with a pattern from the operations side of engineering.
“Back in the days, we had the entire organization dedicated to SRE. That used to be the name for the infrastructure engineers, but it turns out it doesn’t really scale, and it doesn’t work for many different reasons.”
Sasha Sinkevich, at 8:23
“Now it’s called DevOps organization, and then you expect that organization to totally support without understanding how the core logic of the application is supposed to function under normal and extreme conditions.”
Sasha Sinkevich, at 8:43
Site reliability engineering is the discipline that monitors and improves the availability and performance of deployed software (Wikipedia), and DevOps is the integration and automation of software development and IT operations (Wikipedia). Sasha’s point was the handoff. The people who run the application don’t know how its core logic is supposed to behave, and security has the same shape.
“There is a very similar pattern in the security space, where you have a bottleneck often.”
Sasha Sinkevich, at 8:59
Sasha described that bottleneck as one engineer reviewing everyone’s source code, and then the dependencies on top of it: “And then, if we talk about the supply chain vulnerabilities, that makes the job of a single engineer extremely difficult.” A supply chain attack goes after the less secure parts of what an organization depends on (Wikipedia). Sasha ended with the line Gadi picked up.
“A lot of tools in the market fail to identify what is actually exploitable, remove the noise, and suggest the appropriate steps based on the good security standards, how to remediate it.”
Sasha Sinkevich, at 9:48
Listening to what they’re not saying
Gadi said the pivot left the company with a rule.
“When we decided to make the pivot in 2020, we said one of the core values of us as a company that we learned from our failure is we have to make sure that we’re continuously listening to what our customers are saying, in many cases listening to what they’re not saying, but what they really need, and double-click on that and understand that.”
Gadi Bashvitz, at 10:08
His example was a capability Bright released in 2023, aimed at the static analysis tools its customers already owned.
“We have customers that have deployed static analysis tools, whether it’s Checkmarx or Snyk or whatever it is.”
Gadi Bashvitz, at 10:45
“And we realized that one of the biggest problems they have is all the false positives that they’re getting from those static solutions.”
Gadi Bashvitz, at 10:52
Checkmarx is an application security testing company headquartered in Atlanta (Wikipedia), and Snyk is a developer-oriented security company founded in 2015 out of Tel Aviv and London (Wikipedia). Gadi named them as examples of what customers run, not as targets. Bright pulled the results from those tools through an API and tried to reproduce each finding with a dynamic scan. Then he gave the numbers.
“You found 120 vulnerabilities in this application. We were able to run a dynamic scan just looking to correlate those 120. We found 80 of those. By the way, these numbers are from a real customer.”
Gadi Bashvitz, at 11:13
“Out of those 80, we were able to provide proof of vulnerability for 20. And out of those 20, 11 were critical, high, medium.”
Gadi Bashvitz, at 11:30
“So within a couple of hours of getting a result of a static scan, we were able to tell a developer, look, there’s 120 here. These are the 11 you should fix right now.”
Gadi Bashvitz, at 11:39
Run the arithmetic and the point is plain. Of 120 findings, 11 are about 9%. The other 109, Gadi said, “can go into a different cycle, and they can be dealt with in the longer term.” That doesn’t make them false. It means the 11 with a working exploit and a real severity go first, and the developer gets a list short enough to finish. Bright wrote up the approach in June 2024 as a bridge between static and dynamic testing, in which organizations “harness their existing SAST solutions in tandem with Bright’s DAST” (Bright Security). The post calls it IASTless IAST, after interactive application security testing, a third approach that detects vulnerabilities by interacting with a program, coupled with observation and sensors (Wikipedia).
The calculator below runs your own numbers through the same steps.
Technical bugs and business logic
Gadi split the vulnerabilities Bright looks for into two kinds.
“The first part are technical vulnerabilities. So that can be SQL injection and XSS and file upload and file inclusion and all sorts of, like, a very broad set of the OWASP Top 10, whether for APIs or for applications.”
Gadi Bashvitz, at 12:08
“But there’s a whole different set of vulnerabilities that are business logic vulnerabilities, like privilege escalation, that are not technical vulnerabilities.”
Gadi Bashvitz, at 12:23
The first kind has textbook entries. SQL injection slips database commands into an input field (Wikipedia). A file inclusion vulnerability lets an attacker control which file an application executes (Wikipedia). OWASP, the Open Worldwide Application Security Project, is an online community, founded in 2001, that publishes open resources on application security, the Top 10 list among them (Wikipedia).
The second kind lives in the rules of the application. Business logic is the part of a program that encodes the real-world rules for how data can be created, stored and changed (Wikipedia). Privilege escalation is using a bug, a design flaw or a configuration oversight to get access you shouldn’t have (Wikipedia). Nothing in the request looks malformed. A user just reaches a record, a refund or an admin action that the business never meant them to reach. Bright’s 2022 announcement already promised coverage for “both technical and Business Logic Vulnerabilities” (Dark Reading), and Gadi tied that to where the company came from.
“And because of our fuzzing history, we included business logic vulnerabilities very early on in what we deployed, which became the basis of very quickly being able to add LLM vulnerabilities.”
Gadi Bashvitz, at 12:44
OWASP started its Gen AI Security Project in 2023 to extend its Top 10 to the most critical risks of large language models (Wikipedia). The risks are new kinds of input. Prompt injection, for one, uses inputs designed to cause unintended behavior in a large language model (Wikipedia). Gadi expected that list to keep moving.
“And then there’s a debate, are those the right top 10? Are they not? And that’s going to change.”
Gadi Bashvitz, at 13:07
He tied it back to Sasha’s point: the tests that matter aren’t only technical, and the job isn’t finished when a finding is found. The question, Gadi said, was also “how do you enable organizations to remediate those as well.”
Who pays and who uses it
Sasha asked who the customer was. Gadi said the answer was moving.
“The answer to your question is a shifting answer, and I’ll explain why.”
Gadi Bashvitz, at 13:55
“Realistically, the budgets are coming from the security world.”
Gadi Bashvitz, at 14:00
“However, more and more we’re seeing that the actual users are the developers.”
Gadi Bashvitz, at 14:14
“So we’re looking at it, and we’re seeing that the AppSec team becomes basically the bookends. They’re the ones that define the strategy. They’re the ones that do the validation and the reporting later.”
Gadi Bashvitz, at 14:19
“But the actual work is being done more and more by developers. It’s integrating into their unit tests, it’s integrating into their CI, and they’re the ones taking action to remediate and fix vulnerabilities.”
Gadi Bashvitz, at 14:30
A unit test checks one isolated piece of code against the behavior it should have (Wikipedia), and continuous integration merges changes often and checks the result automatically (Wikipedia). Those are the places developers already look. A security check that lives there gets seen, and one that lives in a separate dashboard waits for the AppSec team. Gadi added that the money was starting to follow the work.
“We’re starting to see a shift in that trend, where, in some cases, the budget starts coming from the CTO office and not from the CISO office, or the chief security officer office.”
Gadi Bashvitz, at 14:42
Code nobody wrote
Then he came to the change he’d promised earlier, the one he said had taken the third problem to a new level.
“So if you start looking at tools like GitHub Copilot and Augment AI, right, and other tools like that that are code generation tools, they introduce a whole new challenge into the world that we operate in”
Gadi Bashvitz, at 15:25
GitHub Copilot is the code completion assistant GitHub first announced on June 29, 2021 (Wikipedia). One disclosure here: YSecurity ran Augment’s SOC 2 Type 2 and ISO 42001 programs, and people from Augment have told its story on this show twice, on episode 43 and episode 74. The example was Gadi’s, not ours. His reasoning was about where these tools learned to code.
“And that open source content is not aware of security, which means the code that is being generated by these AI tools is vulnerable. And it’s actually 4x more prone to vulnerabilities than human-generated code.”
Gadi Bashvitz, at 15:55
The 4x figure appears in a Bright blog post from June 2024, which attributes it to Gartner: “AI-generated code is 4X more prone to security vulnerabilities, according to Gartner” (Bright Security). We couldn’t find the Gartner research itself, so read it as Bright’s citation of an analyst number, not as a measurement anyone published in the open. Gartner is a research and advisory firm (Wikipedia). The mechanism Gadi described doesn’t depend on the multiplier: a model learns from the code it was trained on, and much of that code was never written with security in mind.
Unit tests for code you didn’t write
Bright’s answer started with a partnership, by Gadi’s account.
“We started by having an agreement or a partnership with Microsoft in May last year to be able to test AI-generated code that was generated with Copilot.”
Gadi Bashvitz, at 16:13
“we have this component called SecTester in our products that can generate security unit tests, because we realize that developers don’t really understand security, so we need to give them the tool to do that.”
Gadi Bashvitz, at 16:29
The public record has the product side of this. In June 2024 Bright described “Bright for Copilot,” an LLM-powered security unit testing extension for GitHub Copilot that “puts DAST in the hands of developers at the IDE and unit testing levels” (Bright Security). The month before, on May 21, 2024, Microsoft had introduced Copilot Extensions, third-party add-ons for GitHub Copilot, at its Build developer conference (InfoWorld). InfoWorld’s list of launch partners doesn’t include Bright, so the agreement Gadi dated to that May is his account. Microsoft Build is the company’s annual conference for developers, first held in 2011 (Wikipedia).
The pitch to a developer is short.
“You don’t know what’s in that code. It was AI generated, but trust us, we already know what’s in that code.”
Gadi Bashvitz, at 16:59
Bright reads the generated code, tells the developer which security unit tests to run and with which payloads, and the developer runs them. Then they noticed it didn’t have to stop at generated code.
“It’s not just for AI-generated code. It’s for human-generated code as well.”
Gadi Bashvitz, at 17:23
As long as the AI tool sits in the developer’s environment, Gadi said, Bright can guide it on which tests to write for code a person wrote too. Bright’s February 2025 post describes SecTester as its security unit testing library, with support for Go, JavaScript, TypeScript and .NET among other languages (Bright Security).
Fix it, then prove the fix
The last step was the one Gadi called new.
“Let’s be honest. Developers don’t want to sit there and fix vulnerabilities, right?”
Gadi Bashvitz, at 17:47
So Bright goes back to the AI tool and guides it on how to fix what was found. Then it checks.
“But much more importantly, because we’re a dynamic solution, we can then test that that fix actually remediated the security risk.”
Gadi Bashvitz, at 17:59
That closes the loop the episode started with. A static tool can suggest a fix, but it can’t run the application to see whether the attack still works. A dynamic test can run the same attack again. Gadi was careful about where it stood.
“That last part of auto-remediation and testing it, that’s very, very new. That’s just in some pilot customers right now. Again, it’s planned to be released by the middle of the year.”
Gadi Bashvitz, at 18:19
He started to call it a game changer and said game tester first, then fixed it, and the slip fit the product. “We’re getting into the automated testing and remediation realm, which is super exciting to us,” he said.
It shipped ahead of that schedule. Bright introduced the platform as Bright STAR on February 11, 2025, short for “Security Testing & Automated Remediation” in that post, which lists four steps: generate security unit tests for a codebase, run them, generate fixes with AI, and validate the fixes with the same tests (Bright Security). Bright launched it at RSA Conference 2025 on April 28, where the release spelled the name out as “Autonomous Security Testing and Remediation” (Bright Security). In that release Gadi said customers using it were seeing “automatic remediation rates of approximately 85% of vulnerabilities found.” That’s the company’s own number. The product page now describes a platform that “finds, fixes, and validates real vulnerabilities early in the SDLC” (Bright Security).
Enterprises first
Sasha asked whether the traction was with small companies or large ones.
“What do you see the main customer from the SMB or enterprise point of view? What is your biggest traction point in this market?”
Sasha Sinkevich, at 18:44
“So far, it’s definitely been enterprise. So large banks, large financial institutions, leading insurance companies, technology companies”
Gadi Bashvitz, at 18:56
He gave two reasons. Large companies have the most to lose, “understanding that their reputation is so critical to them, that it’s important to find these vulnerabilities early and prevent them from actually manifesting.” And dynamic testing takes setup.
“The other side of it, honestly, is that deploying a dynamic solution is not an easy thing. You need to have the right authentication and the right credentials. You need to be able to get to all of your targets.”
Gadi Bashvitz, at 19:30
A scanner that can’t log in sees the login page and nothing else, and one that can’t reach a service can’t test it. Big organizations have teams to arrange both. Gadi expected the automated version to change who could buy.
“Saying that, I think that as we launch this auto-detect and auto-remediate solution, it’s going to open up the aperture to a lot more organizations to adopt it.”
Gadi Bashvitz, at 19:48
Bright’s 2022 announcement counted developers at more than 4,000 organizations signed up to its cloud service and more than 50 large enterprise customers (Dark Reading). Those numbers are from three years before the recording.
Not yet the proudest moment
Jon thanked Gadi for bringing new technology to old problems, then asked for his proudest moment.
“And I’m super grateful that there are amazingly gifted and talented and smart entrepreneurs willing to take the risk, explore this application of new technology onto some very old problems.”
Jon McLachlan, at 20:02
“I don’t think I’ve gotten to the proudest moment yet. I think we’re still on the journey itself.”
Gadi Bashvitz, at 20:27
He listed the proud moments along the way instead, and the first one wasn’t a signature.
“It’s not landing the customer, that’s the fun, but it’s getting that positive review from that customer is a very proud moment.”
Gadi Bashvitz, at 20:49
The reviews he meant were on G2 and Gartner Peer Insights. G2 is a Chicago company that runs an online marketplace and review site for business software (Wikipedia), and Gartner Peer Insights is the review site run by Gartner, the research and advisory firm (Wikipedia). The rest of his list was people: a partner who said the integration made their own product better, and good words from an investor or a team member.
“Getting really good feedback from a partner that we’ve implemented and integrated with, and they said, like, wow, your product really made our solution better with our customers.”
Gadi Bashvitz, at 20:57
Jon liked the answer.
“You feel the hunger to drive and to move forward and to make the world a better place. It’s always in front of us as entrepreneurs.”
Jon McLachlan, at 21:20
Five hundred noes a week
Jon asked for the hardest thing Gadi had done as a founder. The answer wasn’t one event.
“The hardest thing is staying positive and staying consistent no matter what happens, and constantly being tenacious and not giving up.”
Gadi Bashvitz, at 21:43
“And you will hear no 500 times a week, and you just can’t let it affect you.”
Gadi Bashvitz, at 21:53
He said that’s where co-founders earn their place. Alone it’s much harder, he said, and with co-founders you trust, someone is up when you’re down. The kindergarten friendship from the first section is the long version of that.
“And as long as you can talk about it and support each other, that’s a critical, critical thing that a lot of people underestimate.”
Gadi Bashvitz, at 22:16
Know what you’re getting into
Jon asked what Gadi would tell his younger self. Gadi said he was the wrong person to ask, because he’d done this three times before and knew what he was signing up for. That’s the fourth-startup line from the first section. So his advice went to everyone else.
“Understand that there are no weekends, there are no vacations, there is nothing like that.”
Gadi Bashvitz, at 23:14
“And you’re still concerned about, how do I make payroll tomorrow? Or how do I make payroll next month? Or how do I make payroll in three months?”
Gadi Bashvitz, at 23:40
His bar for being done was specific: “because until you’re a large, profitable company, you haven’t made it.” And he closed the answer the way he opened it.
“I think the advice I would give myself and any other entrepreneur is just know what you’re getting into, because you’re saying goodbye to your weekends and your vacations and anything else like that until you’re on the other side of this journey.”
Gadi Bashvitz, at 23:50
Jon took it from there.
“So speaking of making it worth it, what legacy would you like Bright Security to leave?”
Jon McLachlan, at 24:08
An ounce of prevention
Gadi’s answer started with what hasn’t worked.
“In the end, it’s the understanding of the way we have been doing things just doesn’t work.”
Gadi Bashvitz, at 24:25
He gave the industry credit for real progress, then said the problem isn’t solved, and named the goal he knows is out of reach.
“And I’d like to get to the point where, and I know it’s a utopia because we’re not going to get there”
Gadi Bashvitz, at 24:47
The point he meant is one where vulnerabilities in applications and APIs are a thing of the past.
“That ounce of prevention versus the pound of cure that we have to deploy later.”
Gadi Bashvitz, at 25:00
It’s the old proverb, and it’s the whole episode in a line. The ounce is a test that runs while the developer is still in the code. The pound is the sixty-times fix, the breach, the incident review. Gadi added Sasha’s point about what tools can’t do by themselves.
“There’s the age-old people, process, technology.”
Gadi Bashvitz, at 25:29
It’s not just the right solutions, Gadi said. Train the people correctly, and have the right processes in place to make sure the work actually gets done. And the legacy he wanted was a measurable one: “we made a dent, right? A lot more organizations are now deploying secure applications and APIs before they get to production.”
Two hundred and fifty Slack messages
Jon asked what tool Gadi wished someone would build, for the founders who listen to the show.
“is there any, like, tool or service that you just wish existed, and someone could just go off and build, like, right now, and you would absolutely be the first customer?”
Jon McLachlan, at 26:03
His first answer was more hours.
“So I would say if somebody was able to find me more time in the day and free up more time somehow, that would be the best tool possible.”
Gadi Bashvitz, at 26:23
His second was a better way to distill what the company says to itself, across sales, marketing, development, product, customer success and the CISO’s team, much of it on Slack and tools like it.
“So understand what is actually important to me from the 250 Slack messages that I get a day and highlight those to me in an effective way.”
Gadi Bashvitz, at 27:11
It’s the same idea as the 120 findings, pointed at a CEO’s inbox: out of everything that arrives, show me the few that matter today.
RSA, BSides and brightsec.com
Sasha asked where listeners could meet Gadi.
“So we were just talking before we started recording on the fact that we are presenting at RSA. We’re sponsoring RSA. We’re sponsoring BSides San Francisco.”
Gadi Bashvitz, at 27:30
RSAC Conference, formerly the RSA Conference, began in 1991 as a small cryptography conference (Wikipedia), and BSides is a series of loosely affiliated security conferences (Wikipedia). He also had regional events in Orlando and Denver on his calendar, and he pointed people to brightsec.com, where Bright posts its events.
What happened after the tape
On air. The episode aired on April 22, 2025 (Podbean), and it’s also on Apple Podcasts and Spotify.
Bright STAR. Six days later, on April 28, 2025, Bright launched Bright STAR at RSA Conference 2025, at booth N-4227 (Bright Security). It was the auto-detect and auto-remediate product Gadi described on the tape, and it arrived ahead of the mid-year date he gave.
A competition and an award. On April 23, 2026, Bright was named the winner of the Google Cloud and Google for Startups AI Competition at HumanX, “outperforming 1,420 AI startups worldwide” by the release’s count, and received the “Next Gen AI Security” award at the Global InfoSec Awards 2026 (PR Newswire). “As AI accelerates development, security must move beyond assumptions,” Gadi said.
GitHub AgentHQ. On June 3, 2026, Bright announced that its agent had been chosen for GitHub AgentHQ (Bright Security), which puts it inside the developer workflow Gadi said the work was moving into.
The fuzzer comes back. On October 8, 2026, Bar Hofesh wrote that “technology has caught up to our original vision” and that Bright was reintroducing the 2018 fuzzer as the Bright STAR Fuzzer (Bright Security). Later that month he posted one of its finds.
One more Bright fuzzer finding, and this one was really cool! 38 bytes turn into a multi-gigabyte memory allocation on the attacked server. taking down a while enterprise site with a tiny picture.
38 bytes. 33 million array entries.
Bar Hofesh · October 25, 2026
Gadi reshared it with a line of his own: it’s important to take an approach that finds unknown vulnerabilities, he wrote, and not just rely on LLMs (LinkedIn). The idea from 2018 that the market wasn’t ready for is back in the product, eight years and one pivot later.
The part of the conversation that aged best is the plainest. Find the bug while the person who wrote it still remembers writing it. Prove it’s real before you ask anyone to fix it. Rank what’s left by whether it can be exploited, not by how many tools flagged it. And when something fixes it for you, a person or an AI tool, run the attack again before you believe it.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
How much longer did Gadi say it takes to fix a vulnerability found in production?
- Twice as long
- Sixty times as long
- Ten times as long
b. "it will take you 60x the amount of time to fix it in production" Transcript, 5:25.
-
What ratio of AppSec people to developers did Gadi describe at a very large financial institution?
- 1 to 200, or 1 to 300
- 1 to 20
- 1 to 2,000
a. "the ratio between AppSec people and developers is 1 to 200, 1 to 300." Transcript, 6:26.
-
How long did Gadi say a dynamic scan can run?
- Three or four days
- An hour
- Fifteen minutes
c. "no, those scans can only run for 15 minutes." Transcript, 7:30.
-
Of the 120 static findings in Gadi's example, how many did he tell the developer to fix right now?
- 80
- 11
- 20
b. "These are the 11 you should fix right now." Transcript, 11:46.
-
Who did Gadi say were becoming the actual users of AppSec tools?
- Developers
- Auditors
- The board
a. "However, more and more we're seeing that the actual users are the developers." Transcript, 14:14.
-
What did Gadi say about his proudest moment?
- It was closing the Series A
- It was the company's rename
- He hasn't had it yet
c. "I don't think I've gotten to the proudest moment yet." Transcript, 20:27.
Still in the code?
Gadi’s test for an AppSec program was when and how it fixes what it finds. Eight questions on how early your team gets there.
Scorecard · eight questions
Still in the code?
Answer for your teams as they work today. If two answers fit, pick the lower one.
-
Where does your team find most of its vulnerabilities?
- In production, from a pentest, a bug report or an incident
- In staging, from a scan before release
- In the pull request or the build, while the author still has the code open
"it will take you 60x the amount of time to fix it in production, because the developer is no longer in the code." See Sixty times longer.
-
What does a developer get along with a security finding?
- A label and a severity
- A description and a link to a guide
- Proof the vulnerability works, plus remediation guidance for their stack
"So you have to give them proof of vulnerability." See Fifteen minutes, not four days.
-
How long does the security check in your pipeline take?
- Hours or days, so it runs outside the pipeline
- Under an hour, on some builds
- Minutes, on every build, with incremental scans
"those scans can only run for 15 minutes. That's the whole time you have." See Fifteen minutes, not four days.
-
What happens to the findings from your static analysis tool?
- They pile up in a backlog nobody trusts
- Someone triages them by hand
- Each is checked for whether it can be exploited, and the confirmed ones go first
"These are the 11 you should fix right now." See Listening to what they're not saying.
-
Do you test for business logic flaws, like one user reaching another user's data?
- No, only technical bugs
- In a yearly pentest
- In automated tests that run with the build
"But there's a whole different set of vulnerabilities that are business logic vulnerabilities, like privilege escalation, that are not technical vulnerabilities." See Technical bugs and business logic.
-
How do you test code that AI coding tools write?
- The same as everything else, or not at all
- It gets a human code review
- Security tests are generated for it and run before merge
"You don't know what's in that code." See Unit tests for code you didn't write.
-
After a fix, how do you know it worked?
- We close the ticket
- A reviewer reads the change
- The same test or attack runs again and no longer works
"we can then test that that fix actually remediated the security risk." See Fix it, then prove the fix.
-
Who does the security work in your engineering teams?
- Only the security team
- Security, with developers pulled in for fixes
- Developers do the work, and security sets the strategy and checks the results
"So we're looking at it, and we're seeing that the AppSec team becomes basically the bookends." See Who pays and who uses it.
Most of what you find, you find late, when it costs the most to fix. Start with one check that runs on every pull request and comes with proof, and route the confirmed findings to the person who wrote the code.
Some of your testing runs early and some still waits for staging or a yearly test. Cut the slow scans down to what fits in a build, check static findings for whether they can be exploited, and test the fixes.
Your team finds and fixes most issues while the code is fresh. Keep the checks fast, cover business logic and AI-written code, and make sure every fix gets tested again.
Which of your findings need fixing today?
Gadi’s example came from a real customer: 120 static findings, 80 a dynamic scan could confirm, 20 with proof of vulnerability, 11 critical, high or medium. The defaults below are those numbers as rates. Put in your own, and the hours show what Gadi’s sixty times means for the ones that matter.
Calculator
Which of your findings need fixing today?
Six numbers: your static findings, the share a dynamic scan confirms, the share of those with proof, the share of proven ones that are critical, high or medium, the hours one fix takes while the code is fresh, and the production multiplier.
Of 120 static findings, a dynamic scan confirms 80, 20 come with proof, and 11 are critical, high or medium. Fixing those 11 now takes about 22 hours. If they reach production first, the same fixes take about 1,320 hours, and the other 109 can wait for a later cycle.
The first four defaults are Gadi's real-customer example from Listening to what they're not saying, written as rates: 80 of 120 is 67%, 20 of 80 is 25%, 11 of 20 is 55%. The sixty is his multiplier from Sixty times longer. The two hours per fix is an example, not a figure from the episode. Each step rounds to a whole finding.
From a 1988 class project to the STAR Fuzzer
Everything on this page sits on one timeline, from the class project that named fuzzing to Bright bringing its own fuzzer back. Filter it by thread.
Timeline · 1988 to 2026
From a 1988 class project to the STAR Fuzzer
Filter by thread. Dates are from the public record except where marked as part of this show.
- Fuzz
Barton Miller's graduate class at the University of Wisconsin feeds random input to UNIX utilities, the project that gave fuzzing its name (Wikipedia, on this show).
- OWASP
The Open Worldwide Application Security Project is founded (Wikipedia, on this show).
- Shift left
Larry Smith coins the term shift-left testing (Wikipedia, on this show).
- Verint
Gadi starts six years in product management and enterprise engagements (LinkedIn, on this show).
- Merced Systems
He runs business development, then Asia Pacific and Latin America, until 2011 (LinkedIn, on this show).
- OLSET
He founds a big data company for travel booking, and takes it through 500 Startups from October 2013 (LinkedIn, on this show).
- NeuraLegion
The company launches with an AI-guided fuzzer built on an evolutionary algorithm (Bright Security, on this show).
- Stitch Labs
Gadi becomes chief revenue officer, until November 2019 (LinkedIn, on this show).
- CyberTech
The fuzzer, NexPloit, wins first place as the most interesting technology at Israel's CyberTech conference, by Bright's account (Bright Security, on this show).
- President and chief customer officer
Gadi joins NeuraLegion full time (LinkedIn, on this show).
- The pivot
A $4.7 million seed round, and a shift to dynamic testing for developers, with the first dev-centric product out in late 2021 by Gadi's account (TechCrunch, on this show).
- GitHub Copilot
GitHub first announces its AI coding assistant (Wikipedia, on this show).
- CEO
Gadi becomes CEO (LinkedIn, on this show).
- Bright Security
NeuraLegion renames itself and raises a $20 million Series A led by Evolution Equity Partners (Dark Reading, on this show).
- OWASP and LLMs
OWASP starts its Gen AI Security Project to extend the Top 10 to large language models (Wikipedia, on this show).
- Checking static findings
Bright releases its correlation of static findings with dynamic scans, by Gadi's account, written up in June 2024 (Bright Security, on this show).
- Copilot Extensions
Microsoft introduces third-party extensions for GitHub Copilot at Build (InfoWorld, on this show).
- Bright for Copilot
Bright describes its security unit testing extension for GitHub Copilot (Bright Security, on this show).
- Fortune Cyber 60
Bright is named to the 2025 list in the early-stage category (Bright Security, on this show).
- The recording
Jon and Sasha talk with Gadi while auto-remediation is in pilots (on this show).
- Bright STAR
Bright introduces the platform, short for Security Testing and Automated Remediation (Bright Security, on this show).
- Episode 67 airs
The episode goes out on Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- STAR at RSA
Bright launches Bright STAR at RSA Conference 2025 (Bright Security, on this show).
- HumanX
Bright wins the Google Cloud and Google for Startups AI Competition at HumanX (PR Newswire, on this show).
- GitHub AgentHQ
Bright's agent is chosen for GitHub AgentHQ (Bright Security, on this show).
- The STAR Fuzzer
Bar Hofesh writes that the 2018 fuzzer is coming back (Bright Security, on this show).
- 38 bytes
He posts a fuzzer finding that turns 38 bytes into a multi-gigabyte memory allocation (LinkedIn, on this show).
What to do this week
Five things, in the order Gadi’s argument suggests.
- Find out where you find things. Pull the last quarter’s security findings and mark where each was found: pull request, build, staging or production. The production share is the one Gadi’s sixty times applies to.
- Make the pipeline check fast enough to keep. If a scan takes longer than a build step can, split discovery from scanning and run incremental scans, so it fits in the fifteen minutes Gadi described and nobody turns it off.
- Check static findings before you assign them. Take the open findings from your static analysis tool, confirm which ones can be exploited, and send developers the short list with proof. The calculator above shows how short it might be.
- Test what AI writes, and test the fix. Add security tests for code from AI coding tools before it merges, and after any fix, run the test or the attack again before you close the ticket. The scorecard covers the rest.
- Get help with the parts you can’t staff. One AppSec person can’t cover two hundred developers. Our Secure AI SDLC & Engineering team can build the checks into your pipeline, our AI-Accelerated Vulnerability Remediation Program can burn down the backlog, and you can book 15 minutes with us.