Automated systems can surface vulnerabilities within minutes, yet they cannot consistently determine which findings pose serious risk to the affected organization. In a Help Net Security interview, HackerOne CEO Kara Sprague argues that human judgment remains the decisive advantage in AI-assisted vulnerability research.
That advantage is acquiring economic weight. Security programs are rewarding critical and original discoveries more heavily while assigning little or no payment to routine, duplicate and easily automated submissions.
AI changes the research workload
AI is strongest when it can recognize familiar weaknesses and apply that knowledge across many targets. This gives bug bounty programs broader coverage without requiring every tester to perform repetitive searches manually.
Detection, however, is only one part of determining risk. A researcher must understand the intended workflow, identify any deviation from it and describe what an attacker could realistically accomplish. A flaw tied to refunds, approvals or account activity may depend on several individually permitted actions rather than one obvious technical defect.
Business logic flaws illustrate the limitation. Their significance often comes from how an organization operates, not from an unusual piece of code. AI can assist with testing and analysis, but it remains less dependable when the conclusion requires knowledge of the business process and the people who rely on it.
The research community is already changing direction. HackerOne’s 2026 Security Research Report found that 85% of respondents were actively developing their AI skills. Another 68% said AI had encouraged them to pursue more complicated vulnerabilities associated with larger rewards, while 72% named business logic flaws as their fastest-growing category.
More reports, less value for routine findings
The security crowd is not disappearing, but its role is shifting. Human researchers bring different assumptions and testing strategies, giving them a better chance of approaching a target from an unexpected direction. Multiple AI systems do not automatically supply that same diversity, particularly when they share similar training material and examine identical systems.
Routine findings are consequently becoming less attractive to bounty programs. Automation lowers the cost of discovering common weaknesses, and increased competition makes a finding less likely to be the first accepted submission. Even an unchanged advertised reward can therefore become less attractive in practice.
HackerOne’s figures show the imbalance. From the January 2025 baseline, submissions increased 2.8-fold, while accepted reports grew 1.9-fold. Accepted reports now represent a smaller portion of the total. Programs are concentrating more money on critical and original discoveries while paying little or nothing for low-severity issues, duplicates and reports that automation can readily reproduce.
Money has not disappeared from the market. Researcher compensation climbed 26% year over year during the first half of 2026 and accelerated again during the following quarter. The change concerns the relationship between effort and payment: greater total spending is accompanying lower returns for work that becomes routine.
AI is also changing the target environment. The number of HackerOne programs with AI assets in scope doubled over two years, and valid reports involving AI vulnerabilities rose 222%. As programs evaluate larger volumes, confirming which findings deserve action becomes an increasingly important part of the process.
Why it matters
The clearest benefit is broader discovery. The trade-off is that automation can generate more evidence than security teams can absorb. Roughly 70% of security leaders said validated findings were entering their backlogs more quickly than internal teams could resolve them. Improving discovery without improving validation and remediation simply creates a more detailed queue of unresolved risks.
There is also a commercial risk for researchers. Routine medium-severity issues may earn less because tools can find them cheaply, even if a vulnerability remains worth repairing. Researchers who rely on pattern-based discoveries alone may therefore encounter lower rewards and greater competition. Those who can connect a technical behavior to a plausible business consequence become more difficult to replace.
This does not make human verification optional. It makes it more valuable. AI can assist with producing and refining a report, but platforms may still struggle to determine whether a person, a model or a combination of both produced it. Reviewing duplicates, spam, out-of-scope material and reports missing essential details also consumes time that would otherwise go toward assessing significant findings.
Lower-cost discovery helps attackers as well as defenders. That means a medium-severity flaw cannot be dismissed merely because its bounty has fallen. Programs use rewards to reveal risks, while security teams still need to decide which validated issues warrant remediation.
Who should care
Researchers should shift attention toward vulnerabilities that require contextual understanding. Business-process abuse, account takeovers requiring multiple steps and original findings with credible consequences offer a stronger path to rewards than discoveries that standard automation can reproduce. Clear documentation of impact is especially important as submissions become more competitive.
Security leaders should focus on the flow of work rather than submission totals alone. More incoming reports do not remove the need to verify claims, assign priority and coordinate fixes. The relevant measure is how quickly validated risks move from discovery to resolution, not how many raw submissions the program receives.
Program managers should watch the gap between report volume and confirmed findings. Stronger review standards can prevent duplicates and low-value material from consuming the time needed to assess important issues. Payment decisions also matter: if automated reports receive less while critical and original discoveries command more, researchers have a clear incentive to develop deeper technical and business judgment.
What to watch next
The key indicators are submission growth, the proportion of valid findings and the value attached to each category. Continued divergence between total submissions and accepted reports would suggest that filtering and triage remain under pressure.
The longer-term contest is unlikely to be between humans and AI as separate categories. It will be between programs that use automation intelligently and those that mistake a larger pile of findings for better security. Models can accelerate the search, but people must still connect the technical evidence to the organization’s real exposure and make a defensible case for action.
Key takeaways
- AI makes routine vulnerability discovery faster, cheaper and more competitive.
- Business context remains essential for assessing a flaw’s real-world consequences.
- Routine and medium-severity findings may earn less even while overall bounty spending increases.
- Security teams need stronger triage and remediation capacity as report volumes expand.
- Researchers can distinguish their work by documenting credible impact rather than only technical symptoms.
Frequently asked questions
Will AI replace human vulnerability researchers?
Kara Sprague does not expect that. People retain an advantage in understanding business operations and judging the consequences of a vulnerability, even as AI expands automated discovery.
Why are routine bug bounty reports worth less?
Common weaknesses are cheaper and faster to uncover with automation. Programs have less incentive to reward them heavily, particularly when duplicate submissions increase competition for payment.
What kinds of bugs are becoming more important?
In HackerOne’s 2026 study, 72% of researchers identified business logic flaws as their fastest-growing category. These issues depend on understanding workflows, approvals and account behavior.
Does a growing report backlog create security risk?
Yes. About 70% of security leaders said validated findings were reaching their backlogs faster than teams could handle them. Additional discoveries without stronger triage and remediation can leave legitimate risks unresolved.