XBOW

A Chrome full chain used to take a team of four six to nine months. XBOW built one in six days, for about $40,000 in model time, and Google awarded it $250,000. In this session, Brendan Dolan-Gavitt walks through the two chains behind it: one human-driven that lost to a bug collision, and one orchestrated with AI agents and built to survive one. Watch it on demand.

Where does the testing run? What's in scope? Will your auditor accept the results? Questions worth answering before any AI pentest goes near production. The buyer's guide gives you the eleven to ask every vendor before you sign. Get the guide.

NIS2 doesn't tell you to run a pentest. It tells you to demonstrate that your controls work, and to be able to show the board. Before you choose an AI pentesting vendor, know what evidence to ask for. Our buyer's guide gives you the eleven questions to put in front of every vendor, what a finding trace should look like, and what the report should show. Download the buyer's guide.

Building a full-chain exploit against Chrome used to take elite teams months. XBOW did it in six days with a publicly available AI model, and earned a $250,000 bounty from Google. On October 28, Brendan Dolan-Gavitt walks through how the chain was built, and what falling exploit costs mean for defenders. Register in two clicks.

Building a full-chain exploit against Chrome used to take elite teams months. XBOW did it in six days with a publicly available AI model, and earned a $250,000 bounty from Google. On October 28, Brendan Dolan-Gavitt walks through the two chains behind it: one human-driven that lost to a bug collision, and one orchestrated with AI agents and designed to survive one. If software this hardened falls this fast, the clock on yours is already running. Register now.

If your team is struggling to see which vulnerabilities actually matter, Moderna had that same challenge. Findings were coming from bug bounties, pentests, and internal assessments, and every issue looked critical. See how Moderna shifted from CVSS scores and vulnerability queues to exploit proof and attack paths, giving teams a clear view of what to fix first.