To get in touch about speaking at your event, email [email protected]
Media Packet
1,042 items across 6 categories — press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
100 items · 2020
Press
Threatpost published a bug bounty FAQ feature in September 2020 addressing common questions about bug bounty programs. Ellis provides answers on how these programs function, their value to organizations, and implementation best practices.
Press
Dark Reading published an article on a Supreme Court case examining the legality of security research under the Computer Fraud and Abuse Act. Casey Ellis provided commentary on the Van Buren v. United States case and its implications for how the CFAA applies to security researchers.
Press
Ars Technica reported on online voting vendor Voatz's effort to use the Computer Fraud and Abuse Act to restrict security research into its platform. Casey Ellis opposed the move, arguing that such legal tactics undermine good-faith security research necessary to identify vulnerabilities in critical voting systems.
Press
Dark Reading published coverage of a US Supreme Court case examining the legality of security research under the Computer Fraud and Abuse Act. Casey Ellis provided expert commentary on the case's implications for security researchers and the interpretation of CFAA provisions.
Press
IT World Canada published Casey Ellis's commentary on COVID-19 contact tracing apps in September 2020. Ellis argues that government contact tracing apps require formal vulnerability disclosure programs to build public trust and maintain security standards.
Press
Fortune China published an article examining criticism from security researchers about bug bounty programs and whether they function as genuine security initiatives or public relations exercises. The piece discusses concerns raised by white-hat hackers, including perspectives on the effectiveness and transparency of vulnerability reward platforms in the security industry.
Press
TechCrunch published a story on Facebook's plan to alert third-party developers about vulnerable code in their applications. Casey Ellis commented on the initiative, noting its significance for improving security awareness across the developer ecosystem.
Press
ITWire published a feature in which Casey Ellis outlines a strategic approach to combating the global ransomware problem. Ellis describes the multifaceted solutions he would implement if positioned to address ransomware at scale.
Press
Digital Journal published an article examining Apple's iOS security research device program and its implications for vulnerability discovery. Casey Ellis analyzes the motivations behind Apple's initiative to distribute specially-configured iPhones to security researchers and assesses the program's potential impact on device security.
Press
Digital Journal published an article examining Apple's iOS security research device program and its implications for vulnerability discovery. Casey Ellis analyzes the program's motivations and potential impact on the security research community's ability to identify weaknesses in Apple's platform.
Press
SC Magazine published an article examining legal lessons from Uber's security breach incident and the importance of transparent bug bounty program governance. Casey Ellis discusses how organizations must establish clear, legally compliant bug bounty policies to protect both researchers and the company from liability and misunderstandings.
Press
Infosecurity Magazine reported on charges filed against Uber's former Chief Security Officer over an alleged breach cover-up. Casey Ellis commented on the case's implications for the CISO role and the responsibility of security leaders in corporate governance.
Press
Secure World Expo published an industry news item on federal charges against Uber's former Chief Security Officer for a data breach cover-up. Casey Ellis commented on the case and connected it to the broader evolution of vulnerability disclosure ethics and corporate accountability standards.
Press
SC Magazine reported on FireEye's decision to open its previously private bug bounty program to external security researchers. Casey Ellis contributed to the piece as a bug bounty program expert offering perspective on the company's shift toward broader vulnerability disclosure practices.
Press
A Wall Street Journal article from August 2020 examines potential technology policy shifts under a Biden-Harris administration, addressing antitrust enforcement, data privacy regulation, and Section 230 reform. Casey Ellis contributes perspective on how these policy areas could reshape the technology sector's regulatory landscape.
Press
Bugcrowd hosted a webinar in August 2020 on vulnerability economics and the business impact of security flaws in software. Casey Ellis presented a framework for understanding how organizations should value and prioritize the remediation of discovered vulnerabilities.
Press
Silicon Angle reported on a data exposure incident affecting medical software company Adit, in which 3.1 million patient records were discovered unsecured online. Casey Ellis helped identify the exposure and coordinated its disclosure to the company and relevant authorities.
Press
Clearance Jobs covered the virtual DEF CON 28 hacking conference, which brought together independent hackers and defense officials to strengthen national security practices. Casey Ellis participated in the event, contributing to discussions between the hacker community and government representatives on vulnerability disclosure and defensive security improvements.
Press
Digital Journal published an article examining whether violations of website terms of service should be prosecuted as crimes under the Computer Fraud and Abuse Act. Casey Ellis contributed perspective to the legal debate surrounding enforcement of privacy obligations and the scope of computer fraud statutes.
Press
Google Project Zero shifted its vulnerability disclosure policy away from patch-time requirements to a standardized 90-day deadline, according to Threatpost. Casey Ellis analyzed the implications of the policy change and its effects on the vulnerability disclosure landscape.
Broadcast
Hakluke published a video interview with Casey Ellis on July 31, 2020. Ellis discusses his career path as a developer, the influence of a book on his decision to work remotely, and how that shift enabled him to pursue additional interests.
Press
Apple launched a Security Research Device Program providing specially configured iPhones to vetted security researchers, as reported by SC Magazine. Casey Ellis was among the trusted hackers selected to receive a research phone to identify iOS vulnerabilities.
Press
Digital Journal published an article on a critical vulnerability in SAP's RECON software that could allow unauthenticated attackers unrestricted access to enterprise resource planning systems. Casey Ellis warned about the severity of the flaw and its potential impact on organizations relying on SAP infrastructure.
Press
SC Magazine published an article on a critical 10/10 severity vulnerability in an SAP application affecting approximately 40,000 customers. Casey Ellis commented on the risk and implications of the flaw for organizations using the affected SAP systems.
Papers
A Harvard Belfer Centre paper examines vulnerability rediscovery rates and collision dynamics in government disclosure processes. Casey Ellis contributes analysis on how security researchers and vendors encounter duplicate vulnerability reports, informing policy discussions around coordinated disclosure timelines and resource allocation.
Press
Innovation Bay hosted an online panel discussion on cybersecurity challenges and the current state of digital security for individuals and organizations. Casey Ellis participated in the discussion, sharing perspective on security challenges facing the broader industry.
Press
SC Magazine published an article in which Casey Ellis argues that human hackers will outperform artificial intelligence in offensive security tactics for approximately a decade. Ellis contends that human creativity and intuition provide advantages over AI systems in identifying and exploiting security vulnerabilities.
Press
A Bugcrowd study published on OpenPR.de examines how protecting critical infrastructure requires combining human and artificial intelligence. Casey Ellis provides perspective on the importance of leveraging both human ingenuity and AI systems to strengthen security defenses against evolving threats.
Press
A Betanews article examines the limits of artificial intelligence in cybersecurity defense. Casey Ellis argues that AI tools alone cannot match the creativity and adaptability of human attackers, and that effective defense requires combining automated systems with human expertise and ingenuity.
Press
Computer Weekly published an article examining the growing recognition of neurodiversity among ethical hackers and security professionals. Casey Ellis comments on how neurodivergent individuals bring distinct advantages to creative problem-solving and security research within the hacking community.