In the latest instalment of our 5 Minutes With… series, we speak to Andy Hornegold, Chief Security Technologist at Intruder Systems, about the growing influence of AI on the cyber threat landscape, why supply chain attacks will remain a major concern in 2027, and how continuous testing could fundamentally change the way organisations approach security.
Andy also shares his thoughts on the challenges of navigating an increasingly unpredictable industry, the importance of making decisions under uncertainty, and why cybersecurity needs to be seen as an investment in protecting the business rather than simply another cost…
Tell us about your company, products and services
Intruder is an exposure management platform that helps lean security teams stop breaches before they start. The platform unifies AI pentesting, attack surface management, cloud security, and vulnerability management in a single solution, built to be high on trust and low on noise. The core mission is to reduce the window of opportunity for an attacker, meaning the time between a vulnerability being discovered and fixed versus an attacker finding and exploiting it. The goal is to reduce that window to zero seconds. Founded in 2015 by Chris Wallis, Intruder is a bootstrapped business of 60 people, serving over 3,000 customers predominantly across North America, Europe, Australia, and New Zealand.
What’s important is that Cyber Security is a pretty big industry and I’m mostly focused on the proactive and offensive side of the industry. Not so much on incident response, email security, data security etc. So, my answers will be mostly focused on that side of things.
What have been the biggest challenges the Cyber Security industry has faced over the past 12 months?
AI-enabled vulnerability detection has exploded, with the number of CVEs discovered increasing almost exponentially, doubling month on month. Initial access for attackers is becoming increasingly arbitrary. Attackers are finding weaknesses, exploiting them, and causing impact more quickly than ever, largely due to AI.
Bug bounty programmes and open source projects are starting to creak at the seams. Platforms like HackerOne and Bugcrowd are inundated with AI-generated submissions, much of it slop, which means genuinely critical, artisanally discovered vulnerabilities are being overlooked. We experienced this directly after submitting a real bug in Sophos via Bugcrowd, which was marked as not applicable – even though it was an unauthenticated remote code execution bug in a Sophos product with supporting evidence. We had to spend an inordinate amount of time chasing both Sophos and Bugcrowd to get someone appropriate to review our submission. Eventually Sophos responded and told us Bugcrowd made a mistake and it was eventually reviewed. Without our persistence that bug would have gone unremediated.
Managing AI within organisations, and keeping data within a controlled ecosystem, has been a significant challenge, with companies springing up or changing direction to try to solve it. Companies are trying to grow in an environment where capital is primarily flowing to AI businesses so people are vibe-coding applications to increase efficiency. Those vibe-coded apps only get a cursory nod to security and are being exposed to the internet, which makes them prime targets for bad guys. Supply chains are an increasingly common route for threat actors, with data flowing through third parties who are themselves using AI and potentially introducing vulnerabilities.
Finally, there has been a notable shift among some threat actors away from financial extortion toward destructive impact. Years gone by there would be dwell time in which you might be able to detect a bad guy on the network, then things shifted to a more smash-and-grab approach as criminal organisations became more opportunistic and commoditised. Now, that smash-and-grab doesn’t just include ransomware it’s threat actors impacting the physical world. Not as calculated as the days where a threat actor would sit on an energy grid and wait for the right time to flip a switch like in Kyiv, but incidents which involve internet-connected fridges having their temperature manipulated to destroy millions of euros worth of produce.
And what have been the biggest opportunities?
The challenges above are also opportunities for organisations willing to solve them. The biggest opportunity, from a background in red teaming and pentesting, is the collision of vulnerability scanning, vulnerability management, and human-led pentesting under an AI-led pentesting approach. This combines the speed and availability of automation with the reasoning and context of a human pentest. It’s something that Intruder is actively building a solution for.
AI pentests are fast, they can complete in around 3 hours. Reports are more comprehensive because there are no time constraints on reporting. A human-led pentest relies on a human’s time for example a 4+1 engagement, where there are four days of testing and one day of reporting. The time constraint on reporting will often force summarisation and grouping of findings. With AI pentesting, every finding can be detailed instantly, and remediation advice can be code-specific, pointing to the exact line that needs changing and providing strategic guidance for the rest of the codebase.
The result is dramatically faster remediation. Intruder has issued reports with 170 findings, including 68 critical, and seen all of them remediated in under 7 days, something that would have been unheard of previously. It means there’s less opportunity for an attacker to find those vulnerabilities and exploit them, resulting in a breach, because they’re more likely to be discovered by an AI pentester and then they’re remediated more quickly.
The biggest opportunity of all is truly continuous penetration testing, something the industry has talked about for 20 to 25 years. We’re now in a position where every pull request or code deploy can trigger a pentest, not just an automated vulnerability. Better results, faster, at a more accessible price point than human-led testing.
What technology is going to have the biggest impact on the market this coming year?
AI will continue to have an outsized impact on the market, for better or worse. Anthropic is going through its IPO, and there is potential for other frontier labs to follow. Anthropic’s IPO documentation indicates that token costs will need to increase, which raises a question for cybersecurity products that use those models in some way. If operating costs rise, will product prices rise too, or will vendors shift to open weight models? Either way, the biggest impact in 2027 will come from AI, and potentially the biggest component of that will be how cost dynamics play out.
Next year we’ll all be talking about…?
I believe supply chain compromise will continue to dominate. Vibe-coded applications built by third parties, without reasonable security validation, are being exposed to the internet and compromised. There’s more companies springing up as it is now easier to create a product, with more opportunities in the market there’s more of an organisation’s data flowing to more suppliers. Attackers will continue to use those smaller organisations as footholds to harvest data or pivot into larger, more secure organisations.
One route that we’ve seen attackers compromise organisations is by compromising and backdooring open source packages. Developers then download that backdoored package and the attacker harvests sensitive information. Package managers like npm are making improvements by blocking the methods used to run their malicious code, for example blocking pre-install hooks. The solutions aren’t perfect and not everyone will take advantage of the improvements, but they do make it slightly harder for attackers to take advantage. As those routes become harder attackers will adapt. The interesting thing will be how supply chain compromise evolves and changes shape from what was seen in 2026.
Which person in, or associated with, the Cyber Security industry would you most like to meet?
Sam Altman, as an avid gamer I want to know what he plans to do with the RAM in my gaming PC.
What’s the most surprising thing you’ve learnt about the Cyber Security sector?
Given how fundamental technology is to our society, it is still surprising how little companies/people outside the cybersecurity industry truly care about ensuring it is secure. Cybersecurity is treated as a cost centre and an unwanted expense. That is understandable when you are focused on growing your business and using every resource available to you to grow, but security is a risk mitigation function that protects everything you have built; all the time, effort, blood, sweat and tears.
Maybe that’s because it’s an education, regulation, and legislation problem rather than purely a perception problem. Compliance frameworks built decades ago still tell organisations that a single annual pentest is sufficient. With over 17,000 new CVEs published in October alone, standing still is not a viable security posture. So, that means that it doesn’t matter if you don’t push new code daily or make significant changes to your environment. Even if all you do is run a WordPress site vulnerabilities will emerge and you’ll need to react faster than an annual pentest can help.
Regulators, auditors, and legislators are not being prescriptive enough about what is actually required to stay secure in 2026. In today’s world continuous monitoring is necessary because the threat landscape changes daily, and being compliant with something that does not achieve security is pointless.
You go to the bar at the Cyber Security Forum, what’s your tipple of choice?
If it is just the one, a cold lager on a hot day does the job, or a Guinness – I am a simple being. But, if there are plans to keep things going after the forum then there’s a place for an espresso martini.
What’s the most exciting thing about your job?
Working in a startup means every decision can have a meaningful impact on the direction of the business and potentially on the cybersecurity industry more broadly. Seeing the UK market impact is exciting, seeing customers using and loving the things that we’re building is exciting.
We’re currently building an agentic AI pentester and learning in real time what works and what does not is genuinely cool. The security team are doing standout work on vulnerability discovery, generating proof of concept code for zero-day and n-day vulnerabilities and templating it to scan all customers to ensure they’re not vulnerable. The most recent example saw every customer scanned for a new vulnerability within 45 minutes of it being released. We were also the first commercial scanner to have an active check (one that actively exploited the vulnerability) for the PHP2Shell vulnerability – beating massive incumbents in the space. Being able to make a real difference and watching the team we have make it happen is what makes the role exciting.
And what’s the most challenging?
The most challenging thing is navigating uncertainty. We seem to be living in an age of increased uncertainty (maybe every generation says that?) from trying to determine what we should prioritise next, from the pace of AI development, and from the geopolitical environment. It seems that for most companies planning 3 to 6 years ahead used to be standard. But today, it feels like any company trying to do that is facing the same problem which is that nobody knows what 3 years looks like – you used to be able to squint and see a rough outline of what it could look like. Now, the futures available to us are vastly different. The challenge is bringing order, direction, and some semblance of certainty to that uncertainty which is also, in its own way, exciting.
What’s the best piece of advice you’ve ever been given?
One of the best pieces of advice that still resonates (even taking into account my answer to the last question) is “look where you want to go, not where you are currently going”. It applies in business sure – but also in skiing, and on a motorbike. Turn your head toward where you want to be, and everything else follows. In business, that means thinking about where the industry is going in a year’s time and positioning yourself there, not where it is today. If you keep looking in the direction you are heading right now, you will go straight into the ditch, into that tree you’re worried about, or off the cliff you’re trying to avoid. So, look where you want to go – don’t fixate on what’s in front of you.
The second best piece is probably the quote attributed (or mis-attributed to) Theodore Roosevelt that a mentor relayed to me years ago: The best thing you can do is the right thing, the next best thing is the wrong thing, and the worst thing you can do is nothing.
Obviously, the best thing you can do is make the right decision, but making a wrong decision is better than making no decision at all because you learn from it and you can act if you need to. You can try to improve it. But if you do nothing, you go nowhere and uncertainty grows. I believe you need to gather data first, make an informed decision. I believe in getting input from people who have relevant information. Give yourself the greatest chance of making the best decision. Sometimes that data, or those people, aren’t available. And at that point, you have to make a unilateral decision and you have to go with it. And that also is totally fine.
