Cybersecurity founders converged on Capitol Hill this week for private meetings with lawmakers about the nation’s cyber strategies. Prior to these discussions, they sat down with Washington AI Network founder and podcast host Tammy Haddad at an event at Pubkey in partnership with General Catalyst Institute for candid conversations about the nation’s offensive and defensive opportunities, strengths, and vulnerabilities.
The first conversation featured enterprise cyber founders. “American cyber dominance has never been so important,” said Sam Jones, co-founder and CEO of autonomous cyber defense company Method Security. “Every board of directors is asking one question of their CISO for the first time ever … what is my enterprise readiness against a Mythos-equipped and compute-equipped adversary that wants to do damage to my business? And what if I am not ready, what am I going to do about it?” Jones pushed back on the notion that AI is simply an off-the-shelf weapon, arguing it can be deployed safely when paired with guardrails, defined rules of engagement and a human operator in the loop.
Brian Dye, CEO of Corelight which makes software aimed at monitoring traffic flowing through a company’s network, pointed to their open-source roots as a defensive edge, describing a two-decade feedback loop in which elite defenders investigating nation-state attacks feed new data back into the project, sharpening detection for the next wave of threats. He identified three recurring blind spots among enterprises: mistaking narrow detection coverage for comprehensive protection, ignoring anomalies that don’t fit standard threat frameworks, and underinvesting in proactive threat hunting.
David Gerry, CEO of Bugcrowd, a marketplace connecting companies with freelance ethical hackers who are hired to find bugs and security holes in software, said their network of roughly 700,000 security researchers — most of whom work full-time in cybersecurity — has seen a 334% increase in AI-generated vulnerabilities flowing through the platform, and he detailed the vetting process behind the company’s “trusted hacker” model.
Asked what worries them most, the panelists pointed to less obvious risks: Dye cited companies over-investing in AI models while under-investing in the data those models need; Gerry warned that no single federal entity holds unified responsibility for defending critical infrastructure; and Jones argued cyber remains the national security domain where the U.S. holds its thinnest edge, since any internet-connected actor can contest it. All three said they found encouraging, bipartisan engagement from congressional security subcommittees during the day’s Hill meetings — though they cautioned that translating policy into practice remains a persistent challenge.
The second panel shifted to consumer and enterprise data protection, featuring Arjun Bhatnagar, co-founder and CEO of data privacy app Cloaked; Aida Baradari, founder of counter-surveillance technology hardware company Deveillance; and Bill Robbins, CEO of browser security platform Menlo Security.
Robbins called the browser “the new OS” for both human users and AI agents, describing how Menlo Security’s virtualized browser sessions shield more than 8 million daily users — including eight of the 10 largest U.S. banks and the Department of War’s 3.3 million service members and employees — from malware, phishing and injection attacks. As AI accelerates the speed of attacks, he said, prevention will increasingly take priority over detection.
Bhatnagar, whose company helps individuals mask personal data, said the core challenge comes down to control: a single exposed data point can be enough to compromise someone’s identity entirely.
Baradari discussed Deveillance’s debut hardware product, Spectre I, designed to block nearby microphones from recording conversations. In an era of recording devices existing in most public environments – from cell phones to smart devices and more – she explained that Spectre I is aimed at people handling sensitive information, families with smart-home devices, and a future of increasingly “ambient” AI listening tools.
Asked for one piece of advice every consumer should follow, the panelists offered practical guidance: scrutinize personal data requests and decline them by default when possible; focus security efforts on a handful of accounts that matter most — email, cloud and device accounts, mobile carrier, computer login and frequently used retail accounts — rather than attempting to overhaul every password; and adopt multi-factor authentication broadly, since standard security-awareness training alone hasn’t proven sufficient.
Catch the full episode available now on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts.