@bradlarsen@infosec.exchange pretty much yeah. All that’s required is 1 appsec Eng in your org who understands how to create harnesses for vuln discovery. There’s already really good examples of harnesses directly from anthropic and even cloudflare: https://github.com/anthropics/defending-code-reference-harness. https://blog.cloudflare.com/build-your-own-vulnerability-harness/. Like why pay an ai hacking company 4K per web app that a max subscription for 100$ a month can do?