200 Bugs/Week/Engineer: How We Rebuilt Trail of Bits Around AI
No ratings
Presented at [un]prompted 2026 by
AI isn’t a feature you “adopt.” It is a force that commoditizes effort and shortens the half-life of best practices, especially in security work where trust, evidence, and privacy are non-negotiable. In this talk, I’ll explain the strategy I'm using to turn Trail of Bits into an AI-native consulting firm. The core idea is a compounding operating system built from incentives, defaults, guardrails, and verification loops that let humans and autonomous agents ship high-rigor work at dramatically higher throughput. You’ll see the concrete artifacts that make this real: internal and external skills repositories, a curated marketplace for third-party skills, opinionated configuration baselines, and sandboxing patterns. Then I’ll cover what changes when AI output scales. Pricing, staffing, and delivery models evolve when discovery becomes abundant. Finally, I’ll show what’s next in the full vision. It is to build a firm that compounds faster than the ecosystem changes, and to do it in a way others can copy as a playbook rather than a vendor pitch.