How Redis Built a Threat-Hunting Pipeline Out of its Bug Bounty Program
By refocusing program scope, embedding AI into triage, and connecting vulnerability discovery to incident response, Redis transformed a reactive program into a continuous security operation.
Managing Volume Instead of Driving Outcomes
When Justin Lachesky, now Director of Cyber Resilience, stepped into Redis’s security program, he inherited a public vulnerability disclosure program and a private bug bounty program already running on HackerOne. Researchers were engaged, and bounties were being paid. “It was in a fairly healthy place,” he says.
The next challenge showed up only in where the team’s time went. Redis is not one product. Open source, enterprise software, clients, Docker images, a multi-cloud SaaS, and a growing AI portfolio were all in scope. Reports arrived from everywhere. “We were also getting reports to half a dozen different email aliases,” Lachesky says. “We’re getting reports through GitHub. We’re getting random people reaching out on social media and trying to report things that way.” Scope was just as loose. “Basically anything anyone could think of would come in, which resulted in a lot of chasing things that weren’t necessarily ours to chase.”
Researchers waited up to 7 days for first response and bounty payments lagged.
Security handed engineering raw reports without context.
AI-assisted submissions kept climbing in volume and sophistication.
For a company whose database sits under thousands of applications, including a fast-growing number of GenAI workloads, a program that couldn’t scale was a risk.
Fundamentals First, AI as a Force Multiplier
Lachesky started with a question: where was the team spending the most effort for the least security impact? “The biggest time sink wasn't actually the biggest security impact,” he says.
Redis consolidated reporting around the HackerOne platform and rewrote scope around what mattered most, which allowed Redis to scale with the resources that they had on the team already.
Using Hai, HackerOne’s agentic AI orchestrator, the team cut the time spent working out what a report was and where it belonged. Pattern analysis, once a manual exercise, moved into the platform. Lachesky can now ask an agent “over the last two weeks, what are the common themes that we’re seeing?” Engineering hears “here’s a class of vulnerability we keep seeing,” which drives architectural fixes instead of one-off patches. AI works as a force multiplier once the program is sound, it can’t stand in for one.
Lachesky and engineering agreed on what to bring and how much detail. The handoff varies by report. Sometimes it’s “here’s the report, here’s the general premise, here’s the evidence that this is potentially a real thing, but let engineering cook.” Other times Security brings the problem and the fastest fix.
Every report describes an attack path in Redis’s own products, and that gives the team a place to start. “It actually provides you with a really rich threat hunt hypothesis. Have we seen this before? Has it occurred?” Researchers give Redis something detection teams rarely have. “Because we’re engaged with the researcher community and they’re actively finding and validating and testing these, a lot of times we have control data.” That removes the guesswork about whether missing evidence means an attack never happened or the team couldn’t see it. Redis’s own AI agents map findings to the artifacts they would leave in logs. Lachesky describes this as a practice Redis is growing into, and the program already feeds threat detection and response.
How Redis Used HackerOne
- Scope: Right-sized scope around what matters most | H1 Platform
- Discover: Researchers found vulnerabilities across open source, enterprise, and SaaS with all reporting centralized | H1 Bounty, H1 Response
- Prioritize: Cut the time spent identifying and routing reports, and spotted recurring vulnerability classes | Hai, platform trend analysis
- Mobilize: Gave engineering decisions, not tickets | H1 Platform
- Feedback Loop: Began using reports as threat-hunting leads | H1 Platform (researcher-validated findings as control data)
Redis on AWS Cloud Services
Redis Cloud is a multi-cloud SaaS, and AWS is a major partner in it. AWS secures the foundation. Redis secures what it builds on top, and its customers build on that again. Researchers test what Redis ships. Hai helps the team act on findings quickly. Redis’s own detection work checks whether anything was exploited before it was reported. In AWS’s defense-in-depth model, the top layers are continuous monitoring, threat detection, and incident response, and that is where this loop lives.
Lachesky also asks a bigger question. “Are we able to use our HackerOne program, our vulnerability disclosure, and our bug bounty, to also drive a better security posture and position overall?” The answer shows up in how the team spends its time as a result of the transformation.
We’re spending less time chasing details, spending less time trying to build that initial context, and we’re able to get that delivered to us, which then allows us to make decisions faster, engage teams faster, and ultimately operate the program more efficiently.
His advice to peers starts with the basics. “You’re never gonna find in this space a silver bullet or a magic technology… It’s always gonna be the fundamentals.” For him, a program that keeps attracting researchers works as an early warning system.
“I’d rather have researchers report [vulnerabilities] than find them as a result of an incident.” Every report now answers a question that matters to the board:
Is this a problem that we can fix and then move on, or is this a problem that has actually already manifested and there’s more that we need to do?
Lachesky has since handed the program to a dedicated product security lead, a role that didn’t exist when he inherited it. A program that can change hands without losing momentum is how you know it was built to last.
