As AI-Built Apps Spread, Former Google Security Leader Bryan Vuong Tackles the Security Gap With Cyfendo

For Cybersecurity Awareness Month, Cyfendo spotlights hidden risks in AI-built apps and helps small teams validate vulnerabilities and test fixes.

MOUNTAIN VIEW, CA, UNITED STATES, October 19, 2026 /EINPresswire.com/ — In less than six hours, a suspected attacker used AI to build and run a credential-harvesting campaign from compromised cloud infrastructure, according to a September 2026 report from Google Threat Intelligence Group. The campaign used automated scanning and troubleshooting and compromised thousands of third-party credentials.

The warning comes during October’s U.S. Cybersecurity Awareness Month. The Cybersecurity and Infrastructure Security Agency (CISA) has named its 2026 campaign “Securing the Next 250,” calling attention to the steps organizations can take to strengthen digital defenses. For small businesses increasingly relying on AI-built websites and applications, that includes examining the code and access controls behind systems that appear to work normally.

Small businesses are putting more of their daily operations online. A retailer might build a customer portal; a distributor might handle orders through an application written with an AI assistant. Both systems could work as expected and still expose private records if access permissions are wrong. A successful login or completed transaction would not reveal that weakness.

Bryan Vuong, founder and CEO of Silicon Valley cybersecurity company Cyfendo, previously led engineering teams at Google and Facebook. His company analyzes application code, investigates whether supported findings can be exploited, and prepares tested fixes for developers to review. Developers examine the evidence and decide which changes to accept; nothing is merged into production automatically.

“What worries me is the gap between increasingly powerful attack capabilities and the resources ordinary businesses have to defend themselves,” Vuong said, according to Cyfendo’s founder page. “I founded Cyfendo to help them protect what they’ve worked so hard to build.”

THE CYBERSECURITY CHALLENGE FACING A NEW GENERATION OF SOFTWARE BUILDERS
Picture a small distributor that has moved its orders and invoices online. Customers no longer have to call the office for copies of their bills. But one customer changes a number in an invoice URL and gets somebody else’s invoice. The portal loads normally. The login works. Routine testing may not uncover the access-control mistake. To repair it, a developer has to find where the request bypasses the permission check, confirm the exposure and make sure legitimate orders still go through. This is a hypothetical example, not an incident involving a Cyfendo customer.

At a large company, application-security specialists would investigate a case like that. In a small company, it may fall to a contract developer who is also fixing bugs and answering support requests. The scanner can flag the code; someone still has to find out what it exposes and whether the repair works.
Attackers do not limit themselves to big companies. They search for exposed systems, outdated software and exploitable weaknesses, often before knowing who operates the systems. According to Verizon’s 2026 Data Breach Investigations Report, researchers analyzed 7,152 confirmed breaches involving small and medium-sized businesses. Vulnerability exploitation accounted for 26% of initial access methods, compared with 13% for credential abuse and 9% for phishing; third parties were involved in 55% of the breaches. The dataset covers multiple countries and types of technology, not just U.S. businesses or custom applications.

AI is also helping criminals move through attacks. Google’s September report documented a credential-harvesting operation; research published the same month by Anthropic described criminals using AI for reconnaissance, exploitation and handling stolen information. These are specific cases, not evidence that every attack is autonomous. They add to the pressure on developers to resolve security findings promptly.

CYFENDO TAKES APPLICATION SECURITY BEYOND DETECTION
Cyfendo gives developers a way to investigate. They can connect a GitHub, GitLab or Bitbucket repository, upload project files, or use the documented command-line workflow. The platform follows potential paths from untrusted input to sensitive operations. For supported findings, Cyfendo uses isolated tests to examine exploitability, prepares a patch and checks relevant behavior again. Developers review the evidence before accepting a change. Nothing is merged automatically into production.

A small team might use Lovable to create an initial application, refine it in Cursor, connect a database and deploy it through another service. Each platform can secure aspects of its own environment, but changes to application code and permissions still need review. Cyfendo examines the current codebase, including features and integrations added after launch.

Cyfendo reports finding an average of four critical-severity issues per codebase in its own scans. About seven in ten of its findings are rated high or critical. These company-reported results describe the projects Cyfendo has examined, not a representative sample of business software. For developers, the challenge is to confirm what can be exploited and decide which repairs need attention first.

Cyfendo has separately published detection results from standardized OWASP benchmarks. In its September 2026 evaluations, Cyfendo reported 94.06% recall and 96.38% precision on the OWASP Java Benchmark v1.2, which contains 2,740 test cases. On the OWASP Python Benchmark v0.1, containing 1,230 test cases, it reported 90.04% recall and 93.78% precision. Recall describes the proportion of vulnerable benchmark cases identified; precision describes the proportion of flagged cases that were truly vulnerable. These are company-reported benchmark results, not independently replicated findings or an OWASP endorsement, and they do not establish equivalent detection or repair performance in every live application.

Developers can try Cyfendo’s code-security platform without a credit card. As listed on its website in October 2026, the free plan covers 10,000 protected lines of code and five scans per month, with full vulnerability-finding details and limited patch evaluation. Automated generation of review-ready code patches is included in paid plans. Paid self-service tiers begin at $99 per month for Starter, followed by Growth at $299 and Scale at $799, with different scan and code-coverage allowances. Business and Enterprise plans are quoted separately. Cyfendo also offers application penetration testing for select businesses, separately scoped and not included in the self-service code-security subscriptions. That distinction is important: the code-security product is publicly available now; the penetration-testing service is a business-only service.

FROM GOOGLE AND META TO CYFENDO: BRYAN VUONG’S MISSION TO MAKE CYBERSECURITY ACCESSIBLE
Vuong brings experience in software engineering, artificial intelligence and large-scale technology systems to Cyfendo. From 2020 to 2026, he served as Senior Engineering Manager, AI and Security, at Google; earlier, he worked as an ML Research Scientist and Engineering Manager at Facebook. He earned a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, where his research focused on databases, information extraction and data integration. He also holds a Bachelor of Engineering with First Class Honours from Nanyang Technological University in Singapore.

Under the name Ba-Quy Vuong, he co-authored academic work on managing unstructured data and incorporating user feedback into information extraction, including publications associated with CIDR and ACM SIGMOD. He is also named as a co-inventor on granted U.S. patents involving product attributes and search results, as well as a published patent application concerning website data organization. Those inventions are assigned to Walmart-related entities, not Cyfendo.

Before Cyfendo, Vuong co-founded InnoSearch AI and served as its chief technology officer, helping build an online shopping service for blind and low-vision users. There, he worked on making online stores easier to use for shoppers whom ordinary sites often overlook. At Cyfendo, he is applying that experience to smaller companies that need help examining application-security problems but do not have in-house vulnerability researchers.

A scanner alert alone rarely tells a developer whether the problem is real or if a proposed patch will affect the application. Someone must check what an attacker could reach, review the change and test that existing features still work. Basic safeguards, including access controls, updates and incident planning, remain important. Small teams need actionable evidence, not just more warnings.

AI tools have made building software easier for small businesses. Keeping customer accounts and records secure remains their responsibility. When a vulnerability turns up, developers need to understand its impact, test the proposed repair and decide what to change. Cyfendo offers a way to do that work in the applications those businesses already maintain, starting with a free scan.

ABOUT CYFENDO
Cyfendo Inc. is a Silicon Valley-based application-security company founded by Bryan Vuong. Its autonomous application-security platform combines code analysis, vulnerability investigation, exploitability validation where supported, proposed remediation and re-testing. Teams can connect a repository or upload a project; developers retain control over proposed code changes. The company provides cloud-based and private scanning options with different source-code processing arrangements. Learn more at cyfendo.com.

ABOUT BRYAN VUONG
Bryan Vuong, also known as Ba-Quy Vuong, is the founder and CEO of Cyfendo. He served as Senior Engineering Manager, AI and Security, at Google (2020–2026), after working as an ML Research Scientist and Engineering Manager at Facebook. He holds a Ph.D. in Computer Sciences from the University of Wisconsin–Madison and a Bachelor of Engineering with First Class Honours from Nanyang Technological University. He co-founded InnoSearch AI, and his prior technical work includes research publications and co-inventorship on patents assigned to Walmart-related entities. Founder biography | LinkedIn.

Wendy Nguyen
Cyfendo
contact@cyfendo.com
Visit us on social media:
LinkedIn

Media gallery