The rise of AI-generated software is outpacing the security safeguards most businesses have in place—and a former Google engineering leader is stepping into the breach. Bryan Vuong, who spent years leading AI and security teams at Google and Facebook, has launched Cyfendo, a Silicon Valley-based application security company designed to help developers identify vulnerabilities, investigate threats, and apply tested fixes before attackers strike.
Cyfendo’s platform uses artificial intelligence to analyze source code, trace exploitable weaknesses, prepare contextual patches, and re-test supported findings. It works across popular AI coding tools, code repositories, and development environments—meant to fit into workflows that increasingly rely on speed over scrutiny.
For Cybersecurity Awareness Month, Cyfendo spotlights hidden risks in AI-built apps and helps small teams validate vulnerabilities and test fixes.
AI can build software faster than ever. But a working application is not necessarily a secure one. Businesses need to find vulnerabilities before attackers exploit them.— Bryan Vuong, Cyfendo Founder & CEO; Former Google AI & Security Leader
MOUNTAIN VIEW, CA — In less than six hours, a suspected attacker used AI to build and run a credential-harvesting campaign from compromised cloud infrastructure, according to a September 2026 report from Google Threat Intelligence Group. The operation relied on automated scanning and troubleshooting and ended up compromising thousands of third-party credentials. That finding underscores a sobering reality: as AI accelerates development on both sides of the security equation, the window to defend is shrinking.
The warning arrives during October’s U.S. Cybersecurity Awareness Month. This year, the Cybersecurity and Infrastructure Security Agency (CISA) has named its campaign “Securing the Next 250,” urging organizations to strengthen digital defenses. For small businesses that increasingly rely on AI-built websites and applications, that means closely examining the code and access controls behind systems that may appear to function normally but harbor hidden risks.
Consider the small businesses now moving core operations online. A retailer might build a customer portal with an AI assistant; a distributor might process orders through an AI-generated application. Both systems could work perfectly from a user’s perspective—and still expose private records if access permissions are misconfigured. A successful login or completed transaction would never reveal the underlying weakness.
Bryan Vuong, founder and CEO of Silicon Valley cybersecurity company Cyfendo, previously led engineering teams at Google and Facebook. His company analyzes application code, investigates whether supported findings can actually be exploited, and prepares tested fixes for developers to review. Developers examine the evidence and decide which changes to accept; nothing is merged into production automatically.
“What worries me is the gap between increasingly powerful attack capabilities and the resources ordinary businesses have to defend themselves,” Vuong said, according to Cyfendo’s founder page. “I founded Cyfendo to help them protect what they’ve worked so hard to build.”
THE CYBERSECURITY CHALLENGE FACING A NEW GENERATION OF SOFTWARE BUILDERS
Picture a small distributor that has moved its orders and invoices online. Customers no longer have to call the office for copies of their bills. But one customer changes a number in an invoice URL and gets somebody else’s invoice. The portal loads normally. The login works. Routine testing may not uncover the access-control mistake. To repair it, a developer has to find where the request bypasses the permission check, confirm the exposure and make sure legitimate orders still go through. This is a hypothetical example, not an incident involving a Cyfendo customer.
At a large company, application-security specialists would investigate a case like that. In a small company, it may fall to a contract developer who is also fixing bugs and answering support requests. The scanner can flag the code; someone still has to find out what it exposes and whether the repair works.
Attackers do not limit themselves to big companies. They search for exposed systems, outdated software and exploitable weaknesses, often before knowing who operates the systems. According to Verizon’s 2026 Data Breach Investigations Report, researchers analyzed 7,152 confirmed breaches involving small and medium-sized businesses. Vulnerability exploitation accounted for 26% of initial access methods, compared with 13% for credential abuse and 9% for phishing; third parties were involved in 55% of the breaches. The dataset covers multiple countries and types of technology, not just U.S. businesses or custom applications.
AI is also helping criminals move through attacks. Google’s September report documented a credential-harvesting operation; research published the same month by Anthropic described criminals using AI for reconnaissance, exploitation and handling stolen information. These are specific cases, not evidence that every attack is autonomous. They add to the pressure on developers to resolve security findings promptly.
CYFENDO TAKES APPLICATION SECURITY BEYOND DETECTION
Cyfendo gives developers a way to investigate. They can connect a GitHub, GitLab or Bitbucket repository, upload project files, or use the documented command-line workflow. The platform follows potential paths from untrusted input to sensitive operations. For supported findings, Cyfendo uses isolated tests to examine exploitability, prepares a patch and checks relevant behavior again. Developers review the evidence before accepting a change. Nothing is merged automatically into production.
A small team might use Lovable to create an initial application, refine it in Cursor, connect a database and deploy it through another service. Each platform can secure aspects of its own environment, but changes to application code and permissions still need review. Cyfendo examines the current codebase, including features and integrations added after launch.
Cyfendo reports finding an average of four critical-severity issues per codebase in its own scans. About seven in ten of its findings are rated high or critical. These company-reported results describe the projects Cyfendo has examined, not a representative sample of business software. For developers, the challenge is to confirm what can be exploited and decide which repairs need attention first.
Cyfendo has separately published detection results from standardized OWASP benchmarks. In its September 2026 evaluations, Cyfendo reported 94.06% recall and 96.38% precision on the OWASP Java Benchmark v1.2, which contains 2,740 test cases. On the OWASP Python Benchmark v0.1, containing 1,230 test cases, it reported 90.04% recall and 93.78% precision. Recall describes the proportion of vulnerable benchmark cases identified; precision describes the proportion of flagged cases that were truly vulnerable. These are company-reported benchmark results, not independently replicated findings or an OWASP endorsement, and they do not establish equivalent detection or repair performance in every live application.
Developers can try Cyfendo’s code-security platform without a credit card. As listed on its website in October 2026, the free plan covers 10,000 protected lines of code and five scans per month, with full vulnerability-finding details and limited patch evaluation. Automated generation of review-ready code patches is included in paid plans. Paid self-service tiers begin at $99 per month for Starter, followed by Growth at $299 and Scale at $799, with different scan and code-coverage allowances. Business and Enterprise plans are quoted separately. Cyfendo also offers application penetration testing for select businesses, separately scoped and not included in the self-service code-security subscriptions. That distinction is important: the code-security product is publicly available now; the penetration-testing service is a business-only service.
FROM GOOGLE AND META TO CYFENDO: BRYAN VUONG’S MISSION TO MAKE CYBERSECURITY ACCESSIBLE
Vuong brings experience in software engineering, artificial intelligence and large-scale technology systems to Cyfendo. From 2020 to 2026, he served as Senior Engineering Manager, AI and Security, at Google; earlier, he worked as an ML Research Scientist and Engineering Manager at Facebook. He earned a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, where his research focused on databases, information extraction and data integration. He also holds a Bachelor of Engineering with First Class Honours from Nanyang Technological University in Singapore.
Under the name Ba-Quy Vuong, he co-authored academic work on managing unstructured data and incorporating user feedback into information extraction, including publications associated with CIDR and ACM SIGMOD. He is also named as a co-inventor on granted U.S. patents involving product attributes and search results, as well as a published patent application concerning website data organization. Those inventions are assigned to Walmart-related entities, not Cyfendo.
Before Cyfendo, Vuong co-founded InnoSearch AI and served as its chief technology officer, helping build an online shopping service for blind and low-vision users. There, he worked on making online stores easier to use for shoppers whom ordinary sites often overlook. At Cyfendo, he is applying that experience to smaller companies that need help examining application-security problems but do not have in-house vulnerability researchers.
A scanner alert alone rarely tells a developer whether the problem is real or if a proposed patch will affect the application. Someone must check what an attacker could reach, review the change and test that existing features still work. Basic safeguards, including access controls, updates and incident planning, remain important. Small teams need actionable evidence, not just more warnings.
AI tools have made building software easier for small businesses. Keeping customer accounts and records secure remains their responsibility. When a vulnerability turns up, developers need to understand its impact, test the proposed repair and decide what to change. Cyfendo offers a way to do that work in the applications those businesses already maintain, starting with a free scan.
ABOUT CYFENDO
Cyfendo Inc. is a Silicon Valley-based application-security company founded by Bryan Vuong. Its autonomous application-security platform combines code analysis, vulnerability investigation, exploitability validation where supported, proposed remediation and re-testing. Teams can connect a repository or upload a project; developers retain control over proposed code changes. The company provides cloud-based and private scanning options with different source-code processing arrangements. Learn more at cyfendo.com.
ABOUT BRYAN VUONG
Bryan Vuong, also known as Ba-Quy Vuong, is the founder and CEO of Cyfendo. He served as Senior Engineering Manager, AI and Security, at Google (2020–2026), after working as an ML Research Scientist and Engineering Manager at Facebook. He holds a Ph.D. in Computer Sciences from the University of Wisconsin–Madison and a Bachelor of Engineering with First Class Honours from Nanyang Technological University. He co-founded InnoSearch AI, and his prior technical work includes research publications and co-inventorship on patents assigned to Walmart-related entities. Founder biography | LinkedIn.
Wendy Nguyen
Cyfendo
contact@cyfendo.com
Visit us on social media:
LinkedIn
Why it matters: As AI dramatically lowers the barrier to building software, it also widens the attack surface for small and medium businesses that lack dedicated security teams. Cyfendo’s approach—combining automated vulnerability detection with human-reviewed, testable patches—reflects a growing recognition that speed of development must be matched by speed of remediation. For the thousands of businesses now deploying AI-generated code, the question is no longer whether they will face a security incident, but whether they will have the tools to respond before damage is done.
