AI Helped Steal Thousands of Credentials in Under Six Hours. Former Google Security Leader Bryan Vuong Is Fighting Back

As FBI figures show nearly $21 billion in U.S. internet-crime losses, Silicon Valley cybersecurity startup Cyfendo is using AI to help smaller businesses find software vulnerabilities, investigate real threats and prepare tested fixes for developer approval.

MOUNTAIN VIEW, Calif., Oct. 15, 2026 /PRNewswire/ -- The attacker did not need a team, just an AI coding agent, instructions and a set of tools. In less than six hours, a suspected cybercriminal used an AI-enabled framework to plan, build and run a mass credential-harvesting campaign from compromised cloud infrastructure. Thousands of third-party login credentials were compromised, according to Google Threat Intelligence Group in its September 8, 2026 report.

The campaign shows how much an attacker can organize in a few hours. At a small business, the next security warning may land on one developer's desk, alongside customer support requests and software updates. Bryan Vuong wants to make that investigation less difficult.

Bryan Vuong, the founder and CEO of Silicon Valley cybersecurity company Cyfendo, previously led engineering work at Google and Facebook. His company uses AI-assisted source-code analysis to help developers examine possible vulnerabilities, investigate exploitability where supported, and assess proposed repairs before any change is approved. The goal is to give smaller teams more of the investigative capability usually found inside a large technology company.

"What worries me is the gap between increasingly powerful attack capabilities and the resources ordinary businesses have to defend themselves," Bryan Vuong said. "I founded Cyfendo to help them protect what they've worked so hard to build."

The Cost of Cybercrime, and the Businesses at Risk

The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints and about $20.88 billion in reported losses across internet crimes, including fraud. Meanwhile, the U.S. Small Business Administration counted approximately 36.2 million small businesses in 2025, more than 4.3 million of them in California.

Small businesses use software to take orders, process payments, book appointments and store customer records. When a scan flags a problem, the person maintaining the application must determine whether an attacker could exploit it, what information is at risk and how to make a repair without breaking a feature customers rely on. That work competes with support requests and the next release.

AI Can Build an Application. Who Checks Its Security?

AI coding tools can help a restaurant launch online ordering, a contractor set up a customer portal or a founder build an application without hiring a conventional development team. Consider a small distributor whose customers download invoices from a portal. One customer changes a single number in the invoice URL and opens another customer's billing record. The site looks normal; the login works; an ordinary test may show nothing wrong. The error is in the access rule that should have kept the invoices separate.

Other flaws can be just as hard to spot. A database query may return the right information to a legitimate user while mishandling malicious input. A newly connected service may have broader access than it needs. None of these mistakes has to interrupt a normal transaction to put the business at risk.

A finished application may also have passed through several tools. A developer could start in Lovable, make changes with Cursor, connect Supabase for authentication and storage, track versions in GitHub and deploy the project elsewhere. Each service has its own security controls, but no single check should be assumed to cover the entire codebase after those changes. Someone still has to examine the software that customers actually use.

Cyfendo adds a code-level review alongside those platform protections. Developers can connect GitHub, GitLab or Bitbucket repositories, upload project files or work from the command line. They can check the application as it exists now, including features and integrations added after launch.

Finding a Vulnerability Is Only the First Step

A scanner may flag a suspicious line without telling the developer how an attacker could use it. Someone still has to reproduce the problem, judge its severity, correct the code and check that the application continues to work.

Cyfendo links those steps where its tools support them. The platform traces untrusted data through source code to sensitive operations, runs isolated checks to investigate exploitability, and prepares a code patch for review. It then re-tests the finding and relevant application behavior. Developers see the evidence and decide whether to accept the proposed change; Cyfendo does not merge patches directly into production software.

"Every business, big or small, deserves world-class security," Bryan Vuong said. "Protecting what you've built should not depend on whether you can afford a team of experts."

This is useful when the person responsible for an AI-built application is also the person answering support requests and shipping new features. That developer may know the business extremely well without having the time or training to investigate every security finding from scratch.

According to Cyfendo's own scan data, the company finds an average of four critical-severity issues per codebase. Approximately seven in ten findings are rated high or critical. Those results come from projects scanned by Cyfendo, not a representative survey of business applications. They help explain the company's emphasis on investigating findings and preparing fixes rather than handing developers another list of alerts.

Cyfendo has separately published results on standardized OWASP detection benchmarks. In its September 2026 evaluations, it reported 94.06% recall and 96.38% precision on the Java Benchmark v1.2 (2,740 test cases), and 90.04% recall and 93.78% precision on the Python Benchmark v0.1 (1,230 cases). Recall measures how many known vulnerable cases were detected; precision measures how many flagged cases were truly vulnerable. These are company-reported detection results, not an OWASP endorsement or an independent validation of automated repairs. Cyfendo has published its benchmark methodology for review.

Cyfendo's code-security platform is available now. Its free plan covers up to 10,000 protected lines of code and five scans a month, with detailed findings and limited patch evaluation. Paid self-service subscriptions begin at $99 per month and include automated generation of review-ready patches and higher scanning allowances. The company's separate application penetration-testing service remains in private beta for select businesses and is not part of those subscriptions.

Bryan Vuong's Career, From AI Research to Application Security

Vuong's background includes engineering leadership, machine learning and academic research. From 2020 to 2026, he served as Senior Engineering Manager, AI and Security, at Google, working in areas involving privacy, safety and security. Earlier, at Facebook, now part of Meta, he worked as a machine-learning research scientist and engineering manager.

He earned a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, where he studied databases, information extraction and data integration, following a Bachelor of Engineering with First Class Honours from Nanyang Technological University in Singapore. Publishing as Ba-Quy Vuong, he contributed research on unstructured information and user feedback in information-extraction systems. He is also named as co-inventor on three granted U.S. patents in search and information processing, assigned to Walmart-related entities.

In 2024, Vuong co-founded InnoSearch AI, an online shopping service for blind and low-vision users. The service helped people navigate online shopping experiences that had not always been designed for them. With Cyfendo, he is addressing another gap in access: smaller organizations can build substantial software, but often cannot employ the specialists needed to assess its security.

Automated analysis cannot replace sound access controls, timely updates or a developer's judgment. It can give a small team evidence and a proposed fix to review when a security problem would otherwise demand specialist investigation.

Google's investigation showed what an attacker could organize in a few hours. Cyfendo is focusing on the work a developer faces after finding a potential weakness: determining whether it can be exploited, reviewing a repair and checking the change. More small businesses can now build their own applications with AI. They also need an effective way to check the security of what they put online.

About Cyfendo

Cyfendo Inc. is a Silicon Valley-based application-security company founded by Bryan Vuong. Its AI-powered platform combines source-code analysis, vulnerability investigation, exploitability checks where supported, proposed patches and re-testing. Developers can connect repositories or upload projects, inspect findings and approve or reject proposed code changes. The company offers free and paid code-security subscriptions; separately scoped application penetration testing is in private beta for select businesses.

Build with AI. Verify with Cyfendo.

About Bryan Vuong

Bryan Vuong, also known as Ba-Quy Vuong, is the founder and CEO of Cyfendo. His work includes engineering and machine-learning leadership at Google and Facebook, a Ph.D. in Computer Sciences from the University of Wisconsin–Madison, academic research and co-inventorship on three granted U.S. patents assigned to Walmart-related entities. He previously co-founded InnoSearch AI, an accessible e-commerce platform for blind and low-vision users.

Founder biography | Company website

Media

Wendy Nguyen

(650) 262-6576

[email protected] 

SOURCE Cyfendo