Panel | Who audits the auditors | Common S3nse - 2026

[music] So like I said we have Gonalo from Unifi, we have Dimitro from Hacken Proof can also join us on stage. Uh Alex from Ottok and Brian also from Hacken. So basically all the the top crypto uh security firms are here and um yeah we're gonna have a discussion. Um let me see. Yes, Brian.

Thank you. There's a microphone over there. Um looking if I can see Alex somewhere. I don't see him.

One one. Okay.

Yeah, work.

Uh, let me see. Alex maybe in the background at the corner.

Oh, yeah.

No.

No. Okay.

Okay. I think Alex is somewhere. He's going to be here in in a couple of um Yeah, I guess a couple of minutes, but I saw him the last time. Um yeah basically what we're going to talk about is who audits the auditors that's a very very interesting talk that I would like to question I would like to ask and also um no I auditor that helps teams who've got smart contracts in development we have of course human auditors that do the final usually the final step before the mainet launch and then over on Demetro side uh bug bounty programs and crowdsourced audits ongoing security.

Yeah, we're we're pretty much the same. Um and then also what you mentioned as well like you know typically like uh the audits that we end up doing there's there's multiple firms in the mix and and uh there's there's multiple passes to make sure that you know all the all the tees are crossed and eyes are dotted.

Okay, great. Great.

Uh so we do bug bounty but also we work with many cyber security firms. Uh we work together on a crowdsource audits. we actually ask them to check audit after us. So sometimes we have also created private audits and then we do like dual defense where other auditors participate and check our job and of course we disclosure those reports.

Yeah. Um so I I think the question there are many ways maybe to to answer the question. Um I would say that for sure we we would recommend that a protocol should not you know go through a single audit because it feels like a single point of failure. Um but then we also at least we especially with with the platform and and just having the disclosure of very sensitive information we need to kind of give some evidence that we are trustworthy. I'd say that's the important part not just for the community but also for the customers.

There are many ways like we you can you can make an effort to be like sock to compliant for example to kind of show how how how importantly you value the data that is being um entrusted to you but also at the end of the day I do think like for example the community would be a a good way to see if if you are u a trustworthy entity basically if you end up losing their trust I think it's something very hard to to get it back they they will they will not forgive easily basically

yeah understandable um yeah

I just want to add that uh so your question is related to let's say trust or let's say how we verify but this is the issue on the market what I see so currently we have lots of cyber security firms that's good but Actually sometimes it just entity with one or two person and uh that is why why they have one or two person because actually market someone actually cut teams uh someone actually fail with the work and but still they have a track record and the issue is also here huge that customers who come for track records or because of track records they cannot even get those results. Of course, I would be happy if we could have more audits for simple client. Yes. To verify work after work. But anyway, currently the biggest issue that we see that many companies even hide who is auditing some stuff.

So they don't show employees or auditors itself and they just put label of the brand the audit done. And of course uh I know like teams like Otter like Hacken that actually they showing uh employees inside of reports you can verify and here as you mentioned that it's all about uh brand how they working with their names and etc. But yeah, the issue what I see right now is not having entities as a as as a company who does audits but actually caring about who actually work and of course if someone wants to work with several companies they willing to do that's easily

yeah can kind of along the same lines here the um uh the other way they kind of look at this is is who trusts the firm as well as the auditors right so so I like to just say like call up anatoli from Salana and he'll give the recommendation, right? Or like Brian from layer zero like these the all these CTOs and um technical teams know who we on stage are and they they and they also know to to your point of of who the specific auditors are that they prefer. And then what you'll end up seeing is like um there there will be there there will be world word will get around that somebody's very good on a specific chain and then uh that you know the other teams will request that particular person to do a specific audit if if that um uh their expertise falls within this kind of a a same background or or you know whatever is being developed. So you you'll kind of get that around from a from a

recommendation. H how does that like doesn't that lead to some kind of like um I guess like monopoly on knowledge on a certain on a certain protocol to some extent or how does that go as well because say for example you're like very proficient in a certain um yeah network for example and yeah mostly you're the only one getting that job or maybe you on your team are the one getting that job so how does another like another um I guess um auditing firm compete with back.

I I Yeah.

Yeah. I would say usually um via programs like builder programs, accelerator programs, that kind of stuff. Um yeah, for dealing with new ecosystems and and uh taking market share in new ecosystems, this is this is usually the way.

And and to to a certain degree, I feel like it's it's also self-regulating, too. like like you're the the person that wants that specialist if they don't do a good job it's very quick to like

yeah what what what travels faster faster okay

you're either good or you're not so

um okay another question I had was um basically under pressure right now of course like web three is becoming more commercial you can say that um a lot of things are getting tokenized a lot of push from you know Solana Ethereum Robin Hood um yeah to basically ally be out there and everything's going to be tokenized and NASDAQ this and the S&P that you know that's basically the way it's going. Is there like an extra amount of pressure on you guys um as you know working at these companies to I guess have like uh [laughter] you know code that is like cannot basically get exploited. Is there like what's the pressure? What's the amount of Is there like extra pressure, less pressure?

I I don't know. I'm the sales side man. [laughter] Kidding kidding kidding. Like I think the pressure is always there, right? like like the the

what do you mean by pressure? You mean like pressure of what? Of new technologies or

like responsibility?

Yeah. Because like right now you're not only dealing with web three companies, right? You're also dealing with like banks for example, regul like um yeah, market regulators from like the NASDAQ or stuff like that, right?

Yeah. Yeah. So I I can answer this. So recently we had even some uh uh audits for stable coins of specific countries and uh for banks. So currently I don't see much actually difference of what we does do right now.

Yes. But the issue what I see here um these companies have less knowledge generally about what is uh onchain security and etc. And that's the issue and this is where I'm afraid more and more about my money in banks and uh the biggest issue what I see it's when actually they come for audit let's say for hacking or even they they not caring about operational security. So the biggest issue right now is operational security and um yeah

I I would argue that the banks and the the trampy institutions coming into space they're quite used to quite a high bar for cyber security so they already have a tech budget assigned they already have a specific amount of that tech budget assigned to cyber security in most cases they're quite used to to paying uh you know retainers and these kind of models um on the cryptonative side it's a little bit different you know we're struggling as a market and teams are still uh struggling with operational security as Demetra mentioned.

Yeah, I would just say that from from the responsibility side, I think it's it's generally the same like having blockchains or protocols with billions, we we've already we already went through that basically and that's that's a lot of pressure already. So more than that I you know it continues being high pressure basically continues being you know securing that sort of secrets and and helping the customer with that amount of money that can change a lot of stuff but yeah he's right as well that they they might uh require um a higher level of of service maybe if I if I can say in that way but I I've also seen uh we've also seen many customers uh on the web 3 side who demand the same enterprise quality let's say like uh maybe companies that have been here for a long time like I'm thinking about polygon for example and they they they expect a lot so yeah

okay so that's at least good to hear on that on that case then okay um yeah I would also like to add like for example since banks and um yeah I guess in governments who are get in in into the space. So, how do you guys go about sharing the knowledge that you guys already have in house with those entities as well? because I think you don't want them to run to you for every small thing that they have like oh you know so how do you go about like teaching those uh entities

I think it's two two different sectors government and uh banks and institutions completely different usually with governments and regulators we'd start so that's how you start via education first and hopefully they build a good regulatory framework for crypto um with banks and and enterprise often they've got a cyber security team that's toolled up already and um they've already kind of prepared I would say they've already got sock 2 or ISO 27001 in place so they already understand the process

I would like just to add so recently we did um some security stuff for a fisen bank and for it's quite big banks and um what I'm what what I notice so currently of course they're caring about some license that they have uh inside of countries actually and uh national banks. But uh we started uh back bounty for both of those uh companies and there when you help them to analyze what targets should be added. Of course there are lots of pressure like we will not add this one. No it's too private let's make private and etc. So it takes like three months to make those specification on a buck bounty and while doing this they already learning like oh really that's my works uh and actually this is something they have like a learning and another case um I'm not sure compared to web three but let's say in this case mostly web two stuff yeah and we help to like um explain each issue and when we have let's say 10 of valid reports, we just make a call and help to explain how it works uh and etc.

And if you like take a look at the three stuff, so if some banks trying to implement smart contracts, it's really small smart contract like three 200 lines of code, three line 100 lines of code, it's mostly solidity. So it's not something complicated and it's mostly all the time how they care about private keys to manage these smart contracts or which server deploys these smart contracts and who actually manage the server.

What you what you meant in the beginning was that they they felt unease about showing the assets. Is that what you mean? Like putting [clears throat] what would be the assets that they want uh researchers to look at or something like that?

Good good question. So first of all the biggest issue when it goes to banks is actually if a specific country have to provide credentials to work with a specific servers application etc. uh if they not showing assets generally if you're asking to validate for example when we go when we talk about web three and we saying hey what is critical might be

yeah but I mean like web two endpoints basically maybe they wouldn't want to to specifically say because I I sometimes see that from from customers where they feel like just putting it in in a scope feels like exposing themselves which is kind of the opposite way Yeah, like that might be a point actually web two companies they more like if we don't go to bounty then we are not target but if we go to bounty then we target and uh that's the most common stuff that I hear and now second very common points like we going to delete bug bounty or maybe we will going to not run bug bounty at all because there are lots of EI reports then we will not participate but come on guys even If you delete bug bounty h and you believe that your engineers will scanning uh your products every day that's not true forget forget about this because even your uh engineers is going to scan every day they will spend more on AI than actually hackers who u as a community participate and they do their job like someone taking a look at your code today someone in one week and they will spend actually more time and maybe more money but bring you more value in terms of um bounties than actually having an engineers and um many other stuff. So something like this.

Okay. Well um moving on. So another thing that I want to emphasis is when for example I at least I hear this a lot from people right. So they um they they get they they're usually startups and of course they get like found they get like some um yeah basically some some money. So they do like some seeding rounds or something like that.

And then of course it's very important when they have when they're dealing with people's money that they need to get audited right and usually I hear something in the sense fund. Oh yeah I got audited by uh alterc. Oh yeah, I got that audited by Hacken. And they basically just chalk up everything to that. It's like, hey, okay, we are basically done.

If anything goes wrong, um yeah, don't ask me. It's all Hackin's fault or it's it's sex's fault or something like that. So, how do you guys also um deal with that? Do you communicate that, hey, there's still a chance that something could go wrong and it's not up to us? So, how does that work?

I actually can answer because it's more about ongoing security that hacken proof and imunify see every day. So just a simple case or the most common case some actually company or let's say exchange they can do penetration testing and then not caring about ongoing security at all and but if if actually because they would trying to get license they're trying to be certified by or get some points at coin gecko but the reality is that uh ongoing security and it is something that you get on daily usage and we had a cases where actually like company knowing about bugs they actually knowing about the issue and they don't caring about this because they preparing to shut down operation and they just inform their I don't know employees via Twitter that hey tomorrow we stop our operation recent case if you understand what I'm talking about and uh that's an issue Yeah. So,

yeah, I I'd say that um well, we obviously care a lot about security. Some projects do, some protocols, blockchains, they do care about security. Uh others are just looking for a rubber like a quick rubber stamp to to launch. And it's I mean, in some way, it's understandable. And yeah, that's why I I I don't think I typically see um but maybe maybe they see like customers being upset because they got an audit and then they went live and then in a bug bounty uh a new bug came in like they don't get necessarily upset with the with the auditors because I think they understand it's like a a limited engagement so they cannot do everything.

It's not necessarily perfect. is is very good hopefully, but again it's limited. Um and and that's kind of why you go to bug bounties as well as what I would say is like the last line of defense because you go you go tap into this huge community that has a a wide range of you know [snorts] uh knowledge. they are very good at what they do and it's basically an investment into your ongoing defense as well as many other solutions. Yeah,

another way to look at this too actually this this way we look at it is our our our customers are our liability right so we do review and ask questions and you know verify that that you as a customer are are interested in security and if you're not interested in security then there are other auditors out there that may want to work with you

yeah it's pretty easy to sniff them out I I think the vast majority of successful exploits are still fishing attacks and social engineering attacks that lead to key compromise. So usually it's the human element that's that's compromised and um you know we've seen a lot of these campaign for example this this project on Salana that had all their audits done but they met some VCs in a conference I think it was Q4 last year right they invested $ 1.5 million into the protocol was it drift drift yeah um and then over the next six months befriended all of the dev team eventually able to compromise devices and keys and walked away with $278 million so Yeah. And there's just case after case of these, right? So again going back to operational security must have must have good good key infrastructure.

Yeah, we we we we second that.

I I want to add here that actually um mostly companies like probably 80% on a market they do uh audit or penetration testing just to have a fixed state of security and then there are developers still developing. Yes, that's normal. And of course companies and business they caring about revenue they not going for each review of release and here the most conflicts of interest happening because when a good researchers find a good valid report through hacking proof humanifier what actually happen first of all developer or head of security who actually caring about this project is worrying about his job that's normal No because like it's some kind of stuff that you're doing and we know many cases on the market when whole team were fired after finding half million or 1 million or etc issue that's also understandable and currently when we also talking about uh bug bounty etc many companies don't want to run back bounty also because of this is when you understand that the issue might happen but they afraid of not understanding how much they will pay in total at the end and it's also missing part of understanding how it works. Yeah. Because even if you develop and you know about your issue you can inform platform that you know about this issue and uh it's duplicate that we don't pay for.

Uh I think uh if if we turn it around it's it's I see it typically as an investment like companies if they just look at security I I kind of get it that they would look at security as like uh security we want to move fast we want to do stuff but you know it's very expensive to be exploited it's it's also very expensive to pay a a bug report in a bug bounty so just having that continuous effort of security um will pay off even though it it feels like initially costly.

So um I would like to ask a question. So for like smaller teams usually like you know web three companies that are a bit more boot strapped basically um when would it when would be the perfect time to go for an audit according to you guys? Um yeah from your seen so many things you know so when would it be the the perfect time say for example you could only go for one one um long two to three weeks um yeah I guess

not after the hack [laughter]

well yeah that that's I mean I think so because um so companies also um do it after the hack they are more interested

yeah yeah yeah they they come in afterwards

like I obvious earlier the better All right, earlier the better. And if if nothing else, at least have have the conversation. Like we're

we're we're everywhere. [laughter] You'll always see us at the conferences. So you can find us. We're happy to connect you with the engineering to at least have a conversation, right? And

I think I think the answer is in yeah, in in early dev, but I think definitely with the a in the age of AI, we've seen this move to continuous security models. So there is tools out there where you can audit smart contracts that are 50% complete for example or and and all the way through the dev path. Um you know you obviously they don't replace human auditors. You still need humans to review the code definitely for now. Um and then ongoing bug bounty programs where you set your own budget as well.

Absolutely essential. Um and then also combining that with real-time threat detection and monitoring tools so you've got some kind of firewall in place as well. I just want to add that actually we have topic like how you verify ear auditors after auditors but actually I already heard a few actually discussion around that uh this industry become will be become more regulated and that means that many customers who want to get audits they will see some kind of official tiers of auditors. So let's say if you tier let's say number one you will need to show all certification about your employees who participate in audits how many hours where your company register and many many other stuff that also cost money that means for tier one audits it will be much more costly but such kind of a audits will need for let's say for some regulators unfortunately web three is going to be regulated more and more and uh but this is something that currently uh as a discussion I see at many conferences in uh so this is yeah my expectation uh so that means uh someone or auditors after auditors will verify who actually participate how we might see even some public signature and keys and auditors will sign that this report was actually done or actually this work was done by specific uh auditor.

Well, um lastly just to you know I have another question. So how does it go with the licensing right? Because you know if you think about other things from when it actually comes from you have like the financial audits where for example you have like uh you know specific people who study for that right and then for same thing with like people who do um internal audits for example same thing for IT audits the same. So um right now in web 3 you can you can do some curses basically but it's not you know what I mean like it's not there is no like governing body and basically that everyone has to know a certain amount of um yeah about web three and like a curriculum that it's you know more fleshed out. How do you see that moving out in the future?

Do you think we're going to see um like um like a governing body come out and say hey this is um yeah software web three other thing or something of that nature. So what do you how do you see the field in the next few years?

It's I think it's already starting. We're you know we're already getting requests to uh set up certification standards for smart contract auditing in different jurisdictions for example. Not going to name which ones but um but they they want the auditors to be based there. uh they want them to have an entity there. They want the people who are doing the auditing to be uh citizens or residents there so that they can call them if if something does go wrong or if they need to go to court.

Um probably that's going to expand with Mika 2 and the next CAS framework here in Europe I would say. Um and also probably in the US as well as the crypto regulation gets tighter there. I just want to also mention that uh if you take a look at last 10 uh companies who raise money uh in EI um that mostly like EI auditors and etc and uh let's say they offering like hey this is a final report um let's say so to complant or etc but everything done by AI and um that's reality and they rise around 60 million um dollars for that and currently I I believe this going to be change. So less um AI stuff um like EI will be for sure but actually if you as a company is going to get some certification you will need have more even human um work done for such stuff. uh this is the first things and second about uh license what I would like to say um currently is very common word is uh data sovereignty when actually specific countries going to log data in their countries this is something that is going right now in Europe Europe is going to create lots of stuff regarding this that means probably security uh companies will need to get some license even in Europe Europe uh to provide security services and also showing the data that was found in a specific European company will stay in Europe.

Um this is something that is also we expected to see.

Um so my opinion is that wherever is the the largest talent or I guess maybe the largest money they will attract each other is what I think. the curriculum part I hope it never happens because to me what I I feel like whoever shows uh that it is able to do the job like for example they happen to find the biggest vulnerabilities and that sort of stuff that is that shows that they know it's not like okay I did this certification necessarily for a security researcher I mean if if then like governments and other companies need licenses from the audit firms and they pay very well then I guess audit firms will start doing those licenses. Um but that's basically how I think it will happen.

So basically money moves talent. Uh yeah I think in in both ways right like um I would say that for example governments I I don't interact typically with them or banks or anything but I would say that it would be reasonable for them to go and fetch the best talent and that would mean in some way catering to them a little bit or I don't know but they might not want it not necessarily but if they pay a lot they will attract that that huge

if if if you look at like just traditional programmers like the sort if that we're probably just going to mirror that, right? So, it's it's the certifications are there, the courses are there. How do you hire? You still just go find the best through the referrals and there's there's there's no there's no test that's going to be able to, you know, sus out who's the best, right? Um the hiring is still done word of mouth and friends of friends and through the through the groups.

If you're if you're good I think

we'll find you.

Yeah. I think part of the reason that this certifications don't exist already is that there's so much innovation in the space. There's new languages coming out all the time, new protocols coming out all the time, new ways of doing things all the time. So, it's incredibly hard to nail down and I think the regulators that have tried this have struggled with this this uh this fact.

Yeah. My my prediction just for next let's say six months. So first of all we will see more and more company will rely on AI security but then many big protocols even now they considering to have manual audits not even crowdsource not even AI for their stuff and they will pay more than regularly. Second, we will see more companies who will work with subcontractors, not an employee for full day in the company. And this is where will be the battle for security researchers to be those subcontractor to join some audit.

Of course, currently we have those transit period when we have EI and everyone can use EI to generate some uh reports. But then as I mentioned it will be much cheaper of course to check your let's say releases but much more expensive to get professional report for specific needs. Yeah. Let's say for micro compliance let's say for some stuff.

Okay.

Yeah. What what what's crazy on that end is is some of the teams that they they're like yeah I I I I finished coding. Can can you check? And then I used AI. They're using AI.

So it's AIS that are checking the AI's code and then it's like it's up to us to actually be the eyes.

We got one request like hey guys I built a tool to connect a several AI then they started fighting between each other is valid or not can you give us one triure to check who is lie who is not regarding the report that's all. [laughter] So they need a charge.

Yeah. So I think um the thing basically that we have to remember for I guess security firms as well is that at this moment human in the loop is still very important right. So yeah and yeah I also like to thank all of each and one of you uh for being here and uh thank you very much for the time on the panel and uh yeah if you have any questions for them you can meet them after this talk. Thank you guys.

Thank you.

Thank you. Have a good day.