Two young FPT cybersecurity experts rank among Patchstack’s Top 15 Vulnerability Researchers with AI-assisted approach

Two FPT cybersecurity experts have discovered nearly 40 security vulnerabilities affecting the global WordPress ecosystem by combining AI tools with their research, earning them spots in Patchstack’s Top 15 vulnerability researcher rankings for May 2026. The achievement not only highlights FPT’s technological capabilities but also demonstrates the potential of applying AI to security research, as the technology is profoundly reshaping the race between cyber offense and defense.

Two FPT cybersecurity experts make their mark on Patchstack’s vulnerability researcher leaderboard, ranking 9th and 14th

Specifically, two cybersecurity experts from the New Technology Services Division of FPT IS, FPT Corporation – Bui Duc Tai (nickname: Dutafi) and Nguyen Quang Truong (nickname: Roll) – have made their mark on the vulnerability researcher leaderboard under Patchstack’s Bug Bounty program, a vulnerability management and disclosure platform for the WordPress ecosystem. According to the May 2026 leaderboard, Bui Duc Tai ranked 9th and Nguyen Quang Truong ranked 14th globally. In total, nearly 40 vulnerabilities discovered by the two experts were validated by Patchstack and disclosed to the community during the month.

Patchstack currently operates one of the largest Bug Bounty programs for the WordPress ecosystem, bringing together a global community of cybersecurity experts to identify and report security vulnerabilities. Once validated, eligible findings are disclosed through the platform’s vulnerability database, helping developers promptly address risks before they can be exploited.

Patchstack’s monthly leaderboard recognizes researchers based on the number of validated vulnerabilities, the quality of their reports, and the impact of their findings. The simultaneous presence of Bui Duc Tai and Nguyen Quang Truong in the May 2026 Top 15, with nearly 40 disclosed vulnerabilities between them, demonstrates the FPT team’s in-depth research capabilities and ability to identify and validate security vulnerabilities, while also reflecting the practical value of findings recognized by the international cybersecurity community.

AI is profoundly changing the race between cyber offense and defense. While AI tools can automate scanning, vulnerability discovery and increasingly sophisticated attacks, the technology is also becoming a powerful assistant for cybersecurity experts in identifying threats, researching vulnerabilities and strengthening defensive capabilities.

To improve research efficiency, Bui Duc Tai and Nguyen Quang Truong developed and applied a process combining source-code analysis, artificial intelligence and practical validation to identify potential security vulnerabilities within the WordPress ecosystem. Rather than relying entirely on manual reviews, AI is used to process large volumes of source code, assess context and prioritize potentially high-risk cases.

The process begins with automated source-code analysis tools that scan large numbers of WordPress plugins and themes, identifying code patterns that may indicate weaknesses in access control mechanisms, unsafe input handling, or errors that could lead to exploitation. Following the initial screening, AI is used to group similar findings, eliminate noise, assess their likelihood of being genuine vulnerabilities, and help identify cases that could represent real-world security issues. A detailed account of this process is available here.

As a result, the amount of work requiring manual review is significantly reduced, allowing experts to focus their resources on the highest-value cases. However, according to the experts, AI serves only as a supporting tool throughout the research process.

Every potential finding must undergo validation in a test environment before being submitted to the receiving platform for disclosure. In practice, a number of cases assessed by AI as highly credible are subsequently determined to be false positives after verification. Conversely, many complex vulnerabilities involving business logic, authorization or multi-step exploit chains still require hands-on experience, critical thinking and expert judgment from security professionals.

Sharing this approach, Bui Duc Tai said: “AI helps us process large volumes of data and significantly shorten the initial review process. However, determining whether a finding is actually a vulnerability still requires human analysis, validation and assessment. AI is a powerful supporting tool, but it cannot replace security experts.”

Using AI to strengthen defensive capabilities against cyberattacks is becoming an inevitable trend in cybersecurity

According to the experts, AI’s greatest value does not lie in replacing people, but in enabling experts to focus on tasks that require deep thinking and experience. As cyberattacks become increasingly automated and scalable through AI, leveraging the same technology to strengthen defensive capabilities is becoming an inevitable trend in cybersecurity.

The achievements of Bui Duc Tai and Nguyen Quang Truong on the Patchstack leaderboard further demonstrate the quality and technological capabilities of FPT’s cybersecurity experts on the international stage. This is also the result of a culture of learning, research and innovation that FPT has fostered over many years, encouraging engineers to continuously update their knowledge of new technologies, proactively solve real-world challenges and meet global technology standards.

Cybersecurity is currently one of the five key technology areas that FPT has identified for investment to meet growing demand for data protection, system security and digital trust. By significantly investing in cybersecurity capabilities, developing a highly qualified expert workforce and building a Made by FPT security solutions ecosystem, the Corporation continues to strengthen its ability to master core technologies, support the Government and businesses in building secure digital infrastructure, protect data and promote sustainable development in the AI era.

Amid increasingly sophisticated cybersecurity threats, particularly as AI transforms both offensive and defensive methods, continuously strengthening capabilities in security research, vulnerability discovery and early response will remain a key priority for FPT. These efforts will help create a safer cyberspace for customers, businesses and the wider community, while further strengthening FPT’s position in cybersecurity in Vietnam and the region.