Flock's Bishop Fox engagement: Six months later

Bishop Fox’s offensive security experts will engage in complex, multistage and multilayer adversarial testing across all of Flock’s products, both hardware and software. The results and any ensuing updates will be communicated transparently to reinforce confidence in Flock’s strong security posture.

That February 2026 press release followed signifiicant bad press after a series of vulnerabilities had been discovered:

• In November 2025, Jon “GainSec” Gaines published a report with 51 security findings (22 assigned CVEs).
• That same month, Benn Jordan published the video “We Hacked Flock Safety Cameras in under 30 Seconds. 🫥”
• A month later, Jordan and 404 Media published “This Flock Camera Leak is like Netflix For Stalkers,” showing Flock PTZ cameras were completely unsecured and accessible on the Internet.
• Then, in January 2026, Nexanet.ai published “53 Times Flock Safety Hardcoded the Password for America’s Surveillance Infrastructure,” an incident which revealed “license plate detections, patrol car locations, drone telemetry, body camera locations, 911 call data, and surveillance camera locations from approximately 12,000 law enforcement, community, and private sector deployments nationwide.”

Despite having been independently validated and assigned CVEs (including severity 9.8, CVE-2025-59407), Flock’s response has been — and continues to be — a combination of outright denial and deflection.

To any critical observer, it was obvious from the outset that the security audit by Bishop Fox was never going to work, and that the engagement was little more than a PR stunt. Flock even said as much when saying the goal wasn’t to improve its security but “to reinforce confidence” in it.

In a March 27, 2026, blog post (archive), Flock already quietly downgraded the Bishop Fox engagement from the “complex, multistage and multilayer adversarial testing across all of Flock’s products, both hardware and software” from the month before to a “regular annual penetration test.”^[1]

Two months later, Flock’s CISO, Chris Castaldo, obliquely referenced outside audits in a YouTube video where he said, “[t]he really important thing when it comes to saying you’re secure — or your product is secure — is someone other than you doing that analysis.” He did not mention Bishop Fox — or anyone else — was conducting such an audit for Flock. Seems like something one might mention in a promotional video about security.

Another two months later — in July 2026, six months after the Bishop Fox announcement — Flock published a YouTube short where CEO Garrett Langley says: “We partnered with Bishop Fox months ago to start running an internal audit of how we can strengthen our security posture. We will continue to work with them for the years to come. Continuing to harden and protect this valuable technology.”^[2]

Flock’s CVE entries have not been updated since late 2025, meaning the same vulnerabilities still exist across tens of thousands of cameras deployed nationwide, and used to support warrants and as evidence in criminal trials. There is no telling how many people have been arrested or convicted because of evidence sourced from Flock’s insecure system. According to Flock, it’s many.

In the span of six months, Flock went from announcing a complex across-the-board red-team exercise, where findings would be “communicated transparently” to an “internal audit” that appears to be nothing more than the minimum pentest required for SOC.2 compliance. Its “public safety” hardware and software is as insecure as it was six months ago.

While Langley and Castaldo are publishing YouTube videos minimizing the issues and reframing the Bishop Fox engagement, Flock sales won’t answer questions about the whole ordeal because you can’t believe what you hear on YouTube. Maybe they have a point.