Running an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
summary
Covers concrete steps: implement a two-way vendor API integration, add Slack chat‑ops or Tines automations to auto‑triage and escalate, build a ServiceNow app to store RCA, patch snippets and draft advisories, and pull a patch adoption rate from production to prioritize fixes. Use FIRST.org PSIRT phases, run both post‑incident reviews and post‑mortems, track OKRs (CISO‑level), time‑to‑triage and researcher retention, calibrate bounties every six months, start small and stress‑test processes before going public.
AI-written summary · about
chapters (18)
- 0:00Introduction and overview
- 1:45Automation in incident response
- 4:12Building a custom PERT system
- 8:46Variant hunting and legacy issues
- 11:18Feedback loop for secure development
- 14:04Staffing and team structure
- 16:34On-call expectations and coverage
- 17:16Disclosure process and playbook
- 18:00Metrics and program justification
- 20:50Researcher retention strategies
- 24:20Team health and efficiency metrics
- 26:27Researcher cultivation and talent pool
- 30:19Alternative rewards and recognition
- 31:02Private vs public program debate
- 32:06Measuring program maturity
- 35:17Starting small and stress testing
- 36:41PERT framework and resources
- 37:22Q&A session
related talks
48mGamify your Security
52mPractical Tips For Running A Successful Bug Bounty Program
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
46mHow to run a successful bug bounty programme
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
11mBuilding a Bug Bounty Program: From the Trenches
01mSponsor Interview
58mThe Tactical Application Security Program: Getting Stuff Done