Gamify your Security
summary
Argues that an internal bug bounty cuts external noise and fits a budget, then lays out concrete setup: centralize findings in the ticketing system, script scanner output into Jira, score with CVSS and SLAs (critical = ASAP, high = 7–30 days, medium = 30–60), and require teams to spend ~20% of a sprint clearing backlog. Recommends short weekly training lunches, team-based prizes (donuts, rotating trophy), forbids finding your own bugs, keeps external bounties separate, and warns to track metrics (number fixed vs. found).
AI-written summary · about
chapters (17)
- 0:00Start
- 3:48External Bug Bounties
- 5:10Getting Commitment
- 7:08Things To Consider
- 7:55Watch the Non-Verbal Communication
- 8:20Non-Verbal Communication
- 9:09Sticking to the Facts
- 10:23Organizing Vulnerabilities
- 11:40Faqs Where Should Vulnerability Data Be Centralized
- 13:07Prioritization
- 14:02Service Level Agreement
- 16:07Bug Bounty
- 16:40Training
- 17:59Patching
- 24:16Inviting Internal People to the External Bug Bounty
- 28:31Do You Have any Metrics about How Many More Vulnerabilities You Found because of the Internal Bug Bounty
- 47:52Last Call for Questions
related talks
46mHow to run a successful bug bounty programme
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
52mPractical Tips For Running A Successful Bug Bounty Program
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
11mBuilding a Bug Bounty Program: From the Trenches