Hacker-Powered Data: Why the Most Common Vulnerabilities Aren’t What You Think They Are
summary
HackerOne counts incidents across 140,000 valid vulnerabilities from ~1,700 programs and $75M paid in bounties to show which flaws actually get exploited and rewarded. Cross‑site scripting accounts for about 30% of bounties (stored XSS averages $481 vs generic $288), while XXE is rarer but highest paid (~$1,600). Skilled hackers focus on SSRF, code injection and business‑logic errors; the platform’s empirical list covers ~90% of found vulnerabilities versus OWASP’s ~50%, a data point used to prioritize real‑world patching.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:43Data will transform security operations
- 1:48Audience questions
- 3:55Should hackers be
- 4:41HackerOnes data
- 5:46HackerOnes Top 10 Vulnerabilities
- 6:20Crosssite scripting
- 7:35Crosssite scripting bounties
- 8:35Why does this comparison matter
- 9:16How this data can help prioritize
- 9:40Hackers skills and performance
- 10:20Top and bottom bounties
- 11:05Industry differences
- 12:03Trends
- 13:05Top 10
- 13:51Music
- 15:40Comparison
- 15:56Limitations
- 18:56Vulnerability Types
- 19:14What do programs pay for
- 19:33XZ
- 20:45Not all vulnerabilities are created equal
- 21:14Why does it matter
- 21:38Better conversations with development
- 22:10Mutual understanding
related talks
30mBeyond Quick Cash: Rethinking Bug Bounties for...
41mWhat the Hack: A Personal Story about Ethical Hacking
04mAnother year of HackerOne statistics
16mThe hacker army protecting your data
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
43mHow The Hack?
39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"
36mFrom Bounties to Bureaucracy