Lessons learned from running big bug bounty programs

on YouTube ↗07m

" summary

Early bounties start with $500 from Mozilla in the mid‑90s, Google launches programs in 2010, and Microsoft spends three years building its first programs; ISO guidelines (29147 and 30111) appear in 2014 and are under revision while still 94% of the Forbes 2000 lack a published reporting channel so only 6% do; bug bounties are an incentive subset of vulnerability disclosure, they augment but do not replace pen tests (IoT and hardware are hard to crowdsource), and providers differ: Bugcrowd for outsourced triage, HackerOne for automation and power users, Cenac for vetted researcher engagement.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 0:01The History of Vulnerability Disclosure and Bug Bounty Programs
3. 0:38The First Bug Bounty
4. 3:01The Difference between a Vulva Closure Program in a Bug Bounty Program
5. 3:55Bug Bounties May Replace Penetration Testing

" related talks

• 45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at MicrosoftAanchal Gupta, Katie Moussouris · RSA Conference 2024
• 45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOneKatie Moussoris · Security @Scale 2014
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017
• 50mTo bounty, or not to bounty? Security@ insights from 500 organizationsAlex Rice · OWASP AppSec California 2016
• 30mBeyond Quick Cash: Rethinking Bug Bounties for...Farah Hawa, Jayson Grace · BSidesSF 2024
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018