To bounty, or not to bounty? Security@ insights from 500 organizations
summary
Aggregated data from over 500 programs yields a weighted index across six dimensions (Researcher Breadth, Researcher Depth, Vulnerabilities Found, Response Efficiency, Reward Competitiveness, Signal Ratio) and shows ~17,000 reported bugs and about $6M in bounties paid. An invitation‑only method—invite ~22 researchers—returns 2.7 vulnerabilities per researcher and sees 80% find a critical bug within 24 hours. The framework quantifies where SLDCs are ready for monetary incentives and where tooling, process or response time must improve before paying bounties.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:32Facebook
- 1:58HackerOne
- 3:09A caveat
- 4:07Who is this talk for
- 5:09Different ways to answer
- 5:58Vulnerability metrics
- 10:00Response efficiency
- 11:36Bar metrics
- 14:42Example program
- 20:05Do we bounty or not
- 21:21Responsible disclosure
- 22:44Community resources
- 23:57State of the Internet
- 29:32Bug bounty
- 38:29Riot Games
- 39:08Summary
- 41:05Would you do a bug bounty
- 42:30How do you deal with disclosures
related talks
56mBounties and the SDLC
30mBeyond Quick Cash: Rethinking Bug Bounties for...
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
52mPractical Tips For Running A Successful Bug Bounty Program
55mYour License for Bug Hunting Season
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
07mLessons learned from running big bug bounty programs