Are Pentests Relevant with Bug Bounties

on YouTube ↗39m

" summary

Pen testing stays necessary for compliance, internal network and OT/ICS checks, social engineering and deep source‑code or zero‑day hunts, while bug bounties scale continuous coverage for public web/cloud surfaces and find commodity and some novel bugs by hundreds or thousands of testers. Use adversary emulation (MITRE ATT&CK, CALDERA) to fill gaps, run vulnerability scans for low‑hanging fruit, and keep a formal vulnerability disclosure policy. Combine both: pen tests for point‑in‑time depth, bug bounties for ongoing breadth.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 0:55Omar Santos
3. 10:31What Pen Testing Is
4. 15:23Red Team
5. 19:23What Are the Benefits of Doing Bug Bounties versus Doing Pen Testing
6. 28:04Vulnerability Disclosure Program
7. 29:35Vulnerability Disclosure
8. 32:31How Do You Convince Uh Management To Fund Um Bug Bounty

" related talks

• 12mConfessions of a reformed pentesterNick Murison · NDC Oslo 2020
• 33mWorking with penetration testers as a developerLiam O · PyConline AU 2021
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 19mPenetration TestingBrandy Griffin · DevOpsDays Atlanta 2022
• 50mA CISO's Best Friend: The PentesterSean Atkinson, Chris Elgee · RSA Conference 2023
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 44mApplication Security: Everything we know is wrongEoin Keary · AppSecUSA 2013
• 20mMaking Penetration Tests Actually UsefulIra Winkler · RSA Conference 2014