2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
summary
Laid out are the concrete results of Microsoft’s bounty experiments: using market analysis and timing to shift where bugs surface, offering targeted payouts and a year‑round $100,000 mitigation bypass incentive, then launching a 30‑day IE11 beta bounty paying up to $11,000 and receiving 23 submissions, 18 critical that would have otherwise been sold for six figures. The program pays over a quarter million dollars so far, reverses brokered reporting trends, and funnels fixes back into the SDL while handling 200,000 reports/year at scale.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:13Impossible Supertasks
- 4:52Data: Vulnerability Reporting Trends
- 10:41The Vulnerability Economy
- 14:44Microsoft's Bounty Programs
- 25:39Mitigation Bypass Bounty: $100,000 James and the Giant Check Presented 12/12/13
- 36:11How to Structure Your Own Bounty Programs: Vulnerability Economy Research
related talks
56mBounties and the SDLC
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
20mGetting to $10,000 – the variables at play in determining bounty awards
30mBeyond Quick Cash: Rethinking Bug Bounties for...
07mLessons learned from running big bug bounty programs
01mSponsor Interview
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
04mAnother year of HackerOne statistics