"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
summary
Researchers conduct 53 interviews with practitioners and report concrete findings: organizations treat bug bounty programs as replacements for internal testing despite evidence they often widen scope gaps; trust and communication failures with external testers and between teams create narrow scopes and missed bugs; responsibility for fixes is unclear, producing a persistent remediation bottleneck; smaller orgs avoid bounties for cost and legal risk. Recommendations include full pentests and remediation plans before launching bounties, clear ownership for triage, and incentives for external testers to help verify fixes.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:21Motivation
- 1:32Methodology
- 3:07Vulnerability Management Pipeline
- 4:15Main themes
- 5:11Strategic Decision Making
- 5:52Pen testing
- 6:21Red teaming
- 7:41Bug Bounty Programs
- 9:49Vulnerability Discovery
- 10:23Communication
- 10:45Trust
- 11:52Why not involve external testers?
- 12:27Vulnerability Remediation
- 13:20Compliance vs. Security
related talks
52mPractical Tips For Running A Successful Bug Bounty Program
55mYour License for Bug Hunting Season
11mBuilding a Bug Bounty Program: From the Trenches
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
07mLessons learned from running big bug bounty programs
48mGamify your Security