Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using Bug Bounty Platforms
Transcript
- Lucas: So last week, HackerOne announced it had paid out over $120 million in bounties to ethical hackers since its founding. That's not just a vanity metric — it's a signal that the model has gone mainstream. Luna: And I think we've reached the point where if you're a mid-size company or larger and you don't have a bug bounty program, the board is starting to ask why. Lucas: Exactly. So let's pull apart how these platforms actually work, where the money goes, and why some security teams still resist. Luna: Yeah, before we go deep — just a quick thing. If these conversations are useful for what you're building or running, and you want to keep them ad-free, the simplest way is buy me a coffee dot com slash fexingo. Lucas: Honestly, if today was worth a coffee to you, that's the link. No pressure, just appreciate you being here. Luna: Alright, back to bug bounties. Lucas, set the scene — how did we get from in-house pentesting to a global marketplace for hacking? Lucas: It really started with companies like Mozilla and Google offering small rewards for bugs in their browsers. But the turning point was 2012 when Facebook paid a researcher $50,000 for a critical bug. That made headlines and suddenly the idea of crowdsourced security went from fringe to credible. Luna: And then HackerOne launched in 2012, Bugcrowd in 2013, and Synack around the same time. They basically created a marketplace where companies post assets, hackers hack them, and both sides get rated. Lucas: Right. And the economics are pretty interesting. On HackerOne, the median payout for a critical severity bug is around $3,500. But top researchers — the ones with high reputation scores — can earn six figures a year. There's a guy who goes by 'N0x' who made over $400,000 in bounties last year. Luna: That's not bad for a side hustle. But obviously the big money is in the private programs. Public programs tend to have lower payouts because they get flooded with low-quality reports. Lucas: That's a key point. Most large companies run private, invite-only programs. They only open to the public when they want a surge of coverage — like before a major product launch. And they cap the number of participants so the signal to noise ratio stays manageable. Luna: So how does a company decide how much to pay? Is it based on severity, CVSS score, or something else? Lucas: Most use a variant of the Common Vulnerability Scoring System, but they tweak it. For example, a remote code execution on a high-value server might pay $10,000, while a low-risk cross-site scripting bug on a marketing site might only get $200. And some platforms like Bugcrowd let companies set a bounty range per severity level. Luna: And the companies themselves are spending millions. I saw a report last year that Google paid out over $10 million in 2024 alone. That's more than most pentesting firms charge for a full engagement. Lucas: And that's actually the core tension. Traditional penetration testing gives you a fixed scope, a fixed timeframe, and a report at the end. Bug bounties give you continuous coverage, but you pay per finding. So a company like Google might spend $10 million on bounties, but they also have an internal security team and external pentesting. It's not either-or. Luna: But for a smaller company, a bug bounty program can be a cheaper way to get broad coverage. You only pay for results, not for hours. Though you do need someone to triage the reports. Lucas: And that's where the platforms add value. HackerOne, Bugcrowd, Intigriti — they all offer triage services. They verify the bug, de-duplicate it, and assign a severity before it even reaches your security team. That's huge for a team of two or three. Luna: What about the legal side? I remember when Uber started their bug bounty program in 2016, there was a lot of anxiety about researchers going too far — like accessing data they shouldn't. Lucas: Yeah, the safe harbor policy is critical. Every reputable program has a clear safe harbor clause that says if you follow the rules, we won't sue you. But the rules vary. Some programs allow testing only on certain subdomains, some prohibit automated scanning, some require you to stop as soon as you access any user data. Luna: And some researchers have been sued anyway, which creates a chilling effect. There was a case in 2017 where a researcher went to jail for finding a bug in a hospital's system — though that was because he demanded a ransom. Lucas: Right, that's the line. Good-faith research versus extortion. The vast majority of bug bounty hunters are ethical. But a few bad actors give the whole field a stigma, which is why companies are so careful about their program scope. Luna: Let's talk about the platforms themselves as businesses. HackerOne raised over $160 million from investors. Bugcrowd raised about $80 million. Are they profitable? Lucas: As of their last public disclosures, HackerOne wasn't profitable — they were investing in growth. But they have a solid recurring revenue model. Companies pay a subscription fee for the platform and then pay bounties on top. So the platform makes money whether a bug is found or not. Luna: And Bugcrowd launched a managed bug bounty offering where they run the whole program for you. That's a higher-margin service. Lucas: Exactly. And now there's a new wave of platforms like YesWeHack and HackenProof that focus on specific regions or types of testing. The market is getting fragmented. Luna: So if I'm a CISO listening to this, what's the argument for starting a bug bounty program today? Lucas: The biggest argument is access to a diverse talent pool. Traditional pentesting firms are limited by their employee base — maybe 50 or 100 pentesters. Bug bounty platforms give you access to thousands of researchers with different backgrounds and tools. And they're incentivized to find the weird, hard to find bugs that a pentester might miss because of time constraints. Luna: Plus, a good bug bounty program can actually improve your security posture faster than a periodic test. You're constantly getting new findings, and the researchers help you prioritize because they report what they think is critical. Lucas: But there are downsides. False positives can overwhelm a small team. And if your bounty amounts are too low, you'll only attract low-effort researchers. Also, some vulnerabilities — like logic flaws in business processes — are hard to communicate in a bounty report. Luna: And there's the question of whether you're paying for bugs you would have found anyway. Some argue that bug bounties are just a tax on having a poorly designed application. Lucas: I think that's a little harsh. No application is perfect. And bug bounties find things that static analysis and even top-tier pentesters miss. The data from HackerOne shows that 35% of critical bugs are found by bounty hunters who had never hacked for that company before. Luna: So there's a freshness factor. New eyes on the same codebase. Lucas: Right. And the platforms are now using AI to help with triage. Bugcrowd has a product called CrowdControl that uses machine learning to predict severity and de-duplicate reports. HackerOne has a similar feature. That reduces the burden on the security team. Luna: What about the researchers themselves? Is it a viable career to just do bug bounties full-time? Lucas: For a small number, yes. There are maybe a few hundred researchers globally who earn over $100,000 a year from bounties. But most do it part-time. It's a lot of competition — you're competing against thousands of other people for the same bugs. And the payouts have been declining in some categories because the easy bugs are already found. Luna: So the gold rush phase might be over for simple bugs. But for complex, high-value vulnerabilities — like chain exploits or kernel bugs — the bounties are higher than ever. Microsoft has paid $200,000 for a single bug. Lucas: And that's where the future is. Platforms are moving toward vulnerability chaining bounties — rewarding researchers for combining multiple bugs to achieve a bigger impact. Also, there's a growing trend of 'bug bounty for AI' — testing large language models for prompt injection or data leakage. Luna: I think that's going to be a huge area in 2026 and 2027. AI companies are already launching bounty programs for their models. Lucas: Yeah, OpenAI and Anthropic both have programs. And the bounties can be substantial — up to $50,000 for a serious safety bypass. Luna: So the model is evolving. It started with websites, then mobile apps, then APIs, then cloud infrastructure, and now AI. Every new attack surface creates a new bounty category. Lucas: And for security leaders, the takeaway is: bug bounties are not a replacement for a security program. They're a complement. But they're a very effective one, especially when combined with good triage and a clear scope. Luna: Alright, that's a good place to leave it. Next time we can talk about how bug bounty programs are integrating with CI/CD pipelines — that's a whole other layer. Lucas: Absolutely. For now, thanks for listening. We're Lucas and Luna, and this is Cybersecurity Business with Fexingo.