Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Bug Bounties to Find Hidden Vulnerabilities
Transcript
- Lucas: Luna, one of the quietest shifts in enterprise security over the last five years is how companies find their own vulnerabilities. It used to be you hired a penetration testing firm once a year, got a PDF report, fixed the high-severity items, and called it done. That model is dying. Luna: Replaced by bug bounty programs, right? Where companies invite a global crowd of researchers to break into their systems—for a price. Lucas: Exactly. And the numbers are staggering. HackerOne, one of the largest platforms, has paid out over $120 million in bounties since its founding. Bugcrowd, the other big name, has paid out more than $50 million. But it's not just about the payouts—it's about the sheer volume of vulnerabilities uncovered. Researchers on HackerOne have filed over 300,000 valid reports. Luna: Three hundred thousand. That's an order of magnitude more than what a traditional pentest firm would find across their entire client base. Lucas: Right. And the economics work. A typical enterprise might spend $100,000 to $500,000 a year on a bug bounty program. Compare that to the cost of a single data breach, which IBM's latest report pegged at $4.45 million on average. You don't need to prevent many breaches to break even. Lucas: And if these conversations are useful for what you're building or running, listener support is what keeps this show ad-free and subscriber-supported. You can throw a few dollars in the hat at buy me a coffee dot com slash fexingo. No pressure, just if the episodes are worth something to you. Luna: Yeah, totally. It's a small way to keep the conversation going without ads. So back to the bounties—the economics are clear, but adoption wasn't instant. What changed? Lucas: A few things. First, the rise of bug bounty platforms themselves made it easy for companies to set up programs without managing researchers directly. Second, high-profile breaches like the Equifax hack in 2017—which exploited a known vulnerability that could have been caught by a bounty—pushed boards to ask 'why aren't we doing this?' And third, the quality of researchers improved. Some of the top earners on these platforms make six figures annually. It's become a legitimate career path. Luna: So you've got a global workforce of motivated, skilled hackers vetted by the platforms. Companies love the scalability. But there's a tension, right? The relationship between researchers and corporations isn't always smooth. Lucas: No, it's not. The big flashpoint is disclosure. When a researcher finds a critical vulnerability, the company wants time to patch it before details go public. The researcher often wants credit and may want to publish their findings. Most platforms have a standard 90-day disclosure policy, but some companies drag their feet. And then you get 'partial disclosure' or even 'full disclosure' if the company doesn't respond, which can create bad blood. Luna: And there's the legal risk. Researchers worry they'll get sued for hacking even if they're acting in good faith. Some companies have responded by adopting 'safe harbor' policies—explicitly saying they won't pursue legal action for researchers who follow the rules. Lucas: Right. The Department of Justice even issued guidance in 2022 encouraging companies to adopt safe harbor for good-faith security research. But it's still not universal. And that's why many researchers prefer private programs—invitation-only bounties where they know the company is serious. Luna: Private programs are an interesting trend. Instead of opening the floodgates to thousands of researchers, companies invite a curated list of vetted hackers. It reduces noise and ensures higher-quality reports. Apple, for example, has a private program for iOS vulnerabilities. Lucas: Exactly. Apple's program is a great case study. They launched a public bug bounty in 2016, but initially capped payouts at $200,000. In 2019, they expanded it to include more attack vectors and raised the maximum to $1.5 million for certain vulnerabilities. But they also have a private, invite-only component for their most critical assets. The result? They've seen a dramatic increase in high-severity reports. Luna: And that's not unique to Apple. Google's Vulnerability Reward Program has paid out over $40 million since 2010. Microsoft started paying bounties in 2013. Even government agencies are getting in on it. The U.S. Department of Defense launched 'Hack the Pentagon' in 2016, which found hundreds of vulnerabilities in its first year. Lucas: Let's talk about the economics for researchers. The top earners on HackerOne, like 'Zerodium' or 'PinkDraconian', have made millions. But there's a huge distribution. Most researchers earn a few thousand dollars a year. It's a winner take most market. But for a skilled hacker in a country with lower cost of living, even a few thousand dollars is significant. Luna: And the platforms are adding features to keep researchers engaged. Bug bounty programs now include 'reputation scores', leaderboards, and even gamification. HackerOne has tiers like 'HackerOne Certified' and 'HackerOne Elite'. It creates a sense of career progression. Lucas: One thing I find fascinating is the shift from 'we'll pay for critical bugs' to 'we'll pay for any valid bug, even low severity'. Companies realized that low-severity bugs can chain together into serious exploits. So they're incentivizing the long tail. Luna: And that's where the economics get interesting. A company might pay $500 for a low-severity issue, but if they find 200 of those a year, that's $100,000. But if just one of those low-severity bugs is part of a chain that could lead to a breach, it's worth it. Lucas: Exactly. And the platforms are helping companies prioritize. They offer triage services—their own security analysts review reports, validate them, and assign severity. That takes a burden off internal teams. HackerOne's triage team has a median response time of under two hours. Luna: That speed is critical. Because the window between a vulnerability being discovered and a patch being deployed is when attackers are most likely to exploit it. You want to find and fix it before a bad actor does. Lucas: And that's the core value proposition of bug bounties: continuous testing. Traditional pentests are point-in-time. You test in April, you fix in May, but by June, new code is deployed, and you have new vulnerabilities. Bug bounties provide ongoing coverage. Luna: But they're not a replacement for internal security teams. You still need a team to triage reports, develop patches, and manage the program. It's a complement, not a substitute. Lucas: Absolutely. The best practice is to have both: a strong internal security team and a bug bounty program to catch what they miss. Some companies also run their own internal bug bounty programs where employees get rewards for finding vulnerabilities in internal tools. Luna: There's also the question of scope. Do you let researchers test everything? Most companies scope their programs—they say 'test these domains, but not these'. If you don't scope it properly, you might get researchers poking at your HR system or your internal wikis. Lucas: Right. And that's where the 'rules of engagement' come in. Companies define what's in scope, what's out of scope, and how much testing is allowed. Some forbid automated scanning tools because they can cause denial of service. Others allow it but require coordination. Luna: And then there's the dark side: bug bounty programs can attract malicious actors who try to extort companies. 'Pay me $50,000 or I'll sell this zero-day on the dark web.' That's a real risk, though platforms try to vet researchers. Lucas: It happens. But platforms have reputation systems. A researcher who tries extortion gets banned, and their reputation is destroyed. The vast majority of researchers are ethical. They want to build a career, not a criminal record. Luna: So where is this heading? I see a few trends. First, more companies will adopt 'bug bounty as a service' where platforms manage everything. Second, we'll see more specialization—researchers focusing on IoT, cloud, or AI vulnerabilities. And third, we might see regulation that mandates bug bounties for critical infrastructure. Lucas: I think you're right. The EU's Cyber Resilience Act, which is still being finalized, may require companies to disclose vulnerabilities found by researchers. That could push more companies to have formal programs. And the U.S. government is already leading by example with initiatives like 'Hack the Air Force' and 'Hack the Army'. Luna: And the payouts keep rising. In 2023, the largest single bug bounty payout was $1.2 million for a zero-day in a major tech company. That's more than many software engineers earn in a decade. Lucas: It's a testament to how valuable these discoveries are. And it's a good reminder that in cybersecurity, offense often outpaces defense. But bug bounties are one of the few tools that let you turn the hacker community into an extension of your defense team. Luna: Yeah. It's a win-win if done right. Companies get continuous testing, researchers get paid, and the overall ecosystem becomes more secure. Lucas: And the key is doing it right: clear scope, fair payout, fast triage, and safe harbor. Companies that get those four things right tend to attract the best researchers and get the best results. Luna: I think we'll look back in ten years and wonder why every company didn't have a bug bounty program. It's just common sense. Lucas: Agreed. For now, the early adopters are reaping the benefits. And the rest are starting to catch up. That's the show for today. I'm Lucas. Luna: And I'm Luna. Thanks for listening.