9 of the Biggest Bug Bounty Programs9 of the Biggest Bug Bounty Programs
These programs stand out for the size of their rewards and how much they have paid in total to security researchers in bounties over the last several years.
August 11, 2017
Bug bounty programs have become an increasingly popular way for organizations to find and fix vulnerabilities in their software and services.
Until relatively recently it was mainly the software companies and technology firms that employed the tactic.
However, over the last two years or so a growing number of other organizations—such as airlines, automobile companies and financial firms—have begun crowdsourcing their vulnerability discovery via formal bug hunting programs as well.
The primary appeal of these programs is that they give organizations—especially resource strapped ones—a relatively low cost way to discover security holes they might have missed otherwise.
Bug bounty coordination firms such as HackerOne and BugCrowd have both reported widespread interest in their services from organizations across the spectrum. Both maintain rosters of thousands of security researchers.
"We are seeing adoption continue to grow as enterprises are recognizing that bug bounty programs are a key aspect of their security program," says David Baker vice president of operations at BugCrowd.
Just this week for instance BugCrowd announced that it had launched a bug bounty program for a secret customer. What made the announcement significant is the maxium reward of $250,000 that is being offered under the program—one of the highest payouts in the industry. Any researcher can apply for the program but only those selected can participate.
"As the model gains traction, it’s attracted more traditional businesses looking to combat the impact of a growing and changing attack surface and motivated adversaries," Baker says.
Here in no order are some of the top bug bounty programs:
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingDec 12, 2023
SecOps & DevSecOps in the CloudDec 14, 2023
What's In Your Cloud?Jan 17, 2024
Everything You Need to Know About DNS AttacksJan 18, 2024
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks