You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting

As the momentum grows in both the private and public sector for crowdsourced bug bounty programs, freelance security researchers are increasingly finding their profession for finding software vulnerabilities turning into a lucrative career opportunity in its own right.

Once the primary domain for hobbyists, curious security moonlighters and passionate penetration testers, freelance vulnerability research has typically been a profitless and frequently thankless job. That's not to say bright security minds haven't made money off of their work in the past--just that it's typically come from consulting gigs, opportunities for better in-house security positions, very targeted and involved penetration testing engagements, and so on. All of which often require a broader set of business skills, a specific educational background and even geographical location not necessarily required for pure-play bug hunting.

Bug bounties are completely changing this economic equation, making it possible for organizations to tap into a collective of hackers who they may otherwise have not been able to leverage in the past. And that pool is maturing as it becomes possible to make a decent living hunting bounties. According to a new report out from HackerOne, the economics are such that bug bounties are becoming financially significant in the lives of many of these researchers.

Based on data from the nearly 1,700 researchers producing through the HackerOne platform, approximately 14% of hackers can now count on bounties to make up 90- to 100% of their annual income. An additional 25% say that they depend on bounties to make up at least half of their income. In dollars and cents, about 12% of hackers make $20,000 per year. The really dedicated top performers - about 3% of hackers - are pulling in $100,000 or more per year.

This particularly is a big deal in countries with low median salaries, as most bug bounties don't have geographic limiters, which means hackers can work from anywhere. This is giving people with strong coding skills and the hacking mindset a new avenue to seriously increase their earning potential.

According to the report, top-earning researchers pull in 2.7 times the median salary of a software engineer in their home country. And in countries like India, that multiplier is more along the lines of 16 times the median developer salary.

"This makes bounties enormously attractive and gets precisely the eyes you want looking at your security things. Bounties are a great leveler in terms of providing opportunity to all not solely money motivated," Troy Hunt, a security researcher and consultant, told HackerOne for this study.

This is a body of researchers who are largely self-taught. While about half of these researchers have studied computer science at a collegiate level, less than 5% learned hacking skills in the classroom. This is a big clue as to the passion they bring to their projects.

For the most part, these are people who would be hacking anyway - the money just makes it possible to dedicate more time to what they love because people are paying them to do it. Money is a top motivator but it's not the number one motivator, the survey found. Other motivators named more frequently were the drives for the challenge, the learning opportunity, and simply the fun of hacking.

But let's keep it real: the fact remains that bounties are still on the bleeding edge of best security best practices. Most companies today don't even have a formalized vulnerability disclosure program, let alone a full-fledged bug bounty program. Many of these researchers still find plenty of vulnerabilities with no expectation for remuneration but have difficulty disclosing them because organizations can't get their acts together to receive them properly.

According to this latest study, one in four freelance security researchers say they've not reported some vulnerabilities they've found because the target company didn't have a channel to disclose it. 

The silver lining: over 72% of researchers report that companies receiving recent vulnerabilities have been more open to hearing from researchers than they had in the past.

Related Content: