Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

1/19/2018
11:34 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

You Break It, They Buy It: Economics, Motivations Behind Bug Bounty Hunting

Some bug hunters make 16 times the median salary of software engineers in their home countries.

As the momentum grows in both the private and public sector for crowdsourced bug bounty programs, freelance security researchers are increasingly finding their profession for finding software vulnerabilities turning into a lucrative career opportunity in its own right.

Once the primary domain for hobbyists, curious security moonlighters and passionate penetration testers, freelance vulnerability research has typically been a profitless and frequently thankless job. That's not to say bright security minds haven't made money off of their work in the past--just that it's typically come from consulting gigs, opportunities for better in-house security positions, very targeted and involved penetration testing engagements, and so on. All of which often require a broader set of business skills, a specific educational background and even geographical location not necessarily required for pure-play bug hunting.

Bug bounties are completely changing this economic equation, making it possible for organizations to tap into a collective of hackers who they may otherwise have not been able to leverage in the past. And that pool is maturing as it becomes possible to make a decent living hunting bounties. According to a new report out from HackerOne, the economics are such that bug bounties are becoming financially significant in the lives of many of these researchers.

Based on data from the nearly 1,700 researchers producing through the HackerOne platform, approximately 14% of hackers can now count on bounties to make up 90- to 100% of their annual income. An additional 25% say that they depend on bounties to make up at least half of their income. In dollars and cents, about 12% of hackers make $20,000 per year. The really dedicated top performers - about 3% of hackers - are pulling in $100,000 or more per year.

This particularly is a big deal in countries with low median salaries, as most bug bounties don't have geographic limiters, which means hackers can work from anywhere. This is giving people with strong coding skills and the hacking mindset a new avenue to seriously increase their earning potential.

According to the report, top-earning researchers pull in 2.7 times the median salary of a software engineer in their home country. And in countries like India, that multiplier is more along the lines of 16 times the median developer salary.

"This makes bounties enormously attractive and gets precisely the eyes you want looking at your security things. Bounties are a great leveler in terms of providing opportunity to all not solely money motivated," Troy Hunt, a security researcher and consultant, told HackerOne for this study.

This is a body of researchers who are largely self-taught. While about half of these researchers have studied computer science at a collegiate level, less than 5% learned hacking skills in the classroom. This is a big clue as to the passion they bring to their projects.

For the most part, these are people who would be hacking anyway - the money just makes it possible to dedicate more time to what they love because people are paying them to do it. Money is a top motivator but it's not the number one motivator, the survey found. Other motivators named more frequently were the drives for the challenge, the learning opportunity, and simply the fun of hacking.

But let's keep it real: the fact remains that bounties are still on the bleeding edge of best security best practices. Most companies today don't even have a formalized vulnerability disclosure program, let alone a full-fledged bug bounty program. Many of these researchers still find plenty of vulnerabilities with no expectation for remuneration but have difficulty disclosing them because organizations can't get their acts together to receive them properly.

According to this latest study, one in four freelance security researchers say they've not reported some vulnerabilities they've found because the target company didn't have a channel to disclose it. 

The silver lining: over 72% of researchers report that companies receiving recent vulnerabilities have been more open to hearing from researchers than they had in the past.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/22/2018 | 12:15:48 PM
Are bug bounties part of the cure, or part of the problem?
Seems we're putting a lot of trust in the members of a club; one with the only membership requirement being talent.

There have always been those who would, responsibly, inform software providers about errors or vulnerabilities - with recognition being the only reward. Bug hunters may, on average, be ethical and civic minded; but you don't have to be to find profit in finding vulnerabilities.  We've now created the expectation that if someone finds a vulnerability in your software - YOU will pay to learn what they found.  Odds are you will, one way or another.  Of course, there will also be those who will pay to find vulnerabilities in the code of their rivals.  Are bug bounties part of the cure, or part of the problem?
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9405
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
CVE-2020-9406
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2020-9407
PUBLISHED: 2020-02-26
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
CVE-2020-9398
PUBLISHED: 2020-02-25
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2015-5201
PUBLISHED: 2020-02-25
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows r...