Bug Bounty’s intrinsic cost-effectiveness – thanks to the crowdsourced and, in YesWeHack’s case, results-based pricing model – is a big plus for public-sector organisations.

As well as praising the “cost model”, the CISO of one such entity, the European Community of Alsace (Collectivité européenne d'Alsace), hailed the agility of 

In the video and writeup below, Jérémie Piazza explains the strategic decision to launch a Bug Bounty Program in 2022, how the model fosters more secure development, and the strengths underpinning the partnership with YesWeHack.

The European Community of Alsace is a regional government body that provides services tailored to the needs of the Alsace region in France. It emerged from the merger of two departmental councils, Haut-Rhin and Bas-Rhin, in 2021.

ON THE IMPORTANCE OF CYBERSECURITY AT THE EUROPEAN COMMUNITY OF ALSACE…

Security is an important, even strategic, issue, particularly in the context of the convergence of teams, systems and technologies, added to an increasing number of cyber-attacks against local authorities, as well as the possible assimilation to a European institution. 

All this means that the local authority’s management really takes security issues into account.

Setting up a Bug Bounty Program is part of our vulnerability management process. In this context, we opted for Bug Bounty for agility reasons, particularly in terms of the scope, which can be modified on demand.

Because the cost model is particularly clear, you have a subscription cost and a cost linked to bounties. The notion of bounties also makes development teams aware of the cost of vulnerabilities and encourages them to gradually integrate security by design.

And then we have the advantage of calling on a 

 who have very different approaches to managing and detecting these vulnerabilities.

We also use Bug Bounty as part of the approval process for our teleservices.

We launched our program in 2022, in stages – initially with a limited number of assets and hunters, to enable our teams to mature both in terms of bug resolution and the use of the platform.

The main challenge in setting up a Bug Bounty Program is essentially an internal one. It will depend on your teams’ ability to deal with the bugs reported.

Initially, we were careful to ensure that our teams were capable of handling all the bugs reported by the hunter, to maintain their interest in the program.

The next steps are to broaden our scope. Today, we only have a certain number of institutional sites. In the future, we hope to add externally hosted sites to this number.

Our relationship with YesWeHack is now one of 

, based both on the expertise of the YesWeHack teams in helping us use the platform and on the quality of the bugs reported by hunters.

HIS ADVICE FOR LAUNCHING OR GROWING A BUG BOUNTY PROGRAM…

One piece of advice I’d give to those who want to get started is simply to do it gradually. Give yourself time to mature, both in terms of the type of bug reported and in terms of your teams’ ability to deal with these bugs.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to schedule a demo with one of our experts.

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

In the ever-evolving landscape of cybersecurity, YesWeHack recognises the vital role our hunters play in securing our clients' digital assets and their customers' sensitive data. 

To this end, we periodically send special posters to ethical hackers who have notched exceptional achievements in 

 hunting. These range from claiming maximum bounties to dominating the 

 or crafting imaginative, engaging Dojo challenges. 

Embracing the cosmic expanse of cyberspace, we are thrilled to introduce our latest collection of achievements: the 

These are more than just acknowledgments – they are a testament to the skill, persistence and ingenuity of our highest-performing hunters. With a celestial theme, these achievements are designed to express our gratitude to our community of hunters – and hopefully inspire them to even greater heights!

When and how are the hacker achievements awarded?

These coveted achievements are awarded quarterly. 

Every three months, we assess the performance and contributions of our hunters. Those who meet the criteria for any of the achievements will receive a special email from YesWeHack. 

Along with this recognition, you'll receive a physical poster celebrating your achievement – and serving as a tangible reminder of your hacking prowess!

: each physical poster is sent only once per researcher. So if you win, say, the 'Black Hole' achievement in the first quarter and then again in the third, you will receive the 'Black Hole' poster only for the first of these achievements. 

🌑 BLACK HOLE: The event horizon of criticality

 Attain the maximum reward in any YesWeHack program to claim this prestigious accolade (

this does not apply to reports produced through collaboration

 Top the leaderboard – ranking #1 – for at least three consecutive months.

 Demonstrate unwavering consistency by submitting valid reports every month for a full year (

 Prove your expertise on a specific program with at least 10 valid reports on the same program.

 Sit among the leaderboard’s top 5 for at least six months.

🪐 CELESTIAL PLANNER: Serious staying power

 Stay among the top 5 hunters for a six-month stretch or longer.

🚀 GALAXY VOYAGER: Achieving persistence all-year round

 Demonstrate long-term dominance by staying in the top 5 for at least an entire year.

🤝 COSMIC BLACKSMITH: The community contributor

' achievement is reserved for those who enrich the YesWeHack community, be it through blog contributions or crafting imaginative and engaging 

This is more than just a challenge; it's a journey towards becoming a legend in the cybersecurity space. These milestones can signpost your progress through the vast and growing Bug Bounty universe. 

Each poster is not only a reward, but a symbol of your skill, dedication and contributions to securing the digital cosmos.

So: are you ready to join this select group of world-class hunters, to pwn systems with flair and claim your rewards? Set your sights on these celestial targets and 

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

Ethical hacking can be lucrative but there is no guarantee of income.

As such, inexperienced Bug Bounty hunters must above all practice patience and persistence if they are to reap the potentially significant rewards, according to the subject of our latest hunter Q&A.

‘Xel’ – real name Raphaël Arrouas – is well placed to judge: he’s fourth on YesWeHack’s 

 at the time of writing and boasts an ‘impact score’ (average points per report) surpassed by few others.

But, reassuringly for struggling newbies, even Xel admits full-time bug hunting “was not easy” when he started four years ago.

In the second writeup in this series (other videos are 

), the ethical hacker reflects on the challenges of finding the right work-life balance as a freelance white hat, enthuses about his most impressive bug finds, and offers advice to his fellow hunters.

I’m a cybersecurity engineer and following my studies I worked as a penetration tester. During my time as a pentester, I [became] interested in Bug Bounty Programs and I tested myself. I tested participating in one, in two, in three Bug Bounty Programs.

And eventually I thought: “Wow, this is a great opportunity that I should not miss!” So I quit my job to do Bug Bounty hunting full-time.

I joined YesWeHack’s platform with a very interesting program at the time, Swiss Post. It was very interesting for me because I live in Switzerland, so I invested some time into the program, and then into the platform, and got to meet the team. So yeah, I’ve been a regular of this platform!

ON WHAT IMPRESSES HIM MOST ABOUT YESWEHACK…

It’s always hard to say, but I would say the team. Really, it’s a top-notch team!

They are very friendly and reachable people. What I like is they spend a lot of time explaining their philosophy to their customers, and so it makes the whole process very agreeable.

I like their programs a lot. I think they have expanded their customer base in every continent these last years, so I think it’s more and more interesting to hunt on YesWeHack.

ON THE CHALLENGES OF BEING A FULL-TIME BUG HUNTER…

At first, being a full-time bounty hunter was not easy because, well, I needed to get results and there are no guidelines about how to do that.

So I had to develop my strategy, I had to develop my contact with the platforms, I had to see how it would fit into my schedule, my social life, and then my family life. So it had many challenges, but I would say that these challenges are kind of the same as the ones that entrepreneurs have.

ON THE THREE WORDS THAT BEST DESCRIBE HIS TALENTS AS A HACKER…

I would say curious, persistent and focused.

ON THE MOST CRITICAL BUGS HE HAS FOUND SO FAR…

I think the most critical vulnerability I’ve ever found was an unauthenticated RCE on a firewall orchestrator. I think I would have been able to take control of maybe 50 firewalls or something – I could have caused a lot of damage!

I have [another] vulnerability I was proud of: it was an RCE in an e-banking [application]. I was kind of limited in terms of length, and I had to do a server-side template injection in less than 100 characters or something. It kind of looked like a CTF challenge to me, so I was very proud of this one!

HIS ADVICE ON HOW TO BECOME A SUCCESSFUL BUG BOUNTY HUNTER…

You need to stay creative, you need to see what exists and you need to come with your own approach. You need to familiarise yourself with all the basic security concepts.

You need to start doing it really – to start hunting, even when you think hunting on public programs is hard and so on.

You really need to start doing it and invest some time in it – and don’t give up! After some time, you will get more and more vulnerabilities coming in and you will get better at Bug Bounty hunting.

It’s a job where you need to invest some time in it to be proficient, I would say.

, or learn about the latest hacking tools and hacking techniques 

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

YesWeHack is delighted to unveil a new-and-improved User Experience (UX) that better aligns with users’ workflows and the platform’s fast-evolving capabilities.

Launched today, the redesign reconfigures the layout and gives important elements greater salience in ways that will help customers and hunters track metrics and take actions more efficiently.

The revamp has, for instance, removed friction from sorting, filtering, tracking and commenting on findings or vulnerabilities. For hunters, meanwhile, there’s a 

 facelift, while it’s now easier to find 

The more intuitive and attractive interface builds on design changes introduced with the launch last year of YesWeHack’s 

 (ASM) product. The latest overhaul further simplifies the handling of assets, findings and reports, however numerous.

Vulnerability reports more aligned with workflows

Making it easier to view and take actions, changes to the vulnerability report page (see image below) should produce a more seamless remediation process.

Crucially, BUG DESCRIPTION, COMMENTS and ACTIONS tabs are now always visible near the top of the page; previously users may have had to click or scroll down the page to reach them. Moreover, some dropdowns have been replaced with tabs for even quicker access.

Report details like scope, affected endpoints and patch status have been moved to a more logical position beneath the CVSS and asset value metrics on the right-hand side. By clicking on a new ‘workflow’ link, users can see a visualisation of the workflow for processing vulnerability reports.

The filtering menu on the VULNERABILITY CENTER and ATTACK SURFACE modules is much more compact – elevating the list of findings and reducing the need for scrolling. Notice also how the headline metrics are more conspicuous thanks to a simple dash of colour.

The revamped programs list makes choosing your next hacking engagement a quicker, more informed process with a multi-column layout, enhanced colour coordination and addition of useful program details (namely: country, sector, number of reports and 1st response).

As for the program page itself, a new HTML anchor menu means hunters can save time by navigating with a single click to the most relevant sections.

RANKINGS refresh adds Olympic-style podium

An eye-catching new podium design gives due prominence to the achievements of the top three performing Bug Bounty hunters (whether of all-time, during the current month/quarter/year or of previous quarters/years).

Gilles Yonnet, CTO at YesWeHack, says: “Our design refresh enhances the user experience, whether you’re a hunter or Bug Bounty Program manager, and whether you oversee just a Bug Bounty Program or combine it with ASM, 

 and a Vulnerability Disclosure Policy (VDP).

“The revamp should facilitate the vulnerability remediation process to the benefit of hunters and organisations alike, and enhance the platform’s utility as a 360-degree cockpit combining unified vulnerability management with continuous threat exposure management.”

A raft of new features will be launched throughout 2024.

 that gives hunters more granularity in finding suitable hunting opportunities. Search filters will include scope types, reward grids, program type, collaboration allowed/not allowed, supported languages, countries and activity areas (sectors).

 feature, this functionality is being introduced in response to hunter demand.

YesWeHack unveils workflow-friendly revamp of user interface

 Program (BBP) has diversified the vulnerabilities unearthed in the financial institution’s systems and strengthened the skills of its offensive security team.

That’s according to Lucas Zuluaga Pérez, part of Bancolombia’s red team and manager of the banking group’s BBP at YesWeHack.

Founded in 1875, Bancolombia Group comprises banks in Colombia, Panama, Guatemala and El Salvador, supported by more than 30,000 employees and 80,000 suppliers. It also operates in the US and the Bahamas.

Translated from Spanish, the following interview sees Lucas discuss the group’s approach to expanding the BBP, the security and red team benefits of Bug Bounty, success factors in crowdsourced security, and the reasons for choosing YesWeHack.

LUCAS ZULUAGA PÉREZ ON THE LAUNCH AND EVOLUTION OF BANCOLOMBIA’S BBP…

Security is of the utmost importance to Bancolombia, as we ensure the protection of more than 16 million customers.

Bancolombia’s Bug Bounty Program started around October 2021. We started with a private program in which five of the best hackers in YesWeHack participated. We had a great evolution and within a year we managed to considerably expand the scope of our sites, going from two sites to 30 sites, from five hackers to 50.

Key factors such as the support of senior management, that our leaders consider cybersecurity as a key element, are very important.

Secondly, having the engagement of the technology teams, which positively welcome reports of some of the vulnerabilities we identify in the environment.

And thirdly, the involvement of the red team, to raise the bar every day with the support of the triage team and hunters of YesWeHack.

ON THE RED TEAMING AND SECURITY BENEFITS OF BUG BOUNTY…

With our Bug Bounty Program, the red team’s skills have increased considerably. We have vulnerabilities in our checklist that we would not have considered before.

We have achieved great maturity and a great process, which allows us to quickly address vulnerabilities that may at some point affect the confidentiality, integrity or availability of information.

ON CHOOSING YESWEHACK OVER RIVAL PLATFORMS…

When we conducted the request for proposal for the Bug Bounty Program, we saw in YesWeHack some differentiators, such as their experience in Europe and Asia, the number of hunters registered on their platform, and the level of vulnerabilities reported, which could fit perfectly into our ecosystem.

In addition, other elements, such as the documentation we found on their portal and the closeness with the triage team, enabled us to establish a good alliance and a good team.

This allowed Bancolombia to engage in business relations with YesWeHack.

ON THE MOMENT THE PROGRAM’S PERFORMANCE ELICITED SURPRISE AT EXECUTIVE LEVEL…

In one of the meetings, one of our bosses asked for the current status of the Bug Bounty Program. When he publicly stated that we had about 50 hackers, we said: “No, boss – not 50, 250 of them!”

The look on his face said it all: “What do you mean, 250? How much have we grown in the past year?”

The truth is that it was a very relevant fact that shows the maturity that we have been able to achieve with the Bug Bounty Program.

ADVICE TO OTHER ORGANISATIONS LAUNCHING A BUG BOUNTY PROGRAM…

Start small, and as vulnerabilities are identified and the security posture of your organisation is evaluated, you can increase the number of sites, the number of hunters and – why not? – have attractive rewards and bounties, so that the hunters, the researchers, are always incentivised to participate in your program.

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

In this article we’ll summarise how various active and passive scanning tools can automate and streamline your Burp Suite workflow – saving you time in the process.

📁 Goals for Burp automation
📂 Burp extensions and built-in tools used
├─ Extensions
├─ Built-in tools
📁 Automated workflow
📂 Active scans
├─ BCheck
├─ Burp Bounty
📂 Passive scans
├─ Passive scanner
├─ Passive live crawler
├─ Error Message Check and Response Grepper
├─ BCheck
📁 Logger++
📁 Manual testing still matters

 automation is to save time and automate less complex tasks that are needed to improve manual testing. The automation should cover the very core of our target application and collect as much information as possible. The primary method is using passive scanners to avoid making too much noise as an attacker.

All the information we collect helps us to better understand the application and thereby improve our active automation in the long term.

The automated workflow is divided into two fields: the blue ones represent passive scans while the red ones represent active scans.

The passive scanners will benefit from analysing the outcomes of the active scanners. For example, an active scanner that has triggered a behavior in the target application that leaks an error message in the application's response. The passive scanner will analyse and report the discovered error message to Burp's dashboard, allowing the scanners to work efficiently together and keep our results organised in Burp's dashboard.

As shown in the workflow image above, we will handle the distribution of responses in the following way: responses captured by the proxy will be given to both the passive and active scanner, while responses intercepted by the repeater, extensions and scanners will only be given to the passive scanner.

This structure is built to keep an efficient flow and synchronise all ongoing scans. The passive scanner can dig deep into the responses produced by the active scanners. and the active scanners will keep a low request volume to our target. Since the active scanners have a low request volume to our target, the passive scanner using our hardware's performance will be able to handle the responses without stacking up a massive queue of tasks.

We will have all our ongoing live tasks on 

The active scans will contain our automated attack process. The primary goal of this automation is not to fully exploit the application with these attacks. Instead, it is to discover and trigger as much back-end functionality as possible, by performing 

BCheck is a fairly new feature in Burp, at the time of writing this article. The main reason to use it for our purposes is that it allows us to write BCheck scripts directly in Burp itself. This is useful because it allows us to quickly 

 to perform attack techniques adapted to our collected scan results.

The second reason is that, rather than running complex scans, we can conduct scans like fuzzing a list of files and directories on newly discovered hosts or preform friendly payload spraying to detect possible behaviors within our targets.

It's good practice to keep track of the requests made for each BCheck that performs an active scan. We can do this by adding a custom header - eg: 

X-BCheck-Track: bcheck={BCHECK_NAME}, tag={TAG}

. With this header, we can more easily track and organise all BCheck requests that appear in Logger++.

The Burp Bounty extension is an excellent choice when it comes to slightly more complex scans, with the main advantage of offering great customisation. We can both provide and tamper with the payload used during the scanning process. Burp Bounty also gives us the ability to select detection rules, which allows us to leverage our experience of how different payloads may affect the application we are pentesting.

The passive scans play an important role as a second layer of detection. They can take advantage of the performance of our own hardware to search for errors or patterns and/or compare behaviors already performed by the active scans. This way, we can do more in-depth analysis of the responses from the target, which can lead to discoveries that the active scanner missed.

Burp's built-in passive scanner is great because it covers a wide range of detection techniques. These techniques include detecting services, version banners, misconfiguration and a whole lot more.

We will use Burp's built-in passive scanner to collect as much information as possible from our target.

However, in some cases the JavaScript analyzer used in the passive scanner can draw a lot of hardware performance. If you encounter such issues, read Burp's official documentation for configuration advice on mitigating this problem.

The passive crawler helps us build up a base of the sitemap for our target. We can analyse the discovered routes that are passively added, and get an idea of how the application is structured and what functionalities might be available for us to test.

Error and pattern discovery is one of the most important parts of automation. By looking for errors and patterns within your target, you can extract a lot of useful information. This information can be used both to understand your target and to adapt your active scanners in the future, as it can catch trace errors and other differences in responses that the active scanner itself may have missed.

In the passive scanning process, BChecks will be used to discover the technologies and service that the target application is running. By finding out the technology and/or service of the application, we can filter out data and payloads. By extracting information that allows us to see that our target application mainly uses PHP as its programming language, for example, we can ignore/reduce the amount of payloads related to Java, Ruby, Python and other languages. This allows our automation to maintain its flow and avoid building up a large queue of unnecessary processes.

), adding a tracking header to each BCheck that defines a primary tag and the name of the BCheck used is an effective way to keep track of your requests (

The Logger++ extension is a powerful extension that allows us to log every request and response from all sources in Burp. It offers advanced filtering and highlighting rules that we will use to monitor and analyse all our traffic. We will also use Logger++ to troubleshoot our automation process if something goes wrong.

As the image above shows, we can highlight requests from various tools and requests containing the custom header that we use to track processes such as BCheck scans.

Automation is generally useful, but you should always try to keep the automated workflow aligned with your manual testing. 

Automation will always miss things, so don't rely on it entirely. Rather, combine with manual testing and examine the results of both. This way you can focus more on the creativity of hacking and spend less time looking for new features in the application.

Smart Automation With Burp Suite

Rapid automation will define the evolution of Bug Bounty hunting in the coming years.

That’s according to GoDiego, a full-time hunter from Spain. At the time of writing, the 22-year-old sits 19th on YesWeHack’s 

 (real name: Diego Bernal Adelantado) is the inaugural interviewee in a series of Bug Bounty hunter Q&As we’re publishing on our blog, in text and video form (some videos are already 

). The Q&As, which ask YesWeHack hunters about their backstory, finest discoveries so far and advice for newbies, should at once be inspirational and educational for their peers.

GODIEGO ON GETTING INTO HACKING AND BUG BOUNTY…

I’ve been hacking for like four years now, I think, more or less. It’s been a wild ride!

My story is a bit random because I first started when I was like 15. I was bored in my room, and I said: “Oh, I don’t know anything about computers – let’s teach myself how to code.”

Then a couple of years later I found out about 

. I didn’t know what it was at the time, so I didn’t pay much attention, so I just kept learning stuff.

And then I just got drawn into it, and started doing Bug Bounty – and here I am!

THE THREE WORDS THAT BEST DESCRIBE HIS DEFINING QUALITIES AS A HACKER…

I would say: persistent, creative and curious.

ON HIS MOST CREATIVE VULNERABILITY DISCOVERY SO FAR…

I would say that my most creative and special bug was my first one, because I was testing one of the major news companies. They have a ‘limited’ program. So I was testing it. At this point I was a noob: I didn’t know what I was doing.

There was this feature for careers applications. I tried a couple of payloads – nothing worked. Then, one day, I noticed that they had this “submit a Word document” feature so I tried that, and nothing happened. I put some 

 payloads inside, then saved Word again – it didn’t work.

But they had this button: “Extract data and fill in application from Word”. So I took that then got the pingback.

At first I couldn’t believe it. And then it turned out, yeah – it was accepted!

From my point of view, the thing that makes YesWeHack different is that the triagers are very fast. I sometimes put in a bug and then a couple of minutes later it’s on triage. That’s quite nice!

Also, there are some very good programs, and I’ve had very good interactions with them.

HIS PREDICTIONS FOR THE EVOLUTION OF BUG BOUNTY…

The Bug Bounty world is moving into an automated era, where most people are just relying on 

. So in the future, from my point of view, everything will be based on post-authentication bugs, rather than just finding, I don’t know, an exposed Git repo or something like that.

The level of automation that is going on right now is crazy.

HIS ADVICE FOR ETHICAL HACKING BEGINNERS…

I would say: experiment. Most of the times I found a bug while trying random theories, or saying: “well, what would happen if I tried this or tried that?”

Just don’t rely on other people’s tools; be creative and do your own thing. Because in the end that’s what’s gonna make you stand out and be different!

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

Cybersecurity is a more pressing priority than ever for US-listed companies and foreign private issuers in the wake of new rules and a landmark enforcement action from the US Securities and Exchange Commission (SEC).

The new SEC cyber rules, in force since 15 December, introduced mandatory reporting of “material” cybersecurity incidents and new annual disclosure obligations around cybersecurity risk management, strategy and governance.

A month earlier the SEC stunned the cybersecurity industry when it 

charged SolarWinds and its Chief Information Security Officer (CISO)

 with fraud and internal control failures related to a catastrophic cyber-attack in 2020 – an unprecedented move for the agency.

Even cybercriminals have noticed the SEC’s increasingly muscular approach to cybersecurity. In November, the BlackCat ransomware gang 

 to the agency for failing to disclose BlackCat’s breach of the digital lending platform.

Added to increasingly numerous and sophisticated cyber-attacks, the SEC’s latest manoeuvres are certainly focusing minds in the boardroom (and not necessarily just for public companies).

With digital transformation ongoing and code vulnerabilities a 

unified, multi-layered offensive security strategy

 is invaluable in reassuring both regulators and stakeholders about your security posture. To this end, for instance, 

YesWeHack’s all-in-one vulnerability management platform

 consolidates auto-scanning, Bug Bounty, pentest management, a vulnerability disclosure mechanism and attack surface management.

Public companies must now disclose in their annual filings “any cybersecurity incident they determine to be material” within four days of deeming it material, 

 when the new SEC cybersecurity rules were adopted in July 2023. Their disclosure must “describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant.”

The SEC cybersecurity rules 2023 also require a description of “their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.”

The YesWeHack Blog

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

YesWeHack hunter achievements: Unveiling the Galactic Guardians series

‘Proficiency takes time’: Xel on his best Bug Bounty finds and the primacy of patience in ethical hacking

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

YesWeHack unveils workflow-friendly revamp of user interface

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

Smart Automation With Burp Suite

YesWeHack unveils workflow-friendly revamp of user interface

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

US SEC cyber rules, SolarWinds CISO charges: How a unified OffSec strategy can enhance your SEC disclosures

Unveiling DOJO v2: Our new CTF and realistic challenge-building framework

‘The level of automation right now is crazy’: GoDiego on why post-auth vulnerabilities are the future of Bug Bounty

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us