Bug Bounty is much more cost-effective than penetration testing

Customer Stories

For this instalment of our Customer Stories, we talked with Kevin Dubourg, Bug Bounty Program Manager at Yousign. Yousign provides electronic signature (eSignature) services and aims at protecting both its services and users.

Why did you decide to go for Bug Bounty?

There are a number of platforms out there, which – mostly US based. We asked for certain guarantees on the hunters invited to our programs, and it seemed to us that YesWeHack offered those guarantees and the confidence to launch a Bug Bounty program.

What value can Bug Bounty add compared to traditional cybersecurity solutions (e.g. penetration testing)?

Kevin Dubourg, Bug Bounty Program Manager, Yousign

Diversity in terms of perspectives and skills. Every hunter has his own approach, his way of doing the thing, a unique approach that makes a particular attack. This is different from penetration testing, and it provides a much stiffer challenge. With Bug Bounty, we kind of left behind the penetration testing world, in order to benefit from 10, 20 or 30 different views and really challenge our teams.

What is really interesting, is that not all hunters are necessarily “cybersecurity professionals”. The entire ecosystem is represented here, and we can pick up individuals based on their nationality, skill set, ranking on the platform, etc.

Yet Bug Bounty’s main value, is the continuity, recurrence and “annualization” of the tests: as soon as we release a new version, we integrate the existing program and get immediate feedback on the new version’s security level. We don’t need to wait a year for the next penetration testing to check on the security of our update. This approach is embedded within our project lifecycle.

Our scope evolves constantly, and bugs evolve at the same time. Security flaws turn up every day, not just once a year, and Bug Bounty enables us to detect and fix them in time. It helps us monitor our services on a practically constant basis, and that is very reassuring. It would also be impossible financially to do a penetration testing on each delivery, although we would really need to, etc.

And then there is ROI. Yousign carries out one penetration testing each year. And this is quite expensive, compared to a Bug Bounty program. It’s a bit crazy when you think about it: they cost more or less the same, but Bug Bounty covers an entire year, whereas an audit only lasts a week…

Is Bug Bounty the end of penetration testing? Or will it always remain complementary?

For Yousign, it will continue to be complementary. It could mean the end of the penetration testing in some industries, but not in ours: as a trusted third-party provider we are required to carry out regular audits. In a less stringent regulatory environment, I would probably consider using Bug Bounty only.

However, Bug Bounty is very important for our sales and marketing: it’s clearly a differentiator to large prospect accounts. We mention it systematically in our request for proposal submissions as it’s seen by the market as a quality hallmark.

What are the differences between the results of a penetration testing and Bug Bounty?

I’ve had the same reports from both, but there are clearly many more reports from Bug Bounty than from penetration testing. And after having carried out a penetration testing on a given scope, running Bug Bounty always brings additional vulnerabilities.

One of the problems with penetration testings is results mainly depend on the expertise of the penetration tester. Our last penetration testing showed up some relevant things, but when you compare its results with those of the Bug Bounty program we launched afterwards… there’s no comparison.

Have you seen any changes in your teams since you started using Bug Bounty?

Of course. To start with, I managed the programs on my own, then fairly soon afterwards I got the development teams involved so that they could directly reply to hunters, fix bugs, etc. Most reports concerned the applications team, so they had to face up reality and take things forward, if I can put it like that.

What’s more, we quickly saw that their interactions with the hunters affected their delivery and working methods: not only do they integrate security into their development work more effectively, they actually started to “think” differently, always keeping in mind security aspects. You could say that they are not only delivering for clients, but for the hunters too (laughs).

What’s next?

The next step is to use Bug Bounty even more. In addition to the current programs on our production and “staging” environments, we want to fully embed Bug bounty within our CI/CD workflow to add to our battery of functional and unit test. This should make us even more agile and bug bounty a key component of our CI/CD approach.

And later on, we might move to a public program.

If you want more informations about Bug Bounty & YesWeHack, drop us a line:

About YesWeHack :

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting more than 20,000 cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.