Busting Bug Bounty misconceptions

Organisations often overlook the agility of the crowdsourced security testing model.

Several misconceptions persist widely about the challenges involved in launching and managing Bug Bounty Programs and the kind of organisations they can benefit.

Confusion arises from both outright myths – such as ethical hackers being any less trustworthy than other external contractors – and problems that can arise, but from misconfigured programs rather than weaknesses intrinsic to the model itself.

Bug Bounty Programs are an alternative (or supplementary) means of finding vulnerabilities to penetration testing, whose limitations are increasingly exposed by growing attack surfaces and the modern threat landscape.

Whereas pentests are time-limited engagements undertaken by a small team whose skills may not match your technology stack, Bug Bounty Programs invite appropriately skilled bug hunters from among tens of thousands of ethical hackers (or they can be open to the entire community) to probe assets continuously (or for as long/as often as required).

At the root of common Bug Bounty misapprehensions lies a failure to appreciate the model’s adaptability to myriad use cases, enabled by a platform-driven approach.

Bug Bounty Programs can be configured to meet the needs and resources of startups and smaller businesses – not just those of blue chips or Big Tech.

However modest your goals, budget and capabilities, a reputable Bug Bounty platform should help you continuously calibrate the assets to be tested (the ‘scopes’), rules of engagement (like authorised tests or vulnerabilities), bounty ranges and invited hunters to ensure an affordable, manageable flow of vulnerabilities to remediate.

In fact, Bug Bounty’s pay-per-vulnerability model particularly suits smaller firms: “The opportunity to pay based on results is very important for a small organisation like ours with limited budgets,” said the CTO of a trust service provider that runs a program via YesWeHack.

By contrast, pentesting firms usually charge a pre-agreed price for a time-limited engagement – regardless of the volume and relevance of vulnerabilities surfaced.

From six-figure Google rewards to multimillion crypto payouts, infosec media coverage arguably skews perceptions of typical bug hunter earnings.

In reality, five- or six-figure payouts are the exception and often involve the ‘GAFAM’ tech giants, very ‘hardened’ assets (meaning most ‘low-hanging fruits’ have already been found) and/or critical-risk assets. In most contexts, typical payouts are much lower – the YesWeHack average is €440 ($476) per vulnerability, for instance.

Your platform should continuously help you optimise your rewards grid (along with parameters like scopes and qualifying bugs) to ensure a manageable flow of vulnerabilities that suit your security goals and keep you within budget over time.

No wonder a deputy CISO at a global luxury brand and YesWeHack client insists: “Unlike what US providers will tell you, it is possible to begin a Bug Bounty Program on a small budget.”

It’s true that most organisations don’t have time to run a Bug Bounty Program – if that means running it by themselves.

But a program managed on your behalf by a platform is “close to that of managing a classic pentest” in terms of demands on internal resources, according to a cybersecurity expert working for a major European financial institution and YesWeHack client. It’s also “a lot simpler to launch and monitor than a pentest”, they add.

Sign up to a fully managed Bug Bounty Program and you can mostly focus on fixing targeted findings while the provider manages the program and handles triage – filtering out duplicates and false positives, retesting the vulnerability, qualifying the severity level (with your input) and communicating with hunters.

Using the same word – ‘hacker’ – to describe both those who maliciously exploit security holes and those who help find and patch them has historically fuelled unfair negative connotations about good-faith hacking.

However, the fact that ‘ethical’ or ‘white hat’ hackers are devoted to thwarting the bad guys is not your only source of reassurance when it comes to inviting legitimate investigations of your attack surface.

On YesWeHack, for instance, new bug hunters are thoroughly vetted using their ID, address and banking information.

They must also sign terms of service, including non-disclosure agreements (NDAs) and a promise to abide by program rules – with hunters held responsible for any violations.

For extra reassurance, YesWeHack clients can track hunters’ activities using a VPN or User-Agent.

Additionally, clients award points to hunters that unlock invitations to more lucrative programs, based on the quality of their exploits, reports and communication – a strong incentive for providing an exceptional service.

Tracking and following up bug reports is actually quicker and simpler via Bug Bounty Programs than traditional pentests.

YesWeHack provides collaboration and integration features that automate time-consuming tasks and feed vulnerability report data directly into your internal workflows, tools and processes.

Our DevSecOps-friendly platform makes workflows much more efficient. It’s easy to assign tasks, track reports and interact with bug hunters in real time, and (unlike a typical pentest) there’s no need for irksome copy/pasting from/to spreadsheets.

“Before, we used to receive a PDF report with a list of vulnerabilities to fix. Now, we receive reports progressively, which makes the workload much easier for our teams to absorb,” said the CTO of a YesWeHack client and cyber risk management specialist.

It’s certainly true that IT teams can be swamped with vulnerability reports if the program rules are calibrated badly – if the scopes are too broad, the rewards too enticing, or the hackers too numerous or proficient in regards to the client’s capabilities and resources.

The lesson here, then, is not to eschew Bug Bounty altogether, but to choose a platform that will continually finetune these variables in line with your remediation capabilities and priorities – so you receive significant findings at a pace that your IT team can handle.

“When we opened, we initially received many reports, then we gradually refined our program,” said Alain Tiemblo, Web Security Lead Engineer at YesWeHack client Blablacar. “After the first month, it became quieter, so we invited new hunters onto the program to introduce fresh eyes and other skills on specific aspects of our program.”

Inherently agile, the Bug Bounty model suits organisations with various security postures. So if your security culture is underdeveloped and your applications have not been hardened by penetration testing, then inviting only a few researchers, having a limited scope and offering modest bounties will keep your patching workload manageable.

Then, as your teams become more accustomed to handling incoming vulnerabilities and in-scope targets are hardened, you can loosen these constraints to further bolster your attack surface.

Developing software with a ‘V’ or ‘waterfall’ model doesn’t negate the benefits of Bug Bounty either – so long as your program is configured to run only during each testing or validation phase, in a pre-production environment.

So it’s clear: constraints around your budget, resources or security/development maturity should not prevent the successful execution of a Bug Bounty Program. Indeed, the model’s benefits are such that Bug Bounty is increasingly popular with a wide variety of organisations.

“An application without bugs does not exist and there are only two types of bugs: those that we know and can address, and those that are yet to be discovered,” said Yann Desevedavy, Bug Bounty Program Manager at Orange France.

“Bug Bounty is becoming a security standard and it is the [best] way to take your vulnerability research to scale. You need to start small – but you need to start now!”

Armed with the truth about Bug Bounty, it's time to level up your cybersecurity game. Connect with our expert team today and discover how bug bounty programs can fortify your digital defenses!