Beyond Quick Cash: Rethinking Bug Bounties for...
summary
Markets expand from $200M in 2020 to a projected $5.5B by 2027, hackers grow 63% in 2020, and average bounties rise from $2k to $3k, setting context for concrete changes: adopt impact-driven payouts that ignore raw CVSS, triage by combining findings to assess chainable vulnerabilities, and reward deep POCs. Examples include an AES JavaScript engine crash escalated to an RCE with a ~$90k base payout plus bonuses, an account takeover paid $25k base, and weaponized proofs using MITRE Caldera. Programs also offer a 15% coupon up to $2,500.
AI-written summary · about
chapters (8)
- 0:00Introduction and speakers
- 1:48Current state of bug bounties
- 5:22Problems in bug bounty programs
- 7:29Shifting focus for impactful bugs
- 13:02Strategies for bug hunters
- 19:19Meta's unique bug bounty approach
- 26:00Key takeaways and conclusion
- 27:45Q&A session
related talks
20mGetting to $10,000 – the variables at play in determining bounty awards
43mHard Knock Lessons On Bug Bounties
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
25mHacker-Powered Data: Why the Most Common Vulnerabilities Aren’t What You Think They Are
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions