Don't Let Bug Bounty Kill Your Appsec Posture

on YouTube ↗40m

" summary

Company runs app platform with about 5,000 microservices, 20,000 endpoints and ~2,500 developers and builds an internal SQLi detection tool. Bug bounty program shifts researcher incentives so low hanging issues dominate. After announcing a 150% bounty increase for SQL injection and a focused month the program receives three valid SQLi submissions in one week after years of none. Conclusion: bug bounties find what researchers chase not what the org most needs.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 14:46Let me tell you a real life story
3. 19:21"Survivorship bias"
4. 22:17bringing the problem home

" related talks

• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.noEmil Vaagland · NDC Security 2025
• 50mTo bounty, or not to bounty? Security@ insights from 500 organizationsAlex Rice · OWASP AppSec California 2016
• 56mRunning a Bug Bounty Program @ SEEKJulian Berton · NDC Sydney 2017
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 35mSetting up a bug bounty program for your appSebastian Porst · droidCon Berlin 2019
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017