Bug bounty platforms: global market study

Contents

• Summary
• Introduction
• Bug bounty programs and platforms
  • Challenges of implementing bug bounty programs
  • Bug bounty platforms
  • Services and prices
  • How to score vulnerabilities and what influences the reward size
  • Bug bounty platform statistics
• Prospects and problems of the bug bounty market
• Conclusions
• Research methodology

Summary

• A bug bounty program engages multiple freelance cybersecurity researchers to find vulnerabilities in software, web applications, and IT infrastructure.
• Bug bounty programs are result-oriented, meaning that rewards are paid only for vulnerabilities found and not for the time spent on looking for them.
• The ingredients of a successful bug bounty program are: appropriate infrastructure, competent people, relevant expertise, company's public image, the ability to pick the right IT assets to be tested, and a clearly defined program scope.
• Special bug bounty platforms help to conduct bug bounty programs. They organize the process of vulnerability hunting, provide the required infrastructure, and give support and expert advice. But most importantly, such platforms engage the community of cybersecurity researchers to perform a security assessment of the system in question.
• Public programs offered by bug bounty platforms are accessible to all community members regardless of their competence level, while private programs are intended only for researchers invited by the customer. Most platforms (88%) run both public and private programs, while 8% offer only private programs; the remaining 4% offer only public programs.
• The following sectors show the highest demand for bug bounty platforms: IT (16%), online services (14%), services (13%), trade (11%), finance (9%), and blockchain projects (9%).
• The reward size depends on the severity level of vulnerabilities discovered. On average, customers pay $7,200 for a critical vulnerability, $3,000 for a high-severity vulnerability, $1,100 for a medium-severity vulnerability, and $254 for a low-severity vulnerability.
• The highest average bug bounty rewards for critical and high-severity vulnerabilities are paid by blockchain projects ($13,000 and $5,300, respectively) and IT companies ($6,600 and $2,200, respectively). In third place are medical institutions, offering $5,500 for a critical vulnerability and $1,600 for a high-severity vulnerability.
• The total price for platform services includes several components. First, platforms charge an initial placement fee, which is calculated individually for each customer. Second, they charge a subscription fee, which covers utilization of the platform infrastructure, interaction with researchers, and vulnerability verification. An annual subscription to bug bounty platform services is $16,000 on average. Third, platforms charge a commission fee, which depends on the subscription plan or vulnerability severity. On average, it is calculated as 20% of each payment to a researcher and is not deducted from the researcher's reward.

Introduction

Bug bounty programs and platforms

Challenges of implementing bug bounty programs

1. All reports submitted by researchers have to be screened to filter out duplicates and incorrect reports, determine the severity levels of vulnerabilities, and discard vulnerability reports with extremely low severity levels. In addition, effective collaboration with researchers, continuous feedback, and verification of detected vulnerabilities must be established. All these actions require extra resources.
2. To ensure transparency and assess efficiency of a bug bounty program, it is vital to define key performance indicators, monitor them, and create detailed reports. Organizations that lack experience in conducting such programs might face difficulties if they attempt to manage such tasks on their own.
3. To get the most out of a bug bounty program, it is essential to define the program scope and the relevant IT assets very clearly and well in advance. This might prove to be a nontrivial task for some organizations.
4. The organization's public image plays an important role. Some bug bounty programs do not resonate with the researcher community, especially those announced by little-known organizations, because researchers have to consider the risks involved. First of all, they want to know whether it is worth their time to search for vulnerabilities in the organization's IT systems, whether the rewards will be paid fairly and on time, and whether the bug bounty program is managed in a professional way.

Bug bounty platforms

• Community of cybersecurity researchers. Community is the most valuable resource of any platform: the more community members with advanced skillsets, the higher the effectiveness of bug bounty programs. Platforms work hard on developing and supporting their communities, as it can take years to build them. An average IT security assessment firm can assign five to fifteen employees to test a customer's application. Meanwhile, that application could be tested by hundreds or even thousands of experts and researchers from all over the world who are registered on a bug bounty platform. They can actively test your applications for months or even years, while the duration of a traditional security assessment is limited to about one month. This increases the chances of detecting vulnerabilities and ensures continuous application security analysis.
• A highly skilled cybersecurity team that reviews reports from researchers and verifies vulnerabilities. The platform team is also involved in customer support and interacts with researchers.

Services and prices

If all three criteria (existence, uniqueness, compliance) are met, the report is accepted. The researcher gets a reward and rating points, and the organization receives a detailed vulnerability report.

• Initial placement fee. For this fee, the platform helps the organization to define the program scope, the non-tolerable events, the pricing policy, and the vulnerability report template. The initial placement fee is calculated individually depending on multiple factors, including the organization's line of business, its size, and capitalization.
• Subscription to platform services. The subscription fee includes community activation, use of the platform infrastructure to get reports from researchers and generate analytical reports on the ongoing program, reviews of reports submitted by researchers, vulnerability verification (triage), and interaction with researchers.
• Platform's commission on payouts. The size of the commission depends on the subscription plan (the more expensive the subscription, the lower the commission) or on the vulnerability severity level (the higher the severity, the higher the commission).

• Direct payouts. Customers can pay a one-time reward for each vulnerability to researchers through the platform. This model is better suited for short-term programs. However, customers themselves have to handle financial matters with researchers, which can be challenging.
• Payouts from a dedicated program fund reserved by the customer in advance. This model is better suited for long-term bug bounty programs. It allows organizations to avoid direct interaction with researchers on financial matters and gives platforms more autonomy.

How to score vulnerabilities and what influences the reward size

Researchers may receive additional rewards if they assist organizations in fixing identified vulnerabilities as soon as possible. This approach is used on Huntr.
Rewards for medium- and low-severity vulnerabilities are quite small, as opposed to critical and high-severity vulnerabilities that pose the most serious threats, such as confidential information leaks, unauthorized access to applications, and attacks on local resources. Businesses understand the implications of such vulnerabilities and are willing to pay significantly more for high-severity and critical vulnerabilities. For example, the increasing number of attacks on blockchain projects in recent months has forced developers to be more vigilant in detecting vulnerabilities in their products and announce enticing rewards reaching $13,100 for a critical vulnerability and $5,300 for a high-severity vulnerability. Some especially dangerous vulnerabilities can be priced at $100,000 and higher. Solutions marketed by tech companies must also be immune to attacks. For example, Sony and Intel offer $50,000 and $100,000, respectively, for critical vulnerabilities.
This approach benefits all parties involved. The customer receives a detailed report on exploitation of a range of vulnerabilities that led to a real attack and triggered a non-tolerable event. As a result, the customer can quickly fix the vulnerabilities and form a realistic understanding of the attack scenarios and their consequences. The researcher gets a significantly bigger reward and a higher ranking, while the platform can check a coherent chain of vulnerabilities instead of disparate reports.

Bug bounty platform statistics

The large number of participants is one of the main advantages of the crowdsourcing approach to cybersecurity. However, not all researchers are sufficiently qualified or specialized in the required area (for example, web applications or blockchain), and some organizations are not ready to handle a large number of vulnerability reports at once. That is why platforms offer two types of programs: public and private.
Public programs allow for more coverage, broader categories, and more vulnerabilities being discovered due to the diverse skills and expertise of researchers. But one should keep in mind that the qualification levels of participants can vary greatly, which is not always conducive to finding critical and high-severity vulnerabilities. Private programs allow organizations to handpick professionals who meet their requirements, or invite the most advanced researchers to increase the chances of discovering serious vulnerabilities. Platforms like Synack and Cobalt run only private programs with thoroughly vetted community members.
Businesses are embracing these opportunities to enhance their cybersecurity and integrating bug bounty programs into their processes. The most frequent customers (16%) of such platforms are IT companies that are constantly working on improving their applications. One in ten applications on bug bounty platforms comes from customers in finance or trade. According to a HackerOne report, in 2021 the number of customers from these sectors grew by 62% and 51%, respectively. The recent hacks ([1] and [2]) of cryptocurrency platforms (9%) highlighted the need for bug bounty programs to find vulnerabilities in crypto protocols and smart contracts.

Prospects and problems of the bug bounty market

• Global Internet penetration
• Growing awareness of the need to ensure cybersecurity
• Attractive rewards for vulnerabilities discovered by researchers
• Widespread use of online services in organizations due to the fact that employees are increasingly using mobile devices and other Internet-connected devices at work
• High demand for cybersecurity tools among organizations
• Technological advances and trends, such as IoT, IIoT, cloud computing, artificial intelligence, machine learning, and Industry 4.0

• Lack of market expansion in less developed countries
• Difficulties in detecting vulnerabilities without buying additional specialized software
• Fierce competition in the industry
• Cybersecurity measures in web application development making it more challenging to find vulnerabilities

Conclusions

Research methodology