Are you subscribed to a Bug Bounty programme/service?  We are considering but wondering if benefits will exceed cost/extra noise.

664 viewscircle icon2 Comments
Sort by:
CISO in Softwarea month ago

Yes, it is really a best practice but you have a good scope, plan and desired goals.  Do not open broadly without constraints.

Group Director of Information Security in Banking2 months ago

Subscribing to a bug bounty program is a MUST for every organisation is any of the below is valid for you:
a. You have a customer facing application that undertakes e-commerce/financial transactions that account for over 10% of the revenue generation.
b. You do not have an in-house team of at least 3 FTE penetration testers.
c. Your applications are API intensive and your information security team members are NOT from the background of application development.
d. You have outsourced application development process and do not have absolute control over application development environment where new features are getting added within applications at frequent intervals.
Good bugbounty service providers reduce a lot of noise but you need an inhouse resource dedicated for its management.
ATB

Content you might like

Yes65%

No35%

Not concerned at all8%

Slightly concerned49%

Moderately concerned26%

Significantly concerned14%

It’s our top priority1%

View Results