Overview
Direct Answer
A crowdsourced security initiative in which organisations offer monetary rewards to external researchers who identify and responsibly disclose software vulnerabilities before public exploitation. This model leverages distributed expertise to uncover defects that internal testing may overlook.
How It Works
Organisations publish vulnerability scope, submission guidelines, and reward tiers on dedicated platforms or websites. Security researchers probe applications, systems, or infrastructure within defined parameters, document findings with proof-of-concept evidence, and submit reports through controlled channels. The organisation validates each submission, assigns severity ratings, and disburses payment upon verification and remediation.
Why It Matters
The approach substantially reduces time-to-discovery for critical flaws while distributing security assessment costs across a global talent pool. Organisations gain access to specialised expertise at lower expense than maintaining equivalent internal security teams, whilst researchers earn income for specialist work.
Common Applications
Major software vendors, financial services platforms, cloud infrastructure providers, and consumer technology firms operate ongoing programmes. Technology companies including Microsoft, Google, and Apple maintain active initiatives; financial institutions and healthcare providers similarly utilise the model to protect sensitive systems.
Key Considerations
Programmes require clear scope definition and legal frameworks to prevent scope creep and litigation. Reward calibration and response timeliness directly influence researcher participation rates and data quality; poorly managed initiatives risk reputational damage or delayed vulnerability remediation.
More in Cybersecurity
NIST Cybersecurity Framework
Security GovernanceA set of voluntary guidelines for managing and reducing cybersecurity risk developed by the US National Institute of Standards.
Security Orchestration Automation and Response
Defensive SecurityTechnology that automates security operations by orchestrating tools and processes for incident response.
Intrusion Detection System
Defensive SecurityA system that monitors network traffic or system activities for malicious activity or policy violations.
Security by Design
Security GovernanceAn approach that integrates security considerations into every stage of the software development lifecycle.
Adversary Simulation
Offensive SecurityAdvanced red team exercises that replicate the tactics, techniques, and procedures of specific threat actors to evaluate an organisation's detection and response capabilities.
ISO 27001
Security GovernanceAn international standard for information security management systems specifying requirements for establishing and maintaining security.
Digital Forensics
Defensive SecurityThe process of collecting, preserving, and analysing electronic evidence for investigating security incidents.
Threat Hunting
Defensive SecurityThe proactive search for cyber threats within an organisation's environment that have evaded automated detection, using hypotheses, threat intelligence, and advanced analytics.