Bug Bounty Payouts Up 73% Per Vulnerability: Bugcrowd

Bug bounty programs grew along with payouts, which averaged $781 per vulnerability this year, researchers report.

The past year was a big one for bug bounties, with more programs offering more money to more researchers. Bug bounty programs grew 40% year-over-year, the average payout per vulnerability rose 73% to reach $781, and the number of Bugcrowd researchers grew by 71%.
These new numbers come from Bugcrowds 2018 State of Bug Bounty, its fourth annual report on crowdsourced security. Analysts pulled data from more than 700 managed crowdsourced security programs from April 1, 2017 through March 31, 2018. Over the year they saw more than 37,000 submissions, 69% of which were valid - a 21% increase from the prior year.
Private programs saw a 33% increase year-over-year and made up 79% of all new programs launched. Only vetted, ID-verified, and trusted researchers are allowed to participate in private programs, whereas public initiatives are open to all researchers.
Where the Money Is
Financial gain is an incentive for black-hat and white-hat hackers alike. Bugcrowd founder and CTO Casey Ellis says growth in reward amounts was his key takeaway from this years report. Total payouts have increased 36% from last year; the number of researchers paid is up 13%.
Its a reflection of the fact that more of the critical vulnerabilities are being found by the Crowd, he says. It also reflects the fact that customers are starting to get into the rhythm that the more you incentivize bug hunters, the more you can reduce risk.
The increase in payout reflects the increase in seriousness of bugs found. Bugcrowd categorizes vulnerabilities according to severity and noticed 20% more critical (P1 and P2) vulnerabilities submitted over the year. Seven percent of these were P1, the more severe of the two. Three-quarters of all P1 vulnerability payouts were greater than $1,200, up from $926 last year.
The bulk of bug bounty payouts went toward website vulnerabilities, which ate up 81.2% of funds. Hardware vulnerabilities were a far second, with 6.7% of payouts, followed by API (5.8%), Android (3.1%), IoT (2.5%), and iOS (0.7%) vulnerabilities.
Ellis chiefly attributes the increase in severe vulnerability payouts to the skill of the bug hunting community, and their motivation to go after critical flaws. We have more talented hunters at this point, he notes. However, he adds, if more organizations had bug hunting programs, the team might be able to make estimates about the security of the software theyre researching.
Its positive to see more and larger payouts, but where does the funding come from?
We see some organizations where its a [reallocation] of existing budgets, where they were questioning the ROI of their original [vulnerability] assessment methods, says Ellis. Others started working with the Crowd and realized they were more vulnerable than they thought.
Building and Expanding
Most (57%) of all programs launched in the past year primarily included website vulnerabilities. Seventeen percent include API targets, 13.6% include Android, 8.9% include iOS, 1.4% include hardware, and less than one percent include IoT.
Tech companies are the strongest adopters of bug bounty programs, with computer hardware, software, and networking companies making up 40.6% of all new programs launched, followed by IT services (12.7%), ecommerce/retail (9.1%), financial services (8.7%), and telecom (5.1%).
Ellis says they continue to see a lot of growth in the tech vertical. They continue to be the strongest adopters of this model and those who ultimately tell the story of what it looks like to the rest of the market, he explains.
However, older industries like healthcare and retail have also expressed interest in bug bounty programs over the past year. While they dont have the same representation as tech-first firms, Ellis says their inclusion is significant. These older organizations are often the most in need of fresh adversarial input from someone whos helpful, he points out.
Looking toward the year ahead, Ellis says hed like to see greater representation of IoT bug hunting. Its a pretty broad area of tech thats growing very rapidly right now, Ellis says. What were seeing is those types of threats are becoming pretty critical.
While IoT bug hunting will require additional skillsets on the part of hunters, Ellis doesnt think the transition will be quite as difficult as perceived. The mental transition from Web to IoT hacking isnt as big of a leap as the physical change: for IoT, you have to obtain the devices. You have to get possession of what youre trying to test, he says.
On a broader level, he expects the severity of bugs disclosed will increase, and people with more advanced skillsets will go after more critical issues. The average payout will also likely increase, he says.
Logically there is a ceiling that the average will hit, but I dont think were anywhere near that ceiling yet, Ellis says.
Related Content:
CrowdStrike Launches $1 Million Security Breach Warranty
7 Variants (So Far) of Mirai
DOD Looks to the Cloud for Browser Security
Strutting Past the Equifax Breach: Lessons Learned

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for
more information

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Bug Bounty Payouts Up 73% Per Vulnerability: Bugcrowd