Bug Bounty Programs are Growing Up Fast and Paying More

As more organizations crowdsource the vulnerability-hunting of their software, the process itself has become more formal, as well as more lucrative for researchers.

Recent news about Google and Microsoft substantially increasing their rewards for certain vulnerability disclosures and Intel launching a new bounty program signal the surging popularity of crowd-sourced bug hunting.
Google earlier this month announced that it had increased the maximum reward for remote code execution bugs to over $31,000 from $20,000 previously. Bugs involving unrestricted file system or database access now fetch $13,337, compared with the $10,000 Google used to pay for them. Google security program manager Josh Armour
described
the move as recognition of how much harder it has become for security researchers to find high-severity bugs.
Microsoft, meanwhile,
announced
that bug hunters who find flaws in its Exchange Online and Office 365 Admin Portal between March and May this year can earn up to $30,000, or double the usual reward for such finds.
Intel also has
launched
a program under which it will offer up to $30,000 for critical flaws in its hardware, $10,000 for similar flaws in its firmware, and $7,500 for software bugs.
The announcements come against the backdrop of the Zero Day Initiative’s
Pwn2Own
hacking contest last week in Vancouver, and reflect what several say is the growing and quickly evolving nature of bug bounty programs.
Here are some of the biggest shifts in these vulnerability programs:
Organizations Offering Bug Bounties Have Become More Diverse
Theres been a rapid growth in the adoption of bug bounty programs over the past year, says Jason Haddix, head of trust and security at Bugcrowd, one of the pioneers in the managed bug bounty program space.
Haddix says he has seen a big uptick both in the number of organizations launching bug bounties as well as the kind of organizations launching them.
Today, bug bounties are no longer just for the early adopter tech giants, Haddix says. They’re for organizations of any size and level of security maturity.
Over the last year, Bugcrowd has launched programs for financial companies, automakers, retail companies, and consumer electronics firms, among others. Today, the industry has accepted the value of bringing the crowdsourced testing model to custom web applications, IoT devices, and basically any other type of software, Haddix says.
The Number of Bug Hunters and Vulnerability Submissions is Going Through the Roof
Bug bounty programs have given security researchers of all skill levels and from around the world a legitimate way to monetize their bug discoveries. Not surprisingly, the programs have proved to be a magnet for the community.
HackerOne, which like Bugcrowd manages bug bounty programs for other organizations, has over 100,000 hackers registered with it. Over 4,700 of them have been rewarded for bugs reported, says Michiel Prins, co-founder of HackerOne.
The platform has helped some 750 organizations across multiple industries resolve a combined total of more than 40,000 bugs so far and paid out $15 million for it. Over 75% of the companies that sign up with HackerOne get a bug report in less than 24 hours.
Weve seen a marked increase in the number of researchers signing up for these programs,” adds Bugcrowds Haddix. The number of vulnerability researchers signed up with Bugcrowd has doubled in the past 12 months, and until relatively recently, a majority of them used to be based in India. Now researchers from the US nearly equal those from India.
During the last year, weve seen a surge in the number of submissions as well as in the number of payouts with a 287% increase in researcher payouts and a 66% increase in the size of the average payouts, Haddix says.
Payouts Get Bigger - But Harder to Get
As Microsoft and Googles announcements this week showed, organizations are willing to pay out bigger bounties for vulnerability disclosures than ever before. But getting them has become harder. The biggest rewards are reserved for bugs that are the hardest to find, the toughest to fix, or cause the most harm.
The harder a vulnerability is to mitigate, the more we pay is how Intel described payment under its new bug bounty program.
That trend is reflected at the Pwn2Own contest. In 2007, all it took was a single bug to win a category, says Dustin Childs, director of communications for Zero Day Initiative, the organizer of the Pwn2Own hacking competition. Today, complete exploit chains are required to fully win a category, he says. Teams need to put in hundreds of hours of preparation time to be successful during the contest.
The increased effort required to succeed is mirrored in the prize increases, as well. While a total of $10,000 and a laptop were awarded in 2007 at Pwn2Own, contest winners in 2016 received some $450,000 in cash and prizes over multiple categories during the contest. This year, organizers expect to pay out at least $1 million.
The contest has proven year after year to be the root of the research community. Bugs disclosed during the event inspire the broader community to seek out other similar vulnerabilities, Childs says.
Vulnerability Pricing Models Get a Lot More Formal
As bug bounties have become more formal, so have the methods used to price them. When advising organizations how much they should pay for a bug, HackerOne considers the severity of a flaw; the scarcity or not of similar bugs; the potential impact; and the maturity of the program itself, says Prins.
Typically, the goal in setting bug bounties is not to compete with the black market on payout levels, but to encourage researchers to disclose flaws they discover in a responsible manner. The better our ethical community is at finding vulnerabilities and our customers are at fixing them, the more scarce they become elsewhere, he says.
Bugcrowd even offers a so-called
Defensive Vulnerability Pricing Model
to help organizations determine how much a disclosed flaw is worth. The guide is based on information gathered from tens of thousands of vulnerability submissions and sets rates for bugs based on their criticality, Haddix says. It offers guidelines on how much money an organization might want to allocate for its bug bounty program and what reward ranges attract the best talent, he says. The majority of our programs are scoped in accordance with these guidelines, Haddix says.
Bug Bounties arent for Everyone
Bug bounty programs are an emerging way to discover vulnerabilities in software, says Peter Kaloroumakis, chief technology officer at threat hunting and detection firm BluVector.
Companies are extracting value out of these programs and updating their software to address newly discovered vulnerabilities. At the same time, such programs make most sense for enterprise that are developing software products and not enterprises that are just using them.
[Hear Acuity Solutions President Kris Lovejoy discuss the rise of cyber-hunting to better defend against breaches during her session at
Interop ITX
on Thursday, May 18, at the MGM Grand in Las Vegas. To learn more about other
Interop Security tracks
, or to
register
, visit the live links.]
An enterprise, which is using products, not creating them, is less likely to benefit from a bug bounty program, Kaloroumakis says. They should focus on applying standard controls, network security monitoring and consider traditional penetration tests by third parties, he says.
Related Content:
A Bug Bounty Reality Check
Profiles Of The Top 7 Bug Hunters From Around the Globe
The Bug Bounty Model: 21 Years & Counting
Portrait Of A Bug Bounty Hacker

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Bug Bounty Programs are Growing Up Fast and Paying More