There’s always vulnerabilities,” said Erik Täfvander, head of cybersecurity at ATG: those you know about, those you don’t know about, and those yet to be created.

When it comes to finding them, he told YesWeHack in the interview below, Swedish betting brand 

 to be more productive than pentesting in multiple ways.

In the video and writeup below, Erik also explains how ATG has optimised its approach to crowdsourced security testing, praises YesWeHack’s customer support and triage team, and assures his peers that they “have very little to lose” by road-testing their own program.

Erik Täfvander on ATG's mission and why security is paramount…

ATG is short for Swedish words – AB Trav och Galopp – and we’re a unique betting company. We’re based in Sweden, and we’re owned by the horseracing industry. We try to offer our customers the world’s best betting experience. And it provides about 30,000 daily jobs in Sweden.

Security is important for us. We need to keep our customers’ trust, and one thing is to make sure that if you bet at ATG, your money is safe and your bet is fair.

On what prompted ATG to launch a Bug Bounty Program…

It was good timing actually. We had been looking into it for a bit. It didn’t really tip over at first, but we did struggle with traditional pentesting. We needed something to keep up [with our needs] – to not only [test assets at] a point in time but continuously get reports.

And what kind of tipped the scale was also the business model: that we reward hunters for providing us with valuable information, and we only reward them when we get the information.

On the program’s evolution since launch…

If I’m not mistaken, we launched in 2021. And we started with a private program with a small, limited scope to see if this was something for us. And frankly, in the beginning, I was a little bit bored, because we had for a couple of weeks not a single report. It was that quiet. And then, something happened – we got an instant 20 reports.

After that, we tried to evolve the program to include new scopes, new assets, improve on our reward levels to keep it attractive. And since, I think it’s two years now, we have been running a public program, which has a wildcard scope – so you’re allowed to basically try anything out that is [one of our digital assets].

On the biggest challenge they’ve overcome so far…

Oh… good question. The first challenge we met was: who will help us to patch these bugs? That wasn’t that clear in the beginning, so we kind of developed our own documentation and developed techniques to find out who’s responsible for what line of code, and it’s been running much smoother after that.

On the value of YesWeHack’s customer support and triage service…

I appreciate that you make me feel like a partner more than a client. I really, really, really want to send some kudos to the triage team. They are on the ball 24/7 almost, really rapidly giving us their insights on reports that we receive, and helping us during the process.

I think it gives you great insights into what’s going on, because you use basically the same techniques for malicious hacking, and we learn a lot from that. Also that we pay a reward to someone who is trying to help us.

And you get fast return on investment. If we get serious vulnerabilities reported to us, it’s worth it all day long to reward the hunter for those vulnerabilities.

On the merits of Bug Bounty versus pentesting…

I would say the political answer is it’s 

 pentesting. But with that said, we have had, I would say, 20 really serious reports that we would never get from a traditional pentest. The collective knowledge that we get from a Bug Bounty Program is huge, compared to a pentest where you hire a couple of researchers or consultants to help you.

On keeping hunters engaged after three years and counting…

We’ve done a lot to keep it attractive but that’s a challenge that we need to work on. It was easier in the beginning – when you started to ramp up scopes, you started to ramp up rewards.

But now we’re in a wildcard situation, we can’t add many scopes because they are already there. Now we work with how we interact with hunters – that we are really keen to keep them in the loop, appreciate their work, collaborate and try to be as rapid as we can when we pay out the rewards.

It’s a collective effort because you need colleagues within development, operations and other parts of the business to remediate the bugs reported, because knowing that you have a bug is one thing, but when you actually solve it and patch it, then you have completed the loop.

On whether running a Bug Bounty Program is time-consuming…

From my point of view, there’s not a lot to do. I try to keep my fingers out of the ‘cookie jar’, in terms of looking at the reports! My team manages it beautifully. That’s one [great] thing about this kind of service: the main focus is on remediating vulnerabilities.

Advice for organisations that haven’t yet launched a Bug Bounty Program…

I would suggest trying it out. You actually have very little to lose, because it’s easy to start, easy to quit if you want – but I don’t think you will. You learn about your security posture in a way that you probably didn’t know before.

If you try and you don’t get any reports, I would probably have to buy you a drink or something like that! Because I was afraid in the beginning for us, but now we receive reports continuously. And now, it’s like a self-playing piano in some way.

With the knowledge that we have about ourselves, we know that there’s always vulnerabilities. There’s those that you know of, those that you don’t know of yet, and those that you haven’t deployed yet. So there’s continuous work to be done in terms of keeping your application secure.

 for further details on rules, rewards and scopes.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management platform? 

 to schedule a demo with one of our experts.

‘The collective knowledge ATG gets is huge’: cyber chief on Betting brand’s Bug Bounty story

Bug Bounty often beats pentesting in terms of both the 

 of their deployment, according to TeamViewer’s senior project manager for security.

“The program provides us with a broad access to talent”, said Michael Gillig in a recent YesWeHack webinar about TeamViewer’s Bug Bounty journey.

In particular, he said he valued how hunters often hyper-specialise in specific technologies, such as certain authentication methods. “They are digging really deep into our products,” he said.

 (BBP) went public, “a few things were revealed that were missed by a pentest before. That was partly surprising,” recounted Mr Gillig, who oversees BBPs at 

, whose remote access/control software has been installed on more than 2.5 billion devices worldwide.

Nevertheless, the Germany-headquartered company still does a lot of pentesting. “I would like to shift some capacity away from classic black-box pentesting towards Bug Bounty – and I’m pretty sure I could,” said Mr Gillig, pointing out that a BBP “is like a continuous, never-ending pentest with a large number of resources.”

Given “our software has very high security requirements, because of the special nature of remote-control software,” customers request pentest reports for assurance of cyber resilience, said Mr Gillig.

 is gaining more credibility as the testing model becomes more widely understood. “Customers really like that we run a Bug Bounty Program. It generates trust and shows strong commitment to security,” he says. “There is nothing to hide” when you run a public program. “If you discover and report a vulnerability, we will give you a reasonable financial reward.”

TeamViewer, an official global partner of Manchester United, began its YesWeHack partnership in 2021 with the launch of a 

, which Mr Gillig said “you can spin it up in a few hours”. Hunters are recognised for their contributions through a hall of fame and, sometimes, small gifts.

], which is becoming more important to customers and prospects,” said Mr Gillig.

The first private Bug Bounty Program was launched in 2022 and went public in 2024. The rewards – now up to €10,000 – have grown steadily since launch. A second private program is now underway for another product.

Initially very narrow, the public scope now covers the entirety – web domain, desktop clients, Login service, management console and smartphone apps – of 

, the popular remote control software for IT technicians.

TeamViewer’s first scope was pentested immediately before the BBP launch. “In retrospect, that was unnecessary,” conceded Mr Gillig. “A private program is a kind of pentest,” he said – and a particularly effective one.

“Today, I would not be afraid to start with a less mature scope,” he added, noting that the bug flow could have been kept manageable by inviting fewer hunters and offering smaller rewards at the outset.

And even if the workload had become unmanageable, he added, “you can pause the private program at any time”.

TeamViewer began with 50 hunters and reached around 300 before the first program went public.

Joining Mr Gillig on the webinar, YesWeHack’s Selim Jaafar, TeamViewer’s dedicated customer success manager, said his team helps 

 (and all customers) invite the right hunters based on their requirements, but also “how many hunters should be involved at this time, depending on the scope, challenges, constraints”.

TeamViewer only opened its scopes to all registered ethical hackers – numbering tens of thousands – once their internal bug-management processes were sufficiently stress-tested and optimised. “We had working processes and received vulnerability reports from external hunters before Bug Bounty – but not on this scale,” said Mr Gillig.

Fine-tuning the remediation process and improving internal Service Level Agreements (SLAs) were particularly important for eliminating bottlenecks. “When you receive a vulnerability report with a high CVSS score, development teams sometimes need to interrupt their sprints to fulfil the SLAs,” explained Mr Gillig.

Bug Bounty has enhanced handling and communication – both internal and external – of 

 from all sources, said the security project manager. He also said 

becoming a CVE Numbering Authority (CNA) in 2021

“Amazing support from YesWeHack” helped too. “Really helpful, direct communication,” added Mr Gillig, who said their customer service manager was always available for a call when needed to discuss any issues and answer their questions – even the “stupid” ones they asked early on, he added jokingly.

Previously averaging six a month, the number of reports “exploded” once the first program went public – vindicating the extensive preparation. Yet it still took the 

 by some surprise. “We prepared a lot, but we didn’t expect that, to be honest,” Mr Gillig recalled. By reallocating resources internally, the volume of reports was soon reduced to a more manageable level.

Thankfully, according to Mr Gillig’s estimates YesWeHack’s in-house triage team filters out around 30% of reports, whether as duplicates, out-of-scope reports or because they are missing a Proof of Concept (PoC) or other key information.

“That is the big value of the triage team: we don’t do anything that is not worth our time to look into,” said Mr Gillig. “And the reports come to us with valuable information added by the triage team during their assessment.”

It helps that “these guys really know our products,” he added. “We gave them subscriptions so they can look deep into the product without limits .”

‘Determining CVSS is not always easy’

At first TeamViewer prioritised findings based solely on the CVSS score, but later also took account of other variables. Mr Gillig said the triage service helpfully corrects the CVSS when hunters inadvertently overestimate or underestimate the severity, although TeamViewer has the final say on how the score is set.

“Determining the CVSS is not always easy” and is a matter of interpretation, he said. “There are always discussions, with the hunter but also internally.” Given these challenges and the importance of severity, he recommends that anyone launching a BBP should “train your people in how to determine a CVSS”.

TeamViewer is planning to add new private programs given the success of its YesWeHack partnership so far. “Bug Bounty has made our products more secure and resilient – that’s a fact,” said Mr Gillig.

TeamViewer will soon be launching a private program for 

, a cloud-based remote connectivity solution for PCs, phones, headless devices, OT machinery and embedded platforms.

“What I like the most about Bug Bounty: It is a much larger scope and often more efficient than pentesting,” concluded Mr Gillig in wrapping up the webinar. “It also generates less management overhead.”

As for certain perceived ‘risks’ of Bug Bounty, Selim reminded attendees that internet-facing applications are, by definition, open to attack. “So you don’t take more risks by inviting people to hunt with a mandate, with rules, after background checks, to test it within a more secure framework,” he said. He also pointed out that clients can “set limitations depending on the nature of the asset,” such as on the tools or number of requests permitted.

Mr Gillig agreed that Bug Bounty is a low-risk undertaking: “My advice is don’t be scared, just do it – it will benefit you in many ways, you can be sure of that.”

‘More efficient than a pentest and it generates trust’: TeamViewer’s Bug Bounty story so far

ETHICAL HACKERS CHALLENGED TO FIND SECURITY SYSTEMS VULNERABILITIES DURING THE LATEST EDITION OF ROMHACK

YesWeHack, the global bug bounty and vulnerability management platform collaborated with Ferrero, one of the world's largest sweet-packaged food companies, in hosting 

Italy’s first-ever live bug bounty event.

The landmark competition, which saw some of Europe's most talented ethical hackers compete for points, prestige and financial rewards, took place on 28 September at the RomHack cybersecurity conference in Rome. More than 50 ethical hackers took part in live bug bounty events where participants hack intensively for 10-36 hours.

crowdsource the security testing of digital applications and information systems by inviting ethical hackers (or ‘hunters’) to probe specific targets (‘scopes’) for vulnerabilities – which, if found, earn them financial rewards (bounties). Growing numbers of organisations in a range of sectors, including nearly all of the world’s largest companies, use bug bounty to improve their security.

“Vulnerabilities exist in increasingly complex modern applications. A 

 helps organisations find and fix many vulnerabilities in a short period of time. Hacking against the clock, ethical hackers collaborate and compete to achieve eye-catching results, as well as giving developers and security teams advice that reduces the risk of new vulnerabilities being created in future,” 

said Guillaume Vassault-Houlière, CEO and co-founder of YesWeHack.

 further confirmed our commitment to foster a culture of innovation and to enhance collaboration with the global community of cybersecurity professionals. We recognize the key role that ethical hackers and researchers play in identifying vulnerabilities and improving the overall security of systems, with a clear benefit for both our consumers and our business,” 

said Vittorio Addeo, Cyber Offence Manager of the Ferrero Group.

“This opportunity was essential to explore new areas and methodologies for detecting vulnerabilities, push the limits of security testing, and strengthen our proactive approach to protecting digital assets and data. The goal is to learn, grow, and continue to build a more secure digital environment,

” added Andrea Lombardini, Group Cyber Security Manager of the Ferrero Group.

Taking part in the RomHack live bug bounty was not an isolated initiative: Ferrero always aims to achieve excellence, which is why it launched its 

 in February 2023 with a limited number of researchers chosen on the basis of their skills, ranking and reputation.

That program was developed in response to the company's need to test the Group's top brand websites, while ensuring that the internal organisation and processes put in place by the company’s Cyber Team were effective. In the future, Ferrero plans to invite more ethical hackers into its bug bounty program, entrusting them with conducting increasingly in-depth tests.

Launch your bug bounty program—contact us today!

YesWeHack and Ferrero inaugurate Italy’s first live hacking event

Europe’s most successful ethical hackers and an iconic luxury fashion house proved an irresistible combination for our most glamorous Live Bug Bounty yet.

From the Paris headquarters of Louis Vuitton, around 40 high-ranking hunters deployed their eclectic skills to produce an impressive variety of findings at the second edition of YesWeHack’s ‘Hack Me I'm Famous’.

Louis Vuitton has declared itself delighted with the results – a reflection of the calibre of the hunters, the time (30 hours) and productive setting for hunting, and the target’s commitment to making its internet-facing applications as secure as possible.

YesWeHack keeps Live Bug Bounty targets under wraps until the last-possible moment. This prevents hunters performing pre-event reconnaissance on the targets to get a head start.

On day one, the hunters were kitted out in stylish, baseball-style jackets customised with their hacker alias, before being led to the mystery venue. En route, some excitedly speculated, aided by Google Maps, which nearby organisation might be welcoming them. A famous company? A government agency?

It was no anticlimax when Louis Vuitton’s impressive headquarters heaved into view.

Founded in 1854, Louis Vuitton’s clothing, bags, jewellery, perfume and other fashion items are instantly recognisable worldwide via its iconic LV monogram. The haute couture pioneer is part of LVMH group, the world’s largest luxury fashion multinational.

If the Live Bug Bounty target excels in its field, then so too do the hunters carefully handpicked for the occasion. Ten of YesWeHack’s all-time top 25 performers were enlisted, although hunters were chosen not just for their leaderboard ranking, but also for the relevance of their skillset to the scopes at hand.

Louis Vuitton was a tantalising target – and not only because of the lustre of the brand itself.

Unusually in its industry (and most industries), Louis Vuitton develops most of its digital assets internally. Adding to the anticipation for the Live Bug Bounty was an API among the scopes that had not been part of the private Bug Bounty Program.

Partly thanks to some participants’ familiarity with the scopes via the private program, the reports started rolling in relatively early. Vulnerabilities were surfaced throughout, with the final report submitted in the last few seconds of the competition.

Just 30 minutes later the Louis Vuitton team had, with YesWeHack’s support, reproduced and assessed all vulnerabilities.

The hackers seemed particularly laser-focused as they hacked for 30 hours with infrequent breaks for food, socialising and sleep.

And yet, they were still happy to take time out to patiently explain their findings to Louis Vuitton security teams during their event. There were also ‘show and tell’ presentations of the most significant vulnerabilities at the end.

“What makes this type of event unique is the intense interaction and collaboration that we saw between the researchers and Louis Vuitton security teams,” said Adrien Jeanneau, head of security analysts and researcher enablement. “We saw some great exchanges between them, and everyone appreciated it! The hunters and security teams delved deep into technical discussions about the findings, even though time was limited.” 

Alongside the hacking event, staff from various departments attended demonstrations and interactive workshops about the Live Bug Bounty, phishing attacks and protecting the brand’s global internet assets, among other things.

This, and the attentive engagement throughout of Louis Vuitton’s CIO and CISO, revealed a corporate culture that takes security very seriously – organisation-wide.

 were occupied by a Spanish trio who collaborated throughout the event and notched 26 bugs and 23 rewards apiece. Collectively the hunters reported 133 bugs in total.

YesWeHack and Louis Vuitton created special awards for notable achievements at the Live Bug Bounty, with the winners taking home YesWeHack souvenirs created for the event. Congratulations to the winners:

🧥 Shellcode Stylist (1st place): Diego Bernal Adelantado aka GoDiego

🧵 Exploit Tailor (2nd place): Diego Jurado Pallarés aka djurado

🎀 Pwnage Designer (3rd place): Carlos Rivero Molina aka hipotermia

🧶 Patchwork Pwners (team with highest points): GoDiego, djurado and hipotermia

💎 Best-Dressed Bug (biggest impact): HakuPiku

👜 Bug Trend-Setter (first valid bug): GoDiego

Christophe Plouseau, Chief Information Officer (CIO) of Louis Vuitton, said:

“This is the very first time a luxury brand has organised such an event, so I am very proud of LV_NEO Teams [Louis Vuitton’s tech team]. We were already in the forefront of cybersecurity and this event is testament that we take cybersecurity and cyber threats seriously, especially in the context of the Paris Olympic Games coming soon, where French firms will be the main target of hackers.

“This was also a tremendous opportunity to have the crème de la crème of hackers with us, to share with all LV employees tips and tricks for what they should do in their personal and professional life to mitigate cyber risk, and share what Louis Vuitton does to protect the company’s assets and information systems.”

The hunters also offered their thoughts on the event:

“The experience has been top-notch. I believe we found good bugs… the Louis Vuitton team are great. I would like to thank the YesWeHack team again for the great facilitation of the event, the rewards, the communication.”

“The office is extremely huge and beautiful so we were all looking [forward] to hunt in this place. I really enjoyed the event, honestly. I have the luck to hunt with a lot of friends.”

“This is my first experience with a live hacking event and it is an amazing event. It was possible to improve my knowledge. The place is very beautiful. Nice food, nice scope, very nice people. Fantastic hackers and friends.”

“I knew that they had a quite huge scope. So it was a great feeling knowing there is going to be a lot to hack on, probably not as many duplicates. I’d like to thank YesWeHack for inviting me to this very exclusive event and I want to thank Louis Vuitton for hosting us here at their headquarters.”

And finally, from YesWeHack: a big thank you to all participating hunters, Louis Vuitton and all partners for making this event a such as huge success.

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

The world’s largest cosmetics and personal care company is the latest illustrious brand to enjoy the benefits of a live Bug Bounty with YesWeHack.

Websites, APIs and mobile apps belonging to L'Oréal are now significantly hardened thanks to the discovery of 71 vulnerabilities during an 18-hour event at the LeHack conference last week.

The live hacking event in Paris began at 10am on day two of LeHack (7 July) and concluded at 4am the following morning after some intensive triaging. The rewards grid went up to €5,000.

The scopes comprised a representative sample of L’Oréal’s most business-critical assets, including:

E-commerce websites for various brands and markets, built on different core technologies

Technologies highly specific to L’Oréal that process sensitive customer data

Impressed by the initial findings, L’Oréal’s security team extended the scope early in the evening to maximise the talent and unique opportunity available – a decision vindicated by the submission of some invaluable findings as the event drew to a close. Most notably, credentials were available for one added scope – an uncommon move for a live hacking event – which allowed hunters to dig deep into a new application and make some intriguing discoveries.

More than 50 YesWeHack-registered hunters kicked off the event and around 100 took part overall, with 31 making it onto the leaderboard.

 by a huge margin in his first-ever live hacking event (although he 

 until the second half of the event). He notched 142 points via nine bug reports.

In second place, ‘Borgi’ accrued 49 points from six vulnerabilities, while third on the podium was ‘cosades’, who scored 45 points from three reports.

However, the leaderboard is only one part of the story of live Bug Bounties, which are as much about (if not more so) collaboration and community.

“It was really nice to meet [fellow hunters] again and to discuss with some managers of programs I'm used to hunting on,” said ‘Aituglo’, one of the participants, in a 

Aituglo said his own pre-event automation work and the support of his peers paid dividends for L’Oréal. A custom plugin helped him “get a hit for an XSS” within five minutes of starting his hunt, then “with the help of some friends, I got a nice PoC to steal the password of the user”.

Despite the generous bounties on offer, Aituglo said that making “a lot of money” was not the overriding incentive. It’s “more to discuss and see your friends, hunt together and so on”.

“Thank you for this wonderful event. It was a pleasant surprise and an honour to top the leaderboard. This motivates me to continue learning and improving.

“It was my first in-person event in cybersecurity, and it was really exciting. The other participants were all friendly and warm. The event was well structured, with responsive support. A very positive and enriching experience.”

The event was also “an enriching experience for another hunter, @dropn0w, who 

 on X: “We learned many valuable lessons and measured our skills against the best hackers in France.”

Guillaume Kermarrec, threat and vulnerability manager at L'Oréal’s CyberDefence Center, and in charge of L'Oréal’s Bug Bounty Programs, said:

“The key benefits were meeting the security researchers, meeting the triage team, and working together to find and fix some complex vulnerabilities. We focused on our most critical websites, both global websites and from different regions, B2B and B2C, and some uncovered assets like APIs and mobile applications. Thanks to this live event we could test some new scopes with very specific configurations that couldn’t be added to our continuous program. We have found some interesting vulnerabilities at the live hacking event.”

Fabio Bührer, global application security manager at L'Oréal’s CyberDefence Center:

“The scopes have been tested in the past and now there’s a lot of good people here going through the scopes to see if there’s anything that needs to be taken care of. It’s good to meet the people who work on the program virtually and and see that they actually exist – they’re not just an avatar or AI! YesWeHack did a great job of organising this.”

From YesWeHack, a sincere and heartfelt thanks to all participants for helping to secure the digital assets of L'Oréal, the personal data of L'Oréal customers, and the global internet as a whole.

The L'Oréal event follows a recent Live Bug Bounty held for a similarly glamorous and legendary French brand: Louis Vuitton, which was more than satisfied with the outcome of 

YesWeHack’s second ‘Hack Me I'm Famous’ event

. This in turn came hot on the heels of a 

 in the scopes of Groupe Caisse des Dépôts (CDC), a French public financial institution, at InCyber Forum (FIC) Europe. The targets for LeHack 2023, meanwhile, were provided by the

 French Red Cross and retail distribution giant Les Mousquetaires Group

 and also yielded an impressive bug haul.

YesWeHack also welcomed a steady stream of ethical hackers, security researchers and other security professionals at our LeHack booth, in Cité des sciences et de l'industrie.

 CTF training platforms, we gave away countless t-shirts and other swag. Other sought-after merch was exclusively available to anyone who managed to take on our claw machine (pictured) and triumph.

Finally, many thanks to our tech ambassador, BitK, for the CTF he created exclusively for LeHack attendees (the ‘Pandemic CTF’).

L'Oréal lauds live Bug Bounty success at LeHack 2024

Dozens of vulnerabilities discovered and promptly remediated is a reliable measure of a Live Bug Bounty’s success.

However, the immediate hardening of applications used by certain European supermarket and DIY chains was apparently not the only benefit of a 

 that took place at leHACK, in Paris in 2023.

The then Digital Lab technical lead at Les Mousquetaires said findings from the live hacking event – which also featured scopes from the French Red Cross – would help the French distributor and symbol group “anticipate corner cases” in software development and implement “security by design”.

And in an interview with YesWeHack, Fabrice Bru, CISO at STIME, the IT department of Les Mousquetaires Group, observed that live hacking events facilitated fruitful collaboration with ethical hackers and offer stakeholders reassurance about their security posture.

Read or watch the interview below to also hear Fabrice Bru’s reflections on the Bug Bounty journey so far and the benefits of partnering with YesWeHack, for both continuous security testing and intensive live hacking events.

Les Mousquetaires (‘The Musketeers’ in English) operates 4,100 retail stores in France, Belgium, Portugal and Poland, as well as logistics hubs and support services. Retailers in its stable include Intermarché, Netto, Bricomarché, Bricorama, Brico Cash, Roady and Rapid Pare-Brise.

FABRICE BRU ON THE BUG BOUNTY JOURNEY SO FAR…

We started the Bug Bounty initiative in November 2022, initially on the intermarche.com website, which is an e-commerce site, with around 10 researchers to start with, and gradually we increased the number of hunters to 80.

The whole point for us is, beyond having an occasional overview of the security state of our site, to have a constant monitoring of all the vulnerabilities and potential cases of fraud that we could have on the e-commerce site, since we carry out daily updates on this site.

For this Live Bug Bounty, we obviously included the Intermarché e-commerce site in the scope. We also wanted to add the e-commerce sites of our DIY stores: Bricomarché, Bricorama and Brico Cash. We are also in the process of opening up a new application to our suppliers and shops, which will become an essential part of their day-to-day operations at points of sale, and we also wanted to assess its security through this event.

ON THE LIVE BUG BOUNTY SO FAR [THE INTERVIEW WAS CONDUCTED PARTWAY THROUGH THE EVENT]…

So far, the Live Bug Bounty is going very well for us. Four people from the STIME teams are here – three from the cyber teams and one from the development teams – to try and assess as fully as possible the business impact of the four vulnerabilities identified by the hunters [at the time of the interview].

I have to say that, for the time being, we're actually achieving our objectives, since we’ve started to identify some very interesting cases.

ON THE VALUE OF PARTNERING WITH YESWEHACK…

The collaboration with YesWeHack obviously began before we started our Bug Bounty Program.

We worked very closely with the [YesWeHack] teams. We were able to review the solution and, above all, when we started, what we really enjoyed was the quality of the hunters, their relationship with the YesWeHack teams and the quality of the triage, which saved us an immense amount of time and enabled us to focus on what is essential.

And when you start this kind of initiative, you never really know how much you're going to spend in rewards, and the whole point of being supported by YesWeHack has been to gradually learn how much to value a vulnerability reported by the hunters.

Today's collaborations are very fluid and close-knit. During the event today, we have managed to meet hunters who regularly hunt on our sites, so it's a great way of networking and getting close to them. It’s amazing!

ON THE VALUE OF HARDENING DIGITAL ASSETS THROUGH LIVE HACKING EVENTS…

For STIME, taking part in this event is also about demonstrating the dynamism of our cyber teams, using all the techniques and innovations that exist in our profession today to assess the level of maturity and security of our sites, and reassure our businesses about our ability to protect the company’s activities.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to reach out to us.

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

In terms of useful results, Bug Bounty Programs are typically 90% cheaper than traditional pentesting, according to one speaker at YesWeHack’s ‘Client Success Stories’ event in Stockholm.

The presenter, an application security engineer from a Scandinavian financial services company, also hailed the fact that financial input tracks actionable output – specifically the number and severity of valid reports. “There’s no cheaper way of getting security testing,” he said. “It’s a no-brainer.”

Bug Bounty had been an “incredibly useful asset” overall, he continued, and would only become more useful across the economy in the age of digital transformation since hunters focus on internet-exposed assets.

Bug Bounty deepens cyber-defences by adding a valuable, complementary layer to offensive security operations.

The speaker noted how Bug Bounty mostly supplements rather than duplicates the results of penetration tests, because the former specialises in internet-facing assets, while the latter can focus more on internal networks.

And, drawing on tens of thousands of hunters, Bug Bounty clients can more easily find testing expertise specific to their targets than is typically the case through conventional pentests.

The upshot for the YesWeHack customer in question was the security team being “flabbergasted” at some of the hunters’ discoveries. “Never in a million years” would they have found one particular misconfiguration issue internally, recalled the AppSec engineer delivering the presentation.

Sometimes hunters did find bugs that had already been discovered internally, but which hadn’t yet been fixed. Yet once reported through the Bug Bounty pipeline, they were promptly remediated, the speaker noted.

The Bug Bounty success story began (and it’s 

) with a pair of good-faith bug reports – one submitted externally, another internally. Recognising the need for a secure, structured reporting mechanism, they duly launched a Vulnerability Disclosure Policy (VDP).

Once the VDP was in place, the move to paying researchers was “not a big jump”, insisted the AppSec engineer – albeit this was not a universal perception. “Won’t this just encourage people to hack us?” was one misgiving encountered at boardroom level.

The speaker simply pointed out that traffic logs showed malicious attacks were happening on a regular basis anyway. At least ethical hackers would mitigate the risk of attacks succeeding – and halt their activities in the unlikely event of services being unwittingly disrupted.

Once boardroom buy-in was secured, YesWeHack’s 

strict compliance with EU data security rules

Customer Stories

‘The collective knowledge ATG gets is huge’: cyber chief on Betting brand’s Bug Bounty story

‘More efficient than a pentest and it generates trust’: TeamViewer’s Bug Bounty story so far

YesWeHack and Ferrero inaugurate Italy’s first live hacking event

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

L'Oréal lauds live Bug Bounty success at LeHack 2024

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

‘An efficient way to uncover vulnerabilities’: Doctolib's five years in Bug Bounty

Bug Bounty hunters mount impressive sprint finish to Caisse des Dépôts marathon

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

‘Large amount of knowhow’: Why Thüringer Aufbaubank harnesses Bug Bounty to bolster customer trust

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

‘Large amount of knowhow’: Why Thüringer Aufbaubank harnesses Bug Bounty to bolster customer trust

Products

Researchers

Resources

Company

Follow us