Dozens of vulnerabilities discovered and promptly remediated is a reliable measure of a Live Bug Bounty’s success.

However, the immediate hardening of applications used by certain European supermarket and DIY chains was apparently not the only benefit of a 

 that took place at leHACK, in Paris in 2023.

The then Digital Lab technical lead at Les Mousquetaires said findings from the live hacking event – which also featured scopes from the French Red Cross – would help the French distributor and symbol group “anticipate corner cases” in software development and implement “security by design”.

And in an interview with YesWeHack, Fabrice Bru, CISO at STIME, the IT department of Les Mousquetaires Group, observed that live hacking events facilitated fruitful collaboration with ethical hackers and offer stakeholders reassurance about their security posture.

Read or watch the interview below to also hear Fabrice Bru’s reflections on the Bug Bounty journey so far and the benefits of partnering with YesWeHack, for both continuous security testing and intensive live hacking events.

Les Mousquetaires (‘The Musketeers’ in English) operates 4,100 retail stores in France, Belgium, Portugal and Poland, as well as logistics hubs and support services. Retailers in its stable include Intermarché, Netto, Bricomarché, Bricorama, Brico Cash, Roady and Rapid Pare-Brise.

FABRICE BRU ON THE BUG BOUNTY JOURNEY SO FAR…

We started the Bug Bounty initiative in November 2022, initially on the intermarche.com website, which is an e-commerce site, with around 10 researchers to start with, and gradually we increased the number of hunters to 80.

The whole point for us is, beyond having an occasional overview of the security state of our site, to have a constant monitoring of all the vulnerabilities and potential cases of fraud that we could have on the e-commerce site, since we carry out daily updates on this site.

For this Live Bug Bounty, we obviously included the Intermarché e-commerce site in the scope. We also wanted to add the e-commerce sites of our DIY stores: Bricomarché, Bricorama and Brico Cash. We are also in the process of opening up a new application to our suppliers and shops, which will become an essential part of their day-to-day operations at points of sale, and we also wanted to assess its security through this event.

ON THE LIVE BUG BOUNTY SO FAR [THE INTERVIEW WAS CONDUCTED PARTWAY THROUGH THE EVENT]…

So far, the Live Bug Bounty is going very well for us. Four people from the STIME teams are here – three from the cyber teams and one from the development teams – to try and assess as fully as possible the business impact of the four vulnerabilities identified by the hunters [at the time of the interview].

I have to say that, for the time being, we're actually achieving our objectives, since we’ve started to identify some very interesting cases.

ON THE VALUE OF PARTNERING WITH YESWEHACK…

The collaboration with YesWeHack obviously began before we started our Bug Bounty Program.

We worked very closely with the [YesWeHack] teams. We were able to review the solution and, above all, when we started, what we really enjoyed was the quality of the hunters, their relationship with the YesWeHack teams and the quality of the triage, which saved us an immense amount of time and enabled us to focus on what is essential.

And when you start this kind of initiative, you never really know how much you're going to spend in rewards, and the whole point of being supported by YesWeHack has been to gradually learn how much to value a vulnerability reported by the hunters.

Today's collaborations are very fluid and close-knit. During the event today, we have managed to meet hunters who regularly hunt on our sites, so it's a great way of networking and getting close to them. It’s amazing!

ON THE VALUE OF HARDENING DIGITAL ASSETS THROUGH LIVE HACKING EVENTS…

For STIME, taking part in this event is also about demonstrating the dynamism of our cyber teams, using all the techniques and innovations that exist in our profession today to assess the level of maturity and security of our sites, and reassure our businesses about our ability to protect the company’s activities.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to reach out to us.

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

In terms of useful results, Bug Bounty Programs are typically 90% cheaper than traditional pentesting, according to one speaker at YesWeHack’s ‘Client Success Stories’ event in Stockholm.

The presenter, an application security engineer from a Scandinavian financial services company, also hailed the fact that financial input tracks actionable output – specifically the number and severity of valid reports. “There’s no cheaper way of getting security testing,” he said. “It’s a no-brainer.”

Bug Bounty had been an “incredibly useful asset” overall, he continued, and would only become more useful across the economy in the age of digital transformation since hunters focus on internet-exposed assets.

Bug Bounty deepens cyber-defences by adding a valuable, complementary layer to offensive security operations.

The speaker noted how Bug Bounty mostly supplements rather than duplicates the results of penetration tests, because the former specialises in internet-facing assets, while the latter can focus more on internal networks.

And, drawing on tens of thousands of hunters, Bug Bounty clients can more easily find testing expertise specific to their targets than is typically the case through conventional pentests.

The upshot for the YesWeHack customer in question was the security team being “flabbergasted” at some of the hunters’ discoveries. “Never in a million years” would they have found one particular misconfiguration issue internally, recalled the AppSec engineer delivering the presentation.

Sometimes hunters did find bugs that had already been discovered internally, but which hadn’t yet been fixed. Yet once reported through the Bug Bounty pipeline, they were promptly remediated, the speaker noted.

The Bug Bounty success story began (and it’s 

) with a pair of good-faith bug reports – one submitted externally, another internally. Recognising the need for a secure, structured reporting mechanism, they duly launched a Vulnerability Disclosure Policy (VDP).

Once the VDP was in place, the move to paying researchers was “not a big jump”, insisted the AppSec engineer – albeit this was not a universal perception. “Won’t this just encourage people to hack us?” was one misgiving encountered at boardroom level.

The speaker simply pointed out that traffic logs showed malicious attacks were happening on a regular basis anyway. At least ethical hackers would mitigate the risk of attacks succeeding – and halt their activities in the unlikely event of services being unwittingly disrupted.

Once boardroom buy-in was secured, YesWeHack’s 

strict compliance with EU data security rules

But it was endorsements from peers that sealed the deal for a 

 type of security testing and what the speaker conceded is a “very conservative” financial services industry.

“Wow, we need this,” they said, having seen a Swiss Post presentation about their 

 and meeting another YesWeHack client, Scandinavian telco 

After three months, the pilot was so successful they had “no doubt” about continuing.

Watch our Live Bug Bounty with Swiss Post

The organisation’s conservatism is now the biggest barrier to making the program public, admitted the speaker.

Fortunately, the biggest worry about going public – that the flow of bugs might become an unmanageable flood – is abating as the private program expands, he added. The current program continues to cope well with a gradually growing number of hunters, and the leap to accepting reports from all registered hunters seems ever-smaller and less daunting.

The speaker was currently “fighting” to persuade decision-makers to launch a public Bug Bounty Program, in order to access the full spectrum of hacking skills and publicly demonstrate their commitment to security.

Intriguingly, he believed going public might even aid recruitment in a fiercely competitive market for talented developers, since many are keen to learn more about application security. The Bug Bounty Program findings also inform security training programs and raise the security team’s profile internally, said the engineer.

The speaker echoed advice expressed in many of our 

: start small (with limited scopes and few hunters) to prevent an overload of reports; periodically add scopes, and sometimes increase rewards, to sustain hunter interest; and treat hunters well.

“The way you talk to hunters can be a meaningful factor in whether they come back,” especially if severity is lower than anticipated, said the speaker. Thank them, compliment them and fix their bugs promptly, he advised.

Hunters will also benefit from simpler rules of engagement if you create separate programs for “very different types of systems”. YesWeHack allows customers to create as many programs as they need for no additional cost.

There were some invaluable insights around choosing scopes and providing infrastructure that mitigates risk.

For instance, the speaker’s fellow BBP managers were urged to beware reliance on third parties. Can we count on Microsoft promptly remediating an Office 365 endpoint issue, he asked?

He also pointed out that the UX is a commonly abused attack vector that demands attention. Why not spin up a replica application, separate from production environments, to eliminate risk?

Overall, the workload has been greater “than expected – not an incredible amount, but you have to be active in your program management”.

It’s therefore wise to accept YesWeHack’s assistance, including our recommendations for choosing hunters with relevant skills. The in-house triage service is worth leveraging too, “to filter out chaff, all the noise”, said the speaker. This “first line support” was “incredibly useful” for his employer, especially early on.

YesWeHack’s “handholding” helped them keep the flow of bugs manageable and stay within budget, as has testing assets internally before adding them to the scopes. “Pluck the [easy] weeds in your garden before bringing in a professional weed hunter,” advised the speaker.

YesWeHack has an office in Stockholm dedicated to catering to its clients – 20 and growing – in the Nordic-Baltic region. We also have a dedicated hacker community manager for the region, who caters to the needs of more than 1,500 vetted researchers in the Nordic-Baltic countries.

If you would like to discover another of our case studies, you can check out 

the Bug Bounty success story from risk-management giant DNV

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

In few sectors is cybersecurity as high a priority as it is in healthcare. At stake is huge volumes of highly sensitive personal information and even lives.

It’s therefore a testament to YesWeHack that security-testing of medical software used by 340,000 healthcare personnel and 80 million patients should be entrusted to tens of thousands of our 

In this interview, Cedric Voisin and Paul Marty, respectively CISO and senior product security engineer at 

, reflected on the European healthcare booking platform’s five-year journey in crowdsourced security so far.

Among other topics, the pair discussed Bug Bounty success factors, a trio of special scenarios for claiming maximum bounties, and a ‘panic button’ for hunters embedded within its production instances.

One, to ease access to care for every patient. The second mission is to ease practitioners’ lives in providing them with handy solutions, in order to ensure that they can focus on delivering care to patients.

Cedric on the evolution of Doctolib's Bug Bounty Program…

 five years ago with YesWeHack, first on a very limited scope on the patient side. Then we expanded it to the pro side, in order to stress[-test] the application that we sell to practitioners.

Then we introduced our IT landscape, to finally make the patient program public and raise the bounties associated to those programs.

Paul Marty on increasing the maximum bounty…

Since then, we did two major updates to our program: first, we raised the maximum bounty to €25,000; second, we have updated our Bug Bounty Program.

High rewards require a very detailed program, which aims to cover all the cases. To address this, we continuously improve, based on the feedback from participants and the YesWeHack team.

Paul on a collaborative vulnerability disclosure process…

The Bug Bounty at Doctolib is a collaborative effort. The YesWeHack triage team will first qualify the report, then a security specialist from our team will take ownership of the entire Bug Bounty process. He discusses [the bug] with security researchers as well as the team in charge of the feature [containing the vulnerability].

Cedric on key factors for a successful Bug Bounty Program…

First, I would say that it is really important to start with a very limited scope, well identified, with which you can act very easily in fixing the vulnerabilities that are shared by hunters, and also limit the financial impact of providing rewards to hunters.

Then, as soon as you gain confidence on that program, it’s really easy to expand it to more and more applications. And the final point is to write a very well-defined vulnerability disclosure policy, in order to state clearly to hunters what is expected from them and what is not.

Paul on what has impressed most about the Bug Bounty model…

Efficiency: it’s a very good way to uncover security vulnerabilities. And when you think about it, the high reward is still a good price for a critical bug.

Transparency: it reflects our willingness to deliver a product with the highest standard of security.

Paul on the support provided by YesWeHack…

YesWeHack acts as a partner that helps us to qualify the reports, improve our program and sometimes to define the high rewards we give to security researchers.

Paul on an exciting new avenue for earning maximum bounties…

We have added three special scenarios where participants can earn the maximum bounty.

First, we have the ‘Game Over’ scenario – if a security researcher can access an environment variable. Second, we have the ‘One Shot’ scenario – if the hunter can access a large dataset of patient health information. And third, the ‘Casper’ scenario – if the security researcher can exploit a critical bug without being detected by the security team.

All our production instances have a secret button that any security researcher can push at any time to demonstrate that they successfully hacked Doctolib. You can read more about this panic button in our public program.

Looking for fresh bug-hunting targets? Check out 

 for further details on rules, rewards and scopes.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to schedule a demo with one of our experts.

‘An efficient way to uncover vulnerabilities’: Doctolib's five years in Bug Bounty

Bug Bounty is a “good addition” to Thüringer Aufbaubank’s fulfilment of its compliance obligations around pentesting, according to the development bank’s head of software engineering.

In this interview with YesWeHack, Jürgen Krug reflects on the benefits of crowdsourced security testing – not least for software development practices – and his tips for running an effective Bug Bounty Program.

 (TAB) is a publicly-owned development bank that provides loans, grants and guarantees to projects and organisations in the central German state of Thuringia. Among other things, the bank provides financing on favourable terms to infrastructure projects, environmental protection initiatives and proposals that prioritise sustainable development.

Why did Thüringer Aufbaubank decide to launch a Bug Bounty Program?

Only by ensuring the integrity, confidentiality and availability of the data we process can we maintain the necessary trust of our customers, which is the basis of the business we carry out. 

The foundation for this is a systematic consideration of threat scenarios and the measures derived from them. This approach guarantees that the most important aspects of security are considered, but it also means that we are moving on pre-thought-out paths.

, we want to complement this necessary approach with a pragmatic approach that also considers new, unexpected aspects of cybersecurity. 

With the many bug hunters that YesWeHack connects us to, we have access to a large amount of know-how in the security space that all of our products can benefit from.

Why did you choose YesWeHack over rival platforms?

Our choice fell on YesWeHack since the European data protection requirements 

 without a doubt, as well as the platform having sufficient popularity to be able to activate enough hunters, and finally due to the adequate pricing, as we are only a small company.

What are the most significant benefits of Bug Bounty so far?

 We received information on specific attack scenarios that we were able to prevent.

The hackers’ approach also showed us topics and approaches that we continue to pursue ourselves and that we take into account in the development process.

How has the program evolved and expanded so far?

We started by inviting a limited selection of hackers, so we could gain experience of using a Bug Bounty platform before increasing the flow of bugs to remediate. After the number of reports plateaued, we decided to 

What are your plans or hopes for how your Bug Bounty Program will grow or become more optimised in the coming years?

 First, we are concentrating on business applications that are accessible on the internet.

An extension to other services offered by the bank is conceivable. Testing from an internal perspective, with extended authorisations on separate test systems, is a topic we want to address in the future.

Have you faced any challenges adapting your program to the demands or constraints of your security maturity and internal skills and resources?

The volume of reports was easily processed by our internal teams. Of course, we also benefited from the sophisticated scoping of reportable vulnerabilities, as well as the triage services provided by YesWeHack.

All reports that are ultimately relevant to us flow into a general process for known security vulnerabilities in the bank, which can be centrally controlled and monitored regardless of the source of the information.

Are there any particular challenges or opportunities that Bug Bounty presents for the banking/financial services sectors, given their strict compliance and security requirements?

The requirements of the supervisory authorities for banks already include the performance of penetration tests. In this respect, Bug Bounty is a good addition, since it has the same objective as pentests, but utilises a different approach.

What best practices do you follow that other organisations could benefit from by emulating?

We try to classify a report as quickly as possible and provide feedback to the hacker quickly.

And if a piece of information is of value to us, even though the report itself has no direct impact, we sometimes give a voluntary bonus to show our appreciation to the bug hunters.

Thüringer Aufbaubank recently launched a public Bug Bounty Program on the YesWeHack platform with rewards ranging up to €5,000 for critical vulnerabilities. 

 to find out about the scopes, rewards and rules of engagement.

‘Large amount of knowhow’: Why Thüringer Aufbaubank harnesses Bug Bounty to bolster customer trust

Bug Bounty’s intrinsic cost-effectiveness – thanks to the crowdsourced and, in YesWeHack’s case, results-based pricing model – is a big plus for public-sector organisations.

As well as praising the “cost model”, the CISO of one such entity, the European Community of Alsace (Collectivité européenne d'Alsace), hailed the agility of 

In the video and writeup below, Jérémie Piazza explains the strategic decision to launch a Bug Bounty Program in 2022, how the model fosters more secure development, and the strengths underpinning the partnership with YesWeHack.

The European Community of Alsace is a regional government body that provides services tailored to the needs of the Alsace region in France. It emerged from the merger of two departmental councils, Haut-Rhin and Bas-Rhin, in 2021.

ON THE IMPORTANCE OF CYBERSECURITY AT THE EUROPEAN COMMUNITY OF ALSACE…

Security is an important, even strategic, issue, particularly in the context of the convergence of teams, systems and technologies, added to an increasing number of cyber-attacks against local authorities, as well as the possible assimilation to a European institution. 

All this means that the local authority’s management really takes security issues into account.

Setting up a Bug Bounty Program is part of our vulnerability management process. In this context, we opted for Bug Bounty for agility reasons, particularly in terms of the scope, which can be modified on demand.

Because the cost model is particularly clear, you have a subscription cost and a cost linked to bounties. The notion of bounties also makes development teams aware of the cost of vulnerabilities and encourages them to gradually integrate security by design.

And then we have the advantage of calling on a 

 who have very different approaches to managing and detecting these vulnerabilities.

We also use Bug Bounty as part of the approval process for our teleservices.

We launched our program in 2022, in stages – initially with a limited number of assets and hunters, to enable our teams to mature both in terms of bug resolution and the use of the platform.

The main challenge in setting up a Bug Bounty Program is essentially an internal one. It will depend on your teams’ ability to deal with the bugs reported.

Initially, we were careful to ensure that our teams were capable of handling all the bugs reported by the hunter, to maintain their interest in the program.

The next steps are to broaden our scope. Today, we only have a certain number of institutional sites. In the future, we hope to add externally hosted sites to this number.

Our relationship with YesWeHack is now one of 

, based both on the expertise of the YesWeHack teams in helping us use the platform and on the quality of the bugs reported by hunters.

HIS ADVICE FOR LAUNCHING OR GROWING A BUG BOUNTY PROGRAM…

One piece of advice I’d give to those who want to get started is simply to do it gradually. Give yourself time to mature, both in terms of the type of bug reported and in terms of your teams’ ability to deal with these bugs.

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

 Program (BBP) has diversified the vulnerabilities unearthed in the financial institution’s systems and strengthened the skills of its offensive security team.

That’s according to Lucas Zuluaga Pérez, part of Bancolombia’s red team and manager of the banking group’s BBP at YesWeHack.

Founded in 1875, Bancolombia Group comprises banks in Colombia, Panama, Guatemala and El Salvador, supported by more than 30,000 employees and 80,000 suppliers. It also operates in the US and the Bahamas.

Translated from Spanish, the following interview sees Lucas discuss the group’s approach to expanding the BBP, the security and red team benefits of Bug Bounty, success factors in crowdsourced security, and the reasons for choosing YesWeHack.

LUCAS ZULUAGA PÉREZ ON THE LAUNCH AND EVOLUTION OF BANCOLOMBIA’S BBP…

Security is of the utmost importance to Bancolombia, as we ensure the protection of more than 16 million customers.

Bancolombia’s Bug Bounty Program started around October 2021. We started with a private program in which five of the best hackers in YesWeHack participated. We had a great evolution and within a year we managed to considerably expand the scope of our sites, going from two sites to 30 sites, from five hackers to 50.

Key factors such as the support of senior management, that our leaders consider cybersecurity as a key element, are very important.

Secondly, having the engagement of the technology teams, which positively welcome reports of some of the vulnerabilities we identify in the environment.

And thirdly, the involvement of the red team, to raise the bar every day with the support of the triage team and hunters of YesWeHack.

ON THE RED TEAMING AND SECURITY BENEFITS OF BUG BOUNTY…

With our Bug Bounty Program, the red team’s skills have increased considerably. We have vulnerabilities in our checklist that we would not have considered before.

We have achieved great maturity and a great process, which allows us to quickly address vulnerabilities that may at some point affect the confidentiality, integrity or availability of information.

ON CHOOSING YESWEHACK OVER RIVAL PLATFORMS…

When we conducted the request for proposal for the Bug Bounty Program, we saw in YesWeHack some differentiators, such as their experience in Europe and Asia, the number of hunters registered on their platform, and the level of vulnerabilities reported, which could fit perfectly into our ecosystem.

In addition, other elements, such as the documentation we found on their portal and the closeness with the triage team, enabled us to establish a good alliance and a good team.

This allowed Bancolombia to engage in business relations with YesWeHack.

ON THE MOMENT THE PROGRAM’S PERFORMANCE ELICITED SURPRISE AT EXECUTIVE LEVEL…

In one of the meetings, one of our bosses asked for the current status of the Bug Bounty Program. When he publicly stated that we had about 50 hackers, we said: “No, boss – not 50, 250 of them!”

The look on his face said it all: “What do you mean, 250? How much have we grown in the past year?”

The truth is that it was a very relevant fact that shows the maturity that we have been able to achieve with the Bug Bounty Program.

ADVICE TO OTHER ORGANISATIONS LAUNCHING A BUG BOUNTY PROGRAM…

Start small, and as vulnerabilities are identified and the security posture of your organisation is evaluated, you can increase the number of sites, the number of hunters and – why not? – have attractive rewards and bounties, so that the hunters, the researchers, are always incentivised to participate in your program.

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

Thirty-one valid vulnerabilities across five heavily pentested applications was a strong first-year return for our latest Bug Bounty success story.

Especially so, given that – in line with best practice – the client in question started small before expanding gradually.

Speaking at our recent ‘Client Success Stories’ event in Singapore, the cybersecurity chief at the global retailer of luxury goods recounted how its private Bug Bounty Program (BBP) had materially “enhanced security and increased compliance” and potentially prevented costly breaches.

“The ROI is easy to justify,” read his presentation slides at the Asia-Pacific (APAC) event in October.

The speaker, whose organisation chose to remain anonymous, recalled how in the year before launching the BBP they “received quite a lot” of bug reports via multiple channels. Some ethical hackers asked for financial rewards, but there was no mechanism or policy for paying for vulnerabilities.

The lack of a formal disclosure mechanism was clearly undermining the reporting, prioritisation and remediation of vulnerabilities.

The organisation already did extensive pentesting – “but I wanted to discover what I did not know”, said the head of cybersecurity.

 was duly put to senior management. As well as discussing the organisation’s risk profile and current security testing program, a killer question was posed: if we don’t pay $2,000 for a critical vulnerability now, what will be the cost of malicious exploitation?

The daily attacks mounted by malicious hackers against the organisation put any security concerns about the activities of ethical hackers in perspective. “It’s a matter of 

” attacks will sometimes succeed, he reflected.

With a pilot duly sanctioned, the security team consulted the IT and finance teams, and CIO and CTO, about choosing a crowdsourced security testing platform.

Among other things, they wanted help with budgeting and to compensate for their lack of internal resource and Bug Bounty experience; a program that would dovetail effectively with their internal pentest team; and access to experienced, highly skilled bug hunters.

YesWeHack impressed with its strong use cases, “good feedback from the CTOs I spoke to” and promises of extensive customer support, especially during onboarding. “They did everything I asked for,” said the speaker, “which is why we decided to work with them as a strategic partner.”

’s Bug Bounty case study and several other 

, having an in-house triage team really sealed the deal.

The decision to use YesWeHack was soon vindicated. The program was “super easy to get started”, while the customer-centric support was singled out for praise. The customer success and triage teams did the “heavy lifting” – enabling the busy BBP manager to adopt a fairly hands-off approach to program management.

The manageably modest scope and bug hunter roster left enough time for experimenting and optimising of security testing.

The first critical bug surfaced after 16 days. As the process was gradually optimised, critical bounties were upped from $2,000 to $3,000 after four months, scopes were increased from three to five after six months, and hunter numbers rose from an initial 21 to 222 by the end of the first year.

 was launched in tandem to cover out-of-scope issues.

The first year saw 44 vulnerability reports submitted in total on the pentest-hardened scopes. Some 31 were deemed valid, with 25 warranting a payout. Three vulnerabilities were classified as critical, and a further six were designated as ‘high’ severity. Total rewards so far had reached $15,500, averaging $620.

A $3,000 maximum payout was earned through the discovery in a developer’s GitHub account of a file containing credentials that could have enabled the compromise of internal systems, recounted the speaker.

Another notable and lucrative find – netting the hunter a $2,000 bounty – was a firewall-bypassing remote code execution (RCE) on an API endpoint using Spring Expression Language SpEL.

Bug Bounty hunting can achieve results that are typically elusive to pentesters, said the speaker, because they operate with “no limitations” and offer “multiple testing methodologies from many, many people”.

The speaker also reasoned that, because bug hunters are not (unlike pentesters) whitelisted by firewalls, it forces them to be more creative in bypassing defences. Necessity is indeed the mother of invention.

Nevertheless, the client still saw the value in continuing with traditional pentesting engagements. YesWeHack’s 

The speaker suggested that a Bug Bounty Program’s success hinges on having sufficient platform support and securing internal buy-in by communicating about the Bug Bounty model in an easy-to-understand way. For all the promise of BBPs, he also advises other program managers to carefully manage the expectations of both internal and external stakeholders.

Nevertheless, in this case study expectations were comfortably surpassed. So much so, that the speaker said the ultimate goal was to launch a public program and open the scopes to the entire YesWeHack 

Ready to enhance your company's security and prevent costly breaches? 

Connect with our experts today to launch a Bug Bounty Program

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer 

“If I’m a hunter, is this worth my time and effort?”

Rather than overreacting to the “modest” level of hunter activity at the outset of 

, who oversees the assurance and risk management specialist’s BBP, took the perspective of an ethical hacker – to impressive effect.

’ event in Stockholm, Medhurst told senior security professionals in the Nordic region how tweaks to the program description and more hunter invites – increased to 80 from an initial 20 – sparked a surge in reports.

And these were generally high-quality reports too, especially from a prolific hunter who the DNV team dubbed ‘Wreck it Ralph’. “How clear he was with his reports, the intelligence behind it”, and so many ways of escalating privileges, said Medhurst – “we laughed at his ingenuity”.

Customer Stories

‘Our businesses are reassured that we’re protecting their activities’: Les Mousquetaires CISO on leveraging live hacking events

‘No cheaper way of getting security testing’: financial services Bug Bounty success story

‘An efficient way to uncover vulnerabilities’: Doctolib's five years in Bug Bounty

‘Large amount of knowhow’: Why Thüringer Aufbaubank harnesses Bug Bounty to bolster customer trust

‘We opted for Bug Bounty for agility reasons’: European Community of Alsace CISO

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

‘Large amount of knowhow’: Why Thüringer Aufbaubank harnesses Bug Bounty to bolster customer trust

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

"Triage was world class": Bug Bounty success story from risk-management giant DNV

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

‘Start small – but start now!’ Inside Orange’s Bug Bounty journey with YesWeHack

Navigating the Waters of Bug Bounty: Lessons Learned from Brittany Ferries’ Live Event

Vulnerability Disclosure Policy as a first step of GfK’s crowdsourced security strategy

‘Start small – but start now!’ Inside Orange’s Bug Bounty journey with YesWeHack

Products

Researchers

Resources

Company

Follow us