Thirty-one valid vulnerabilities across five heavily pentested applications was a strong first-year return for our latest Bug Bounty success story.

Especially so, given that – in line with best practice – the client in question started small before expanding gradually.

Speaking at our recent ‘Client Success Stories’ event in Singapore, the cybersecurity chief at the global retailer of luxury goods recounted how its private Bug Bounty Program (BBP) had materially “enhanced security and increased compliance” and potentially prevented costly breaches.

“The ROI is easy to justify,” read his presentation slides at the Asia-Pacific (APAC) event in October.

The speaker, whose organisation chose to remain anonymous, recalled how in the year before launching the BBP they “received quite a lot” of bug reports via multiple channels. Some ethical hackers asked for financial rewards, but there was no mechanism or policy for paying for vulnerabilities.

The lack of a formal disclosure mechanism was clearly undermining the reporting, prioritisation and remediation of vulnerabilities.

The organisation already did extensive pentesting – “but I wanted to discover what I did not know”, said the head of cybersecurity.

 was duly put to senior management. As well as discussing the organisation’s risk profile and current security testing program, a killer question was posed: if we don’t pay $2,000 for a critical vulnerability now, what will be the cost of malicious exploitation?

The daily attacks mounted by malicious hackers against the organisation put any security concerns about the activities of ethical hackers in perspective. “It’s a matter of 

” attacks will sometimes succeed, he reflected.

With a pilot duly sanctioned, the security team consulted the IT and finance teams, and CIO and CTO, about choosing a crowdsourced security testing platform.

Among other things, they wanted help with budgeting and to compensate for their lack of internal resource and Bug Bounty experience; a program that would dovetail effectively with their internal pentest team; and access to experienced, highly skilled bug hunters.

YesWeHack impressed with its strong use cases, “good feedback from the CTOs I spoke to” and promises of extensive customer support, especially during onboarding. “They did everything I asked for,” said the speaker, “which is why we decided to work with them as a strategic partner.”

’s Bug Bounty case study and several other 

, having an in-house triage team really sealed the deal.

The decision to use YesWeHack was soon vindicated. The program was “super easy to get started”, while the customer-centric support was singled out for praise. The customer success and triage teams did the “heavy lifting” – enabling the busy BBP manager to adopt a fairly hands-off approach to program management.

The manageably modest scope and bug hunter roster left enough time for experimenting and optimising of security testing.

The first critical bug surfaced after 16 days. As the process was gradually optimised, critical bounties were upped from $2,000 to $3,000 after four months, scopes were increased from three to five after six months, and hunter numbers rose from an initial 21 to 222 by the end of the first year.

 was launched in tandem to cover out-of-scope issues.

The first year saw 44 vulnerability reports submitted in total on the pentest-hardened scopes. Some 31 were deemed valid, with 25 warranting a payout. Three vulnerabilities were classified as critical, and a further six were designated as ‘high’ severity. Total rewards so far had reached $15,500, averaging $620.

A $3,000 maximum payout was earned through the discovery in a developer’s GitHub account of a file containing credentials that could have enabled the compromise of internal systems, recounted the speaker.

Another notable and lucrative find – netting the hunter a $2,000 bounty – was a firewall-bypassing remote code execution (RCE) on an API endpoint using Spring Expression Language SpEL.

Bug Bounty hunting can achieve results that are typically elusive to pentesters, said the speaker, because they operate with “no limitations” and offer “multiple testing methodologies from many, many people”.

The speaker also reasoned that, because bug hunters are not (unlike pentesters) whitelisted by firewalls, it forces them to be more creative in bypassing defences. Necessity is indeed the mother of invention.

Nevertheless, the client still saw the value in continuing with traditional pentesting engagements. YesWeHack’s 

The speaker suggested that a Bug Bounty Program’s success hinges on having sufficient platform support and securing internal buy-in by communicating about the Bug Bounty model in an easy-to-understand way. For all the promise of BBPs, he also advises other program managers to carefully manage the expectations of both internal and external stakeholders.

Nevertheless, in this case study expectations were comfortably surpassed. So much so, that the speaker said the ultimate goal was to launch a public program and open the scopes to the entire YesWeHack 

Ready to enhance your company's security and prevent costly breaches? 

Connect with our experts today to launch a Bug Bounty Program

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer 

“If I’m a hunter, is this worth my time and effort?”

Rather than overreacting to the “modest” level of hunter activity at the outset of 

, who oversees the assurance and risk management specialist’s BBP, took the perspective of an ethical hacker – to impressive effect.

’ event in Stockholm, Medhurst told senior security professionals in the Nordic region how tweaks to the program description and more hunter invites – increased to 80 from an initial 20 – sparked a surge in reports.

And these were generally high-quality reports too, especially from a prolific hunter who the DNV team dubbed ‘Wreck it Ralph’. “How clear he was with his reports, the intelligence behind it”, and so many ways of escalating privileges, said Medhurst – “we laughed at his ingenuity”.

At the time of speaking, Medhurst, DNV’s Head of Program Management and Testing, Digital Solutions, said the pilot program had generated 55 vulnerability reports, of which 24 warranted a payout – collectively totalling €9,000. A great return on investment, Medhurst concluded.

After a modest beginning, these numbers had been achieved within 18 months of launch, which in turn came only six months after Medhurst became aware (via a pentester) of Bug Bounty. “The concept resonated with me immediately,” he recalled.

Before committing to YesWeHack, concerns about budgetary constraints and securing sign-off from decision-makers were soon allayed by the enthusiasm of DNV’s development team and assurances from YesWeHack – which we subsequently lived up to.

For instance, YesWeHack provided “a lot of handholding and guidance” on assessing scopes and suggested they weren’t attractive enough when incoming bugs began as a trickle.

When reports really started to flow, the triage team worked efficiently to avoid blockages and help developers prioritise the most critical vulnerabilities. “I think it’s world class,” Medhurst said of the in-house triage service. “We’ve shown our technical support teams for software products how they deal with things. We’ve learned a lot – for free.”

Guided by YesWeHack, the vulnerability management process has become increasingly streamlined too, added Medhurst.

DNV, a global brand headquartered in Norway, has derived benefits beyond each remediation’s closure of a single attack vector. They sometimes create automated tests for specific vulnerabilities, for instance.

Supported by an internal ‘security champions’ network, sharing hunters’ findings with developers and pentesters has also made development more secure and improved security testing – in effect creating a positive “feedback loop”, noted Medhurst.

DNV, which is also the world’s largest classification society for the maritime sector, is currently working on strengthening this feedback loop, adding two programs to the existing three and introducing maturity KPIs.

Success factors for the pilot were getting “funding principles in place straightaway, getting buy-in from developers and senior management, and having a strong relationship with the CSM and triage team”, said Medhurst.

In case your program does start strongly – and DNV’s latest BBP began with eight reports on day one – Medhurst advised attendees to “be ready to respond” when you go live.

He also suggested there was more to attracting hunters than offering enticing scopes and bounty grids. “Relationships matter,” said Medhurst, with speed of response, clarity of communication and fairness of rewards pivotal to building trust.

Finally, as we pointed out in a recent article that 

, budgetary constraints needn’t be a dealbreaker when considering whether to launch a BBP. “Don’t worry about running out of budget,” advised Medhurst. “Go with whatever budget you’re willing to invest and you’ll be pleasantly surprised!”

Explore the benefits of a Bug Bounty program for your organisation with our team of experts! 

Quantity AND quality

'A lot of handholding'

Positive feedback loop

"Triage was world class": Bug Bounty success story from risk-management giant DNV 

Loïc Deleforterie on how Withings strengthens its cybersecurity posture…

Customer Stories

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

"Triage was world class": Bug Bounty success story from risk-management giant DNV

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

‘Start small – but start now!’ Inside Orange’s Bug Bounty journey with YesWeHack

Navigating the Waters of Bug Bounty: Lessons Learned from Brittany Ferries’ Live Event

A sneak peek into Open-Xchange’s public Bug Bounty programs

‘Start small – but start now!’ Inside Orange’s Bug Bounty journey with YesWeHack

Vulnerability Disclosure Policy as a first step of GfK’s crowdsourced security strategy

Walk me through Open My Heart – Live Bug Bounty event with Lazada

Back to Decathlon’s Live Bug Bounty

Vulnerability Disclosure Policy as a first step of GfK’s crowdsourced security strategy

How a world-renowned luxury brand implemented a crowdsourced security strategy

How cybersecurity players gain customer trust with Bug Bounty

Boosting E-Commerce Security: PrestaShop's Success with YesWeHack's Public Bug Bounty Program

How a world-renowned luxury brand implemented a crowdsourced security strategy

Products

Researchers

Resources

Company

Follow us