 Program (BBP) has diversified the vulnerabilities unearthed in the financial institution’s systems and strengthened the skills of its offensive security team.

That’s according to Lucas Zuluaga Pérez, part of Bancolombia’s red team and manager of the banking group’s BBP at YesWeHack.

Founded in 1875, Bancolombia Group comprises banks in Colombia, Panama, Guatemala and El Salvador, supported by more than 30,000 employees and 80,000 suppliers. It also operates in the US and the Bahamas.

Translated from Spanish, the following interview sees Lucas discuss the group’s approach to expanding the BBP, the security and red team benefits of Bug Bounty, success factors in crowdsourced security, and the reasons for choosing YesWeHack.

LUCAS ZULUAGA PÉREZ ON THE LAUNCH AND EVOLUTION OF BANCOLOMBIA’S BBP…

Security is of the utmost importance to Bancolombia, as we ensure the protection of more than 16 million customers.

Bancolombia’s Bug Bounty Program started around October 2021. We started with a private program in which five of the best hackers in YesWeHack participated. We had a great evolution and within a year we managed to considerably expand the scope of our sites, going from two sites to 30 sites, from five hackers to 50.

Key factors such as the support of senior management, that our leaders consider cybersecurity as a key element, are very important.

Secondly, having the engagement of the technology teams, which positively welcome reports of some of the vulnerabilities we identify in the environment.

And thirdly, the involvement of the red team, to raise the bar every day with the support of the triage team and hunters of YesWeHack.

ON THE RED TEAMING AND SECURITY BENEFITS OF BUG BOUNTY…

With our Bug Bounty Program, the red team’s skills have increased considerably. We have vulnerabilities in our checklist that we would not have considered before.

We have achieved great maturity and a great process, which allows us to quickly address vulnerabilities that may at some point affect the confidentiality, integrity or availability of information.

ON CHOOSING YESWEHACK OVER RIVAL PLATFORMS…

When we conducted the request for proposal for the Bug Bounty Program, we saw in YesWeHack some differentiators, such as their experience in Europe and Asia, the number of hunters registered on their platform, and the level of vulnerabilities reported, which could fit perfectly into our ecosystem.

In addition, other elements, such as the documentation we found on their portal and the closeness with the triage team, enabled us to establish a good alliance and a good team.

This allowed Bancolombia to engage in business relations with YesWeHack.

ON THE MOMENT THE PROGRAM’S PERFORMANCE ELICITED SURPRISE AT EXECUTIVE LEVEL…

In one of the meetings, one of our bosses asked for the current status of the Bug Bounty Program. When he publicly stated that we had about 50 hackers, we said: “No, boss – not 50, 250 of them!”

The look on his face said it all: “What do you mean, 250? How much have we grown in the past year?”

The truth is that it was a very relevant fact that shows the maturity that we have been able to achieve with the Bug Bounty Program.

ADVICE TO OTHER ORGANISATIONS LAUNCHING A BUG BOUNTY PROGRAM…

Start small, and as vulnerabilities are identified and the security posture of your organisation is evaluated, you can increase the number of sites, the number of hunters and – why not? – have attractive rewards and bounties, so that the hunters, the researchers, are always incentivised to participate in your program.

Want to learn more about the YesWeHack Bug Bounty & Vulnerability Management Platform? Click the button below to schedule a demo with one of our experts.

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

Thirty-one valid vulnerabilities across five heavily pentested applications was a strong first-year return for our latest Bug Bounty success story.

Especially so, given that – in line with best practice – the client in question started small before expanding gradually.

Speaking at our recent ‘Client Success Stories’ event in Singapore, the cybersecurity chief at the global retailer of luxury goods recounted how its private Bug Bounty Program (BBP) had materially “enhanced security and increased compliance” and potentially prevented costly breaches.

“The ROI is easy to justify,” read his presentation slides at the Asia-Pacific (APAC) event in October.

The speaker, whose organisation chose to remain anonymous, recalled how in the year before launching the BBP they “received quite a lot” of bug reports via multiple channels. Some ethical hackers asked for financial rewards, but there was no mechanism or policy for paying for vulnerabilities.

The lack of a formal disclosure mechanism was clearly undermining the reporting, prioritisation and remediation of vulnerabilities.

The organisation already did extensive pentesting – “but I wanted to discover what I did not know”, said the head of cybersecurity.

 was duly put to senior management. As well as discussing the organisation’s risk profile and current security testing program, a killer question was posed: if we don’t pay $2,000 for a critical vulnerability now, what will be the cost of malicious exploitation?

The daily attacks mounted by malicious hackers against the organisation put any security concerns about the activities of ethical hackers in perspective. “It’s a matter of 

” attacks will sometimes succeed, he reflected.

With a pilot duly sanctioned, the security team consulted the IT and finance teams, and CIO and CTO, about choosing a crowdsourced security testing platform.

Among other things, they wanted help with budgeting and to compensate for their lack of internal resource and Bug Bounty experience; a program that would dovetail effectively with their internal pentest team; and access to experienced, highly skilled bug hunters.

YesWeHack impressed with its strong use cases, “good feedback from the CTOs I spoke to” and promises of extensive customer support, especially during onboarding. “They did everything I asked for,” said the speaker, “which is why we decided to work with them as a strategic partner.”

’s Bug Bounty case study and several other 

, having an in-house triage team really sealed the deal.

The decision to use YesWeHack was soon vindicated. The program was “super easy to get started”, while the customer-centric support was singled out for praise. The customer success and triage teams did the “heavy lifting” – enabling the busy BBP manager to adopt a fairly hands-off approach to program management.

The manageably modest scope and bug hunter roster left enough time for experimenting and optimising of security testing.

The first critical bug surfaced after 16 days. As the process was gradually optimised, critical bounties were upped from $2,000 to $3,000 after four months, scopes were increased from three to five after six months, and hunter numbers rose from an initial 21 to 222 by the end of the first year.

 was launched in tandem to cover out-of-scope issues.

The first year saw 44 vulnerability reports submitted in total on the pentest-hardened scopes. Some 31 were deemed valid, with 25 warranting a payout. Three vulnerabilities were classified as critical, and a further six were designated as ‘high’ severity. Total rewards so far had reached $15,500, averaging $620.

A $3,000 maximum payout was earned through the discovery in a developer’s GitHub account of a file containing credentials that could have enabled the compromise of internal systems, recounted the speaker.

Another notable and lucrative find – netting the hunter a $2,000 bounty – was a firewall-bypassing remote code execution (RCE) on an API endpoint using Spring Expression Language SpEL.

Bug Bounty hunting can achieve results that are typically elusive to pentesters, said the speaker, because they operate with “no limitations” and offer “multiple testing methodologies from many, many people”.

The speaker also reasoned that, because bug hunters are not (unlike pentesters) whitelisted by firewalls, it forces them to be more creative in bypassing defences. Necessity is indeed the mother of invention.

Nevertheless, the client still saw the value in continuing with traditional pentesting engagements. YesWeHack’s 

The speaker suggested that a Bug Bounty Program’s success hinges on having sufficient platform support and securing internal buy-in by communicating about the Bug Bounty model in an easy-to-understand way. For all the promise of BBPs, he also advises other program managers to carefully manage the expectations of both internal and external stakeholders.

Nevertheless, in this case study expectations were comfortably surpassed. So much so, that the speaker said the ultimate goal was to launch a public program and open the scopes to the entire YesWeHack 

Ready to enhance your company's security and prevent costly breaches? 

Connect with our experts today to launch a Bug Bounty Program

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer 

“If I’m a hunter, is this worth my time and effort?”

Rather than overreacting to the “modest” level of hunter activity at the outset of 

, who oversees the assurance and risk management specialist’s BBP, took the perspective of an ethical hacker – to impressive effect.

’ event in Stockholm, Medhurst told senior security professionals in the Nordic region how tweaks to the program description and more hunter invites – increased to 80 from an initial 20 – sparked a surge in reports.

And these were generally high-quality reports too, especially from a prolific hunter who the DNV team dubbed ‘Wreck it Ralph’. “How clear he was with his reports, the intelligence behind it”, and so many ways of escalating privileges, said Medhurst – “we laughed at his ingenuity”.

At the time of speaking, Medhurst, DNV’s Head of Program Management and Testing, Digital Solutions, said the pilot program had generated 55 vulnerability reports, of which 24 warranted a payout – collectively totalling €9,000. A great return on investment, Medhurst concluded.

After a modest beginning, these numbers had been achieved within 18 months of launch, which in turn came only six months after Medhurst became aware (via a pentester) of Bug Bounty. “The concept resonated with me immediately,” he recalled.

Before committing to YesWeHack, concerns about budgetary constraints and securing sign-off from decision-makers were soon allayed by the enthusiasm of DNV’s development team and assurances from YesWeHack – which we subsequently lived up to.

For instance, YesWeHack provided “a lot of handholding and guidance” on assessing scopes and suggested they weren’t attractive enough when incoming bugs began as a trickle.

When reports really started to flow, the triage team worked efficiently to avoid blockages and help developers prioritise the most critical vulnerabilities. “I think it’s world class,” Medhurst said of the in-house triage service. “We’ve shown our technical support teams for software products how they deal with things. We’ve learned a lot – for free.”

Guided by YesWeHack, the vulnerability management process has become increasingly streamlined too, added Medhurst.

DNV, a global brand headquartered in Norway, has derived benefits beyond each remediation’s closure of a single attack vector. They sometimes create automated tests for specific vulnerabilities, for instance.

Supported by an internal ‘security champions’ network, sharing hunters’ findings with developers and pentesters has also made development more secure and improved security testing – in effect creating a positive “feedback loop”, noted Medhurst.

DNV, which is also the world’s largest classification society for the maritime sector, is currently working on strengthening this feedback loop, adding two programs to the existing three and introducing maturity KPIs.

Success factors for the pilot were getting “funding principles in place straightaway, getting buy-in from developers and senior management, and having a strong relationship with the CSM and triage team”, said Medhurst.

In case your program does start strongly – and DNV’s latest BBP began with eight reports on day one – Medhurst advised attendees to “be ready to respond” when you go live.

He also suggested there was more to attracting hunters than offering enticing scopes and bounty grids. “Relationships matter,” said Medhurst, with speed of response, clarity of communication and fairness of rewards pivotal to building trust.

Finally, as we pointed out in a recent article that 

, budgetary constraints needn’t be a dealbreaker when considering whether to launch a BBP. “Don’t worry about running out of budget,” advised Medhurst. “Go with whatever budget you’re willing to invest and you’ll be pleasantly surprised!”

Explore the benefits of a Bug Bounty program for your organisation with our team of experts! 

Customer Stories

‘The red team’s security skills have increased considerably’: Bug Bounty at Bancolombia

'ROI is easy to justify’: Bug Bounty success story from a luxury goods retailer

"Triage was world class": Bug Bounty success story from risk-management giant DNV

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

‘Start small – but start now!’ Inside Orange’s Bug Bounty journey with YesWeHack

Navigating the Waters of Bug Bounty: Lessons Learned from Brittany Ferries’ Live Event

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

A sneak peek into Open-Xchange’s public Bug Bounty programs

Vulnerability Disclosure Policy as a first step of GfK’s crowdsourced security strategy

Walk me through Open My Heart – Live Bug Bounty event with Lazada

A sneak peek into Open-Xchange’s public Bug Bounty programs

Back to Decathlon’s Live Bug Bounty

How a world-renowned luxury brand implemented a crowdsourced security strategy

How cybersecurity players gain customer trust with Bug Bounty

Back to Decathlon’s Live Bug Bounty

Products

Researchers

Resources

Company

Follow us