I am the Group CISO of a multinational insurance firm. My team’s mission is to set up a “cyber shield” for the Group and all its subsidiaries, by offering new security services to our subsidiaries – including 

Why did you decide to launch a Bug Bounty program?

I discovered Bug Bounty following discussions with CISOs from major financial institutions. Having a recommendation from organizations like these with demanding security needs was a key factor in my decision. We started small and the results were conclusive, so we gradually opened several Bug Bounty programs. It’s a new approach, which implies a learning curve.

What value does Bug Bounty offer compared with traditional cybersecurity solutions, such as penetration testing?

Bug Bounty offers the guarantee of continuous checking

 – and not just punctual testing, which is what you get with ‘traditional’ penetration testing. If I run a two-week penetra­tion test every year, it implies that we remain ‘unprotected’ for the other 50 weeks, which is no longer acceptable. As a comple­ment, automated tests can also be useful, but are not sophisticated enough. With Bug Bounty, I have researchers working permanently on my scopes.

This continuity is essential, especially when you have frequent deliveries in an increasingly agile development context.

Bug Bounty also allows us to be more flexible.

 For example, I need to test environments which are still in development, or in validation phase, before going into production. Again, this is challenging to do consistently using traditional penetration testing. The 

 platform enables us to adjust the rules for each program, including the bounty grid, accor­ding to the specific phase of each project.

I would also mention responsiveness and availability: it is increasingly difficult, if not impossible, to find skilled penetration testers at short notice, when you need them most, i.e. when you have a new release. 

With Bug Bounty, you just ‘press a button’, and it starts: you can run tests at any time and get confir­mation of remediation in the process very quickly.

Finally, we have been amazed by the diversity of reported vulne­rabilities. We uncover more ‘real-life’ scenarios: for example, researchers have found ‘bits’ of vulnerabilities whose combination made unprecedented attacks possible. Vulnerabilities like these were not addressed until then, as they were not brought to our attention. We are now able to correct them in depth.

Bug Bounty really puts yourself in the head of a hacker.

Does Bug Bounty mean the end of penetration testing, or are the two complementary?

For me it is complementary. The reality however is that there are too few audit firms to keep pace with the number of testing that must be carried out. Hence the key value of Bug Bounty. Moreover, 

penetration testing shows various limitations and constraints: they must be scheduled in advance, with a start and end date, and they demand project manage­ment.

 This synchronization is a real headache, especially with agile developments. If a delivery is two days late on a given scope, the pentesters are no longer available, which poses a real stewardship problem.

What I also like about Bug Bounty is the 

. With traditional penetration testing, you almost never receive a remediation check. Following an audit, if a developer tells me, ‘I fixed the bug’, I only have his word. Bug Bounty allows me to delegate this control to the researcher, who is entirely objective.

This enables me to fix a vulnerability and validate the correction in the process – unlike a traditional cross-verification, which I should run once all my vulnerabilities have been addressed. Now, when a serious or critical vulnerability is discovered, I know it is fixed quickly, and I can sleep soundly! 

Have you seen any other changes since you started the Bug Bounty program?

There is certainly more awareness now, but the major point I’m observing is the 

acceleration of the patching rate / frequency

. Our developers fix much faster. Responding to researchers, rewarding them, closing reports, etc. require developers to react more qui­ckly. This, in turn, leads to much shorter time-to-remedia­tion.

As mentioned earlier, we have implemented speci­fic programs dedicated to test environments, before their release. We therefore detect and fix vulnerabi­lities further upstream of projects. Firstly, this allows us to train our developers ‘on the fly’; second, it accelerates our deliveries since there are fewer patches to manage in the validation and release phases.

We became more responsive, in the interests of both developers and business.

Our first step is to gradually expand the Group’s assets under Bug Bounty. And on these scopes, to gradually move from black box to grey box.

The second step, where we are now, is to make the ser­vice available to our subsidiaries worldwide. We want to offer them something different and forward-thinking, allowing them to renew their vision of cybersecurity and audits.

If you wish to learn more regarding our platform and service, please do not hesitate to 

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

Bug Bounty’s strengths compared to penetration testing

organises bug bounty programmes to disclose and correct vulnerabilities before malicious tools get in. A year after joining the Paris Call, we look back at how have we contributed to furthering peace in the cyberspace.

On 12 November 2018, hundreds of partners gathered to launch the 

Paris Call for Trust and Security in the Cyberspace

. The Paris Peace Forum kicked off on 12 November 2019, to continue building upon the Call and showcase peaceful global governance from the world over.

YesWeHack is Europe’s bug bounty leader and a first-hour Paris Call signatory. 

 bridges the gap between discoverers and vendors, thus structuring a Coordinated Vulnerability Disclosure (CVD) process and clarifying benefits for all. Bug bounty is , therefore, an accessible legal and value-generating framework preventing state and non-state actors from stockpiling vulnerabilities.

Furthermore, by enabling actual CVD, bug bounty is a viable economic alternative to vulnerability-oriented black markets. Our active contribution to decreasing the proliferation of malicious uses of digital products is thus twofold.

Protecting NGOs and civic-tech initiatives

YesWeHack promotes proactive vulnerability disclosure by providing bug bounty programmes for NGOs and civic tech initiatives, forebears of democratic values. Those programmes unfold during the 

International Forum for Cybersecurity (FIC)

 held yearly in Lille, France. More specifically, YesWeHack provides the full operational power of its ethical hackers’ community and ensures that researchers get an adequate reward for reporting vulnerabilities to the participating NGOs.

For its 2019 edition, “le FIC”, as it is known amongst its French-speaking community, hosted a two-day long bug bounty we organised. 

 benefited from our hunters’ skills: HelloAsso, iRaiser, Croix Rouge, CapCollectif, OpenStreetMap and Destination Rennes. Its 2020 edition will witness again YesWeHack’s recurrent effort to improve the security of NGOs’ infrastructures. The 2020 edition is coming up end of January, and we are currently convening NGOs to join (so, watch this space for more!).

Coordinated Vulnerability Disclosure, a sustainable way to root malware out

A CVD process aims at reducing risk and ultimately mitigating the potential damage caused by a security vulnerability. Even though patch deployment or report publication are indicators of efficient cooperation between vulnerability discoverers and the affected service editors, the CVD process cannot be reduced to any of those events alone.

Instead, Coordinated Vulnerability Disclosure is the process of collecting information from security researchers, coordinating the sharing of that information amongst concerned parties, and subsequently disclosing the existence of vulnerabilities and their mitigation measures to various stakeholders, including the general public.

Bug Bounty ensures and fosters such coordination. 

 thus remains true to its values and commitment to the 

 by actively participating in establishing a 

. By consistently promoting CVD as a means to significantly increase the likelihood of success of any vulnerability response process, YesWeHack thus aims at bringing about a meaningful alternative to malware proliferation.

Fighting malware at the roots

EDU, the world’s first Bug Bounty education platform dedicated to cybersecurity training.

“Cybersecurity is both an economic and societal issue, and this sector suffers from an imbalance between the state of the threat and the market’s defence capabilities,”

 commented Guillaume Vassault-Houlière, co-founder of YesWeHack. He adds: “To remedy this situation, the capacity of public and private actors to detect and correct shortcomings in a professional and ethical manner must be rapidly strengthened – This requires specialized profiles training and better information sharing. »

YesWeHack EDU is aimed at cybersecurity curriculums in schools and universities and more broadly at all European IT curriculums (e.g. development, big data, etc.) that want to accelerate the sharing of quality datasets.

YesWeHack EDU’s educational approach first encourages emulation through gamification and the involvement of each student in securing their institution. Above all, it opens up prospects for future developers towards promising specializations such as DevSecOps, Data Scientist, Security Analyst, etc. Finally, YesWeHack EDU facilitates the implementation of collaborative projects and cross-functional initiatives between academic institutions and the private sector.

“According to a study published by Gartner, 50% of companies worldwide are expected to use Bug Bounty by 2022, compared to 5% today. We are launching YesWeHack EDU to address the talent shortage faced by the cyber security industry. This program provides the academic community with a sophisticated training platform to professionalize vulnerability management and to train for new cyber jobs, such as DevSecOps, Big Data, SOAR, etc. ”

 explains Guillaume Vassault-Houlière, CEO & Co-founder of YesWeHack.

, who will provide YesWeHack EDU to schools and universities globally.

Available throughout Europe, the YesWeHack EDU platform is aligned with the 

 consortium initiative, of which YesWeHack is a founding member, that aims to strengthen both innovation and research in cybersecurity at the European level.

YesWeHack EDU, the world’s first Bug Bounty educational platform

, we talked with Kevin Dubourg, Bug Bounty Program Manager at

. Yousign provides electronic signature (eSignature) services and aims at protecting both its services and users.

Kevin Dubourg, Bug Bounty Program Manager, Yousign:

There are a number of platforms out there, mostly U.S.-based. We requested certain guarantees from the hunters invited to our programs, and 

 offered those guarantees and the confidence to launch a bug bounty program.

What value does bug bounty bring compared with traditional cybersecurity solutions, such as penetration testing?

It offers diversity in terms of perspectives and skills. Every hunter has his own approach, his way of doing the thing: a unique approach that makes a particular attack. This is different from penetration testing, and it provides a much stiffer challenge. With bug bounty, we left the penetration testing world behind, in order to benefit from 10, 20, or 30 different views and really challenge our teams.

It is also interesting that not all hunters are necessarily ‘cybersecurity professionals’. The entire ecosystem is represented here, and we can pick up individuals based on their nationality, skill set, and ranking on the platform.

However, the primary value of bug bounty is the continuity, recurrence, and ‘annualisation’ of the tests: as soon as we release a new version, we integrate the existing program and receive immediate feedback on the security of the new version. We don’t need to wait a year for the next penetration test to check on the security of our update. This approach is embedded within our project lifecycle.

Our scope evolves constantly, and bugs evolve at the same time. Security flaws turn up every day, not just once a year, and bug bounty enables us to detect and fix these in time. It helps us monitor our services almost constantly, which is very reassuring. It would also be impossible financially to do a penetration test on each delivery, although we would need to.

The return on investment is compelling too. Yousign carries out one penetration test each year. And this is quite expensive, compared to a bug bounty program. It’s a bit crazy when you think about it: they cost more or less the same, but bug bounty covers an entire year, whereas an audit only lasts a week.

Do bug bounty programs spell the end for penetration testing? Or will they remain complementary?

For Yousign, the two will continue to be complementary. It could mean the end of penetration testing in some industries, but not in ours: as a trusted third-party provider we are required to carry out regular audits. In a less stringent regulatory environment, I would probably consider only using bug bounty.

However, bug bounty is very important for our sales and marketing: it’s clearly a differentiator to large prospect accounts. We mention it systematically in our request for proposal submissions as it’s seen by the market as a quality hallmark.

How do the results compare between penetration testing and bug bounty?

I’ve had the same reports from both, but there are many more reports from bug bounty than from penetration testing. Moreover, after we have carried out a penetration test on a given scope, running bug bounty always brings additional vulnerabilities.

One of the problems with penetration testing is that results mainly depend on the expertise of the penetration tester. Our last penetration test showed up some relevant things, but when you compare the results with those of the bug bounty program we launched afterwards, there was no comparison.

Have you seen any changes among your teams since using bug bounty?

Yes, definitely. I initially managed the programs on my own, but soon afterwards involved the development teams so that they could manage processes like replying directly to hunters and fixing bugs. Most reports concerned the applications team, so they had to face up to reality and take things forward.

What’s more, we quickly saw that their interactions with the hunters affected their delivery and working methods: not only do they integrate security into their development work more effectively, but they also started to ‘think’ differently, always keeping in mind the security aspects. You could say that they are not only delivering for clients, but for the hunters too!

The next step is to extend the use of bug bounty. Besides the current programs in our production and ‘staging’ environments, we want to embed bug bounty within our CI/CD workflow to add to our battery of functional and unit tests. This should make us even more agile. Bug bounty is certainly a key component of our CI/CD approach.

In time, we may move to a public program.

If you want more informations about Bug Bounty &

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

 (VDP), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Bug bounty is significantly more cost-effective than penetration testing

 program owing to our short delivery cycles. In the past, we conducted ‘traditional’ penetration testing once a year. However, we have a lot of changes every month to our scopes and could not wait 12 months for the next audit. 

 enables us to carry out continuous checks, for each release, update, and new delivery.

It’s the return on investment. The opportunity to pay based on results is very important for a small organisation like ours with limited budgets. With traditional penetration testing, we have to pay even if nothing is found. Our last penetration test cost around €8,000 and no major vulnerabilities were reported.

After two months running this latest program, dozens of security flaws were reported, including some critical vulnerabilities never reported using previous audits. This was achieved with a reward budget approximately half that of a single audit.

I would also mention diversity: penetration testing is too ‘academic’ and doesn’t meet our real needs. Most penetration testers run tools and tick boxes. As a result, too many vulnerabilities are left undiscovered. The diversity of hunters and their range of skillsets make a big difference.

Lastly, the model is very flexible. Take scope evolution, for example. With a traditional penetration test, a scope is defined in advance: if you want to change anything, you have to pay again for another audit. Now, with bug bounty, we can fine-tune the program over time, adding products or URLs to the scope. This is key to us.

 we have to run penetration tests to meet regulatory requirements. So, we have no choice but to continue with traditional audits. However, if we were in an industry not subject to such regulations, there’s no question we would only use a bug bounty platform. 

This year, we will cite bug bounty in our certification process, making the case that bug bounty is equivalent to intrusion testing – and actually more effective.

We will expand the program to our APIs and mobile apps.

Is there anything else you’d like to mention?

Bug bounty is also a key selling point for our sales team, especially with large accounts that require stringent security guarantees. Bug bounty is now automatically included in our sales presentations to large accounts.

Bug bounty agility is key for small organisations

Hey, we just wanted to greet the talented hacker community using our plateform and reward them for their skill.

Some of you yet received them in a postal parcel, please bear with us while they travel around the globe 😉

staying on top of the leaderboard for more than 3 months

having submitted a valid report each month for 12 months

validating 10 reports on the same program

staying on the leaderboard’s top 5 for 12 months

staying on the leaderboard’s top 5 for 6 months

staying on the leaderboard’s top 5 for 3 months

Next batch is in 3 months, KEEP HACKING! 😉

We hope those humble rewards will please you, get in touch with a private message on our 

 for any follow-up needed on this matter.

We have a small message for the hackers playing with us.

As technology moves forward, so do the threats to the tools we use every day. GitHub is one such tool, enabling software developers to collaborate within and across organisations. One way of keeping tabs on GitHub is gitGraber which detects sensitive data available on the platform.

Nowadays, the security tactics of companies have evolved with emerging technologies such as Cloud and the DevOps culture, moving from perimeter security of private infrastructures to a model focused on the data and identity management. With the usage of cloud-hosted machines or SaaS applications, it becomes more than critical to ensure that the data hosted and managed by the company or its contractors are appropriately secured and monitored.

 is one of the most famous as it allows a quick and effective way for teams to work together on software, allowing developers to host their projects.

The drawback of such success is that companies do not necessarily own the right tools to technically check that they are not exposed. Exposure can come from an employee sending code with secrets inside by mistake, an employee about to leave and trying to get his revenge by leaking data or a contractor without any security concern and pushing code by convenience and to having a kind of backup on GitHub.

We originally developed gitGraber in the context of a 

. However, with time and improvements to the code, gitGraber has become a real assistant for Github monitoring based on specific keywords (e.g. company brand name). Moreover, gitGraber recognises common patterns, thus helping identify code that contains this type of data and assisting SOC teams to react and remediate quickly when an issue is detected.

The story behind the tool began in 2019. A friend (and bug hunter) received an invitation to participate in a private and not-so-typical 

. The goal was to find specific and valid API keys for the target online service. For each of these keys that were not previously reported, the hunter receives a bounty.

By definition, every hunter is aware that GitHub is a gold mine to find sensitive data. From this idea, we tried to imagine what was the best way to find these API keys and how to be the first to submit it to the program. Many excellent tools already exist to search on GitHub; these tools are, however, designed to search for specific items (e.g. ‘repository,’ ‘user’) or the history. However, this was not compliant with our need to be fast and accurate; this how we decided to start this project.

Security-enhancing features from the start

As soon as we started, we already had a roadmap with essential features to develop:

Define the best patterns that allow the matching of sensitive data (like 

Create a regular expression to find these keys in the different public repositories;

Automate the whole process, from finding the keys to programme reporting;

Check each set of keys to see if they have been revoked;

Avoid sending reports in case our tool had already scanned the repository and previously reported the keys.

The starting point was to understand the API of GitHub and how we could optimise its usage. From the documentation, we found that the GitHub API allows to directly check last indexed commit files, which was the perfect thing for our project.

We spent many hours to develop the tool and ensure that it was working correctly. In the end, we succeeded, and the automation flow was working as expected. Indeed, our tool was able to find the pairs of keys, validate them and create a report with the URL of the concerned GitHub repository.

It was awe-inspiring. Using gitGraber allowed for some of our reports to be submitted on the Bug Bounty platform only 30 seconds after GitHub indexed the commit. It was an excellent experience (shared with Nico and Gwen, thanks guys).

Seven months later, I decided to go back on my tool and to enhance it with other sensitive API keys of some of the most used providers (like AWS, Google, Slack, etc.). In the beginning, the tool worked with a specific Bug Bounty programme, so it was the moment to create a real standalone tool—

 is a friend and hunter with whom I collaborate many times for hunting. Collaboration is always fun in Bug Bounty, and you can be sure that you always learn something from others. After discussing with Remy about recognition, I talked to him about gitGraber. We agreed to work together to improve and enhance gitGraber to have the best tool to monitor GitHub in real-time (with specific features for bug hunters).

We tested all the services with our accounts to ensure that all the regular expressions were valid, thus avoiding as much as possible false positives and obtaining a high level of accuracy. This effort was difficult as GitHub hosts and indexes millions of repositories, and the tool would have been useless if the notifications excellent each time a sensitive word is detected.

Today, gitGraber can find more than 31 types of keys, and we used the program to do responsible disclosures of sensitive data leaks to major companies in the world (we do continuous monitoring on our side). The project has been open-sourced, and all contributions are welcome, be it because you have encountered any bugs or would like to add some exciting features to make it even more accurate and robust.

gitGraber: A tool to monitor GitHub in real-time to find sensitive data

YESWEHACK PROPHILE ON Ak1t4

Singapore Polytechnic (SP) successfully concluded its first ever bug-bounty event, held in partnership with YesWeHack, Europe’s leading bug bounty platform.

The first-ever held by the institution, the workshop brought more than 30 second- and third-year students from the Diploma in Infocomm Security Management back to school from their vacation as they learnt the ins and outs of bug-bounty hunting.

The workshop began with a bug bounty crash course led by BitK, a renowned French security researcher, bug hunter and Tech Ambassador at 

After equipping them with highly specialised bug hunting skills, he led students in a live experience to discover vulnerabilities and bugs in two selected applications.

During the bug bounty hunt, the Singapore Polytechnic students found a total of nine critical vulnerabilities in the applications, and by the end of the workshop, one group successfully penetrated and gained full admin rights to one of the applications – impressive for the first timers!

Bug bounty programs are a growing industry best practice, implemented by both public and private sector organizations across multiple sectors in Singapore. With cyber-attacks growing in scale and complexity, bug bounty has been recognised by the Singapore Government as an initiative to strengthen collaboration with the cybersecurity community to safeguard systems and digital services.

Life-long learning plays a significant role in advancing Singapore’s digital defence mandate. Equipping and exposing future talents to the latest technologies and practices creates a highly-skilled and sustainable workforce, which is especially vital in the area of cybersecurity, which is fast evolving.

This is well in line with Singapore Polytechnic’s ongoing efforts to keep the Diploma in Infocomm Security Management (DISM) course relevant with industry demands. Through the bug bounty event, students gain the technical know-how to detect bugs that are generally difficult to find using normal tools or techniques. Moreover, the out-of-curriculum activity complements the lessons taught in the course by allowing students to apply their existing skills and knowledge to real-life situations.

“The bug bounty workshop was well-received with our students. At Singapore Polytechnic, we aim to equip our students with the latest knowledge and skills. We are confident that the bug-bounty session gave our Infocomm Security Management students an insight into the cybersecurity industry and we’re exploring the inclusion of bug bounty programmes as part of the curriculum in the diploma course,” said Samson Yeow, Course Chair, Diploma of Infocomm Security Management, Singapore Polytechnic.

“Throughout my education at Singapore Polytechnic, I’ve had the opportunity to attend cybersecurity events like Capture-The-Flag competitions, which has allowed me to learn new things and further enhance my skills. Bug-bounty is very different, you’re trying to exploit a real and live application. This raises the difficulty level and requires me to pick up new skills and knowledge that cannot be found in a school environment,” said Jonathan Tan, a Year 3 Infocomm Security Management student.

“Singapore Polytechnic is setting a great example by taking a bold move to explore bug bounty as part of its course module. As one of the first tertiary institutions in Singapore to equip students with industry-level bug-bounty skills, we are excited to partner with them to explore ways to further enhance the learning experience for their future talents,” said Kevin Gallerin, Managing Director, Asia Pacific, YesWeHack. “Ethical hacking will increasingly become a larger focus as organisations tackle the cybersecurity threat, and training needs to start from young.”

Singapore Polytechnic partners with YesWeHack to hold its first-ever bug bounty event

Adopt a proactive security posture now

Harness the power of crowdsourced security to supercharge the discovery and remediation of vulnerabilities.

The YesWeHack Blog

Bug Bounty’s strengths compared to penetration testing

Fighting malware at the roots

YesWeHack EDU, the world’s first Bug Bounty educational platform

Bug Bounty’s strengths compared to penetration testing

Bug bounty is significantly more cost-effective than penetration testing

Bug bounty agility is key for small organisations

We have a small message for the hackers playing with us.

Bug bounty is significantly more cost-effective than penetration testing

gitGraber: A tool to monitor GitHub in real-time to find sensitive data

YESWEHACK PROPHILE ON Ak1t4

Singapore Polytechnic partners with YesWeHack to hold its first-ever bug bounty event

gitGraber: A tool to monitor GitHub in real-time to find sensitive data

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us