Every business needs a vulnerability disclosure policy. Thankfully, a growing number of organisations have one. Yet, those programs are not always a click away. Here’s to a unique plugin for both Chrome and Firefox, because making it easy to report issues need not be much work.

We are all too familiar with the quotidian data breach debacle that organisations go through more often than not. Besides, the initial notice frequently comes from an “anonymous report” or a disgruntled ethical hacker tweeting about your mishandling their repeated vulnerability notifications.

Those are situations we observe, yet many still struggle with preparing for them and the PR mess that inevitably follows. Shooting the messager, coming up with statements that look pretty much like they have been 

 for months, are all symptoms that you are ill-prepared to handle reports from the broader security community.

One robust approach to preventing stinky headlines and loss of trust from customers and partners is a vulnerability disclosure policy (VDP). That policy is a commitment that your organisation will receive, evaluate, and if need be, fix vulnerabilities notified by security folks external to the business.
A VDP also clarifies that you will not go after ethical hackers willing to help you improve the security of your service or product.

For a VDP to be efficient, it needs a few essential elements:

 clearly state what is what, identifying assets that your VDP covers.

 specifically directed at ethical hackers, this bit confirms your commitment to not prosecuting well-intentioned researchers who report a vulnerability. That part is particularly important as legal clarity across organisations and countries is extremely challenging to achieve.

: the precise mechanism your organisation has set up and, ideally, the details you would want to see added to a vulnerability report. The aim here is to make said report the most useful possible to the organisation’s technical team.

: anything you find relevant to smoothen communication.

You get it right: setting up such a policy implies you have thought out roles and responsibilities internally. Rather than a burden, setting a VDP and organising it is a way of developing talent, breaking silos and improving security altogether.

The better news: Showcasing your VDP has never been easier

You have a VDP; you need to feature it prominently on the organisation’s website so it is accessible to anyone who needs it. One way of doing so is creating a dedicated webpage, 

Another way is thanks to a simple tool that comes in handy, namely 

. You fill in the form, download the file and upload it to the business’s website. Your security.txt can contain 

. Indeed, a Bug Bounty programme is a vulnerability disclosure policy with a monetary reward system.

Whichever way you choose, you will want it to be known. Well, now, 

 . Whenever you browse the web, the plugin indicates whether a VDP exists. Because making it easy to report issues does not need to be much work!

Wanna go for a cool – and secure – carpooling service?


We have marked cases where a VDP exists without a security.txt as “room for improvement” to highlight that security.txt is a (draft, for now) standard. As such, it makes locating a VDP policy even easier since one needs no extra browsing to find the contact detail: the security.txt file is always present at www.mywebsite.tld/.well-known/security.txt

Showcasing your vulnerability disclosure policy to the world

Interview with Romain Lods, Head of Engineering,

Why did you decide to launch a Bug Bounty program?

About two years before we launched our Bug Bounty program, we started internal security audits on our code, which had never been done before at Deezer. These tests allowed us to make a first pass and fix some obvious vulnerabilities.

Then we became interested in Bug Bounty and 

The ease of use of the platform convinced us of launching a program.

 Following the launch, we very quickly received interesting vulnerabilities, everything went smoothly, so we decided to conti­nue and expand our perimeters.

What value does Bug Bounty offer compared to traditional cyber security solutions, such as penetration testing?

We typically perform an annual audit on several of our services, which lasts between one and three weeks. But this approach is expensive, focuses only on a few services, and over time, doesn’t really deliver interesting results. Bug Bounty gives us ongoing feedback throughout the year, on various scopes, and detects bugs very quickly.

In terms of ROI, Bug Bounty is also very interesting: we decide ourselves the reward we assign to each vulnerability.

Moreover, Bug Bounty guarantees us a diversity of testing skills. With penetration testing, each consul­tant is ultra-specialized, so we tend to guide him or her on what we want from the test.

With Bug Bounty, we were surprised by some researchers’ reports. They gave us results of original scenarios, which we had never seen before.

Finally, I appreciate the quality of the reports on the flaws reported through YesWeHack. You sense the researchers are really trying to offer a functional and reproducible POC, that we can easily retest.

The reports of our usual audits are generally quite accurate, 

but we also find the equivalent quality with Bug Bounty, when the researchers are good and ‘play the game’

. It’s very pleasant to receive reports illustrated with screenshots and videos, which greatly facilitates their understanding, validation, and also their communication to the teams concerned.

Check out Deezer’s public Bug Bounty program

Do you get help from researchers to analyze and fix the bugs received?

Yes, the researchers help us in the bug reproduction phase. In some cases, we ask them to check whether the vulnerability has been fixed. We also have a large team of developers in-house who can take care of this patch management.

Does Bug Bounty mean the end of penetration testing or are the two complementary?

For me the two remain absolutely complementary. 

Bug Bounty is a tool that goes further and deeper than the audit.

 We use penetration testing on new services, or on scopes where we already know there are problems.

Have you observed any changes in your teams since you began using Bug Bounty?

We clearly see an increased awareness of security. Bug Bounty reports helped us trigger some major security projects. 

Our cybersecurity vision and posture have evolved, and Bug Bounty is one of the drivers of this change

In terms of organization, we adapted our process to collect, sort, and validate reports. Then, based on the elements of each validated report, an internal ticket is created and assigned to the relevant team for processing with a varying degree of priority.

Do you consider Bug Bounty as a sign of confidence towards the market?

Using a public Bug Bounty program, we can demonstrate and highlight our concerns about security and transparency

. We also assume the fact of exposing ourselves to ‘controlled’ attacks, and to consider the valuable feedback from the researchers’ community.

At Deezer, we also have a team dedicated to fraud: indeed, artists and labels are paid according to the audience of the tracks. In order to guarantee their income, we have to protect them from any fraud relating to the platform. So, this is a crucial part of our cybersecurity strategy – and within the scope of our Bug Bounty program.

For the time being, we are pursuing our current strategy, regularly reviving the program when activity is declining. Generally speaking, the amount of feedback often depends on how visible Deezer is in the news. When we communicate more or launch campaigns, researchers are attracted to our program.

As a next step, we will consider an increase in bounties to encourage researchers to find more complex vulnerabilities.

Do you have any advice for CISOs or startups considering Bug Bounty?

As a general rule, it’s better to know your security flaws when you start a project, rather than wait until there are too many to deal with, after you’ve made (bad) choices of architectures.

When I see what our Bug Bounty program brought us, I think it would have been better if we had taken these insights into account as early as possible.

So, I would recommend not waiting too long to implement tools such as Bug Bounty

, in order to minimize the dependency on legacy systems, which are more complex to secure afterward.

If you want more information about Bug Bounty & YesWeHack,

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

Deezer protects their artists & users with a public Bug Bounty program

Alain Tiemblo, Web Security Lead Engineer,

We used to rely on ‘traditional’ audits, such as vulnerability scans, penetration testing, and code analysis, which exposed a lot of threats. Then, we began receiving messages from trolls on social networks, reporting potential vulnerabilities, without notice and without any detail.

We also received emails via customer support regarding vulnerabilities, with no precise or exploitable information. These people wanted payment before revealing more information, but in the absence of any ‘proven’ flaw, it was impossible for us to pay them.

The volume of these messages grew and grew, up to the point where we decided to take the Bug Bounty step, in order to channel this flow of noisy reports.

We compared different Bug Bounty platforms in Europe and 

mainly for regulatory and data sovereignty reasons.

was the number of active hunters on the platform

: it doesn’t make much sense to put money and energy into a Bug Bounty program if there isn’t a sufficient number of hunters to effectively search for vulne­rabilities.

Conversely, we integrated security.txt on our web­site to guide hunters to the YesWeHack platform, as Bug Bounty is a good way to encourage Coordinated Vulnerabilities Disclosure.

Can you describe the evolution of your program from the beginning?

We launched our private program in late 2017, with an important running-in phase. When we opened, we initially received many reports, then we gradually refined our program. For example, we defined our scopes more clearly, including the type of vulnerabilities we wanted to see reported.

From the outset, we received ‘real’ and potential critical vulnerabilities, which convinced us of the relevance of the model and the effectiveness of the platform.

After one week, the number of reports began to decrease, but the ones that came up were more and more interesting. This is because the hunters ‘got into’ our product and produced reports that were really specific to our business.

After the first month, it became quieter, so we invited new hunters onto the program to introduce fresh eyes and other skills on specific aspects of our program.

The private program also allowed our teams to learn how to manage reports, classify and qualify them, and adjust the program rules.

Seven months after launching the private program, we switched to a public program. 

We were very satisfied with the quality of the interactions with the hunters during the private phase, and were therefore not worried about this transition… We just wanted more hunters on our program!

We also wanted to send a strong message to the community: anyone who finds a flaw can bring it back to us! Of course, we received more reports after the switch to a public program, but it was totally manageable.

Today, we are striving for quality reports on increasingly complex vulnerabilities that require more operating time for hunters, and more experienced hunter profiles.

In this context, we have increased the value of our rewards for critical and high vulnerabilities. The challenge is, with the support of YesWeHack, to attract researchers who find great stuff without ‘ex­ploding’ our rewards budget.

What value does Bug Bounty offer compared with traditional cybersecurity solutions, such as penetration testing?

The advantage of Bug Bounty is first of all crowdsourcing

. With an audit, you only have a couple consultants at your disposal. With Bug Bounty, we potentially have hundreds or thousands of researchers working on our program.

Then there is 365/24/7 continuity, whereas a penetration test usually takes place over a limited period of time and only offers a ‘snapshot’ at a specific moment. This continuity is critical to detect bugs as early as possible, as we update our applications very frequently.

Another key differentiator is that Bug Bounty implies an obligation of result – you pay only for what you get – while penetration testing only implies an obligation of means

This also helps us obtain security budgets internally: the rationale being that we only pay people who find exploitable vulnerabilities, rather than pay auditors to see whether they will find something, without any obligation of results.

Bug Bounty also sends a strong message to hackers. Many companies have long threatened to prosecute hackers who report vulnerabilities. As a result, there is a kind of trauma among some bug hunters who find vulnerabilities and hesitate to contact the organizations concerned, for fear of being mistreated.

With our public program, we’re sending this very strong message to the community: we want you to report flaws to us. In return, we give you a legal and secure framework, with a trusted third party between us to make sure everything goes well.

Ultimately, we want hunters to think, ‘I found a vulnerability on BlaBlaCar, I can be rewarded for this work legally and without taking any risks’. Rather than some people ending up selling the vulnerabilities on the black market…

How do you manage bug reports internally?

The security team is in charge of handling bug reports. They provide an initial qualification, in order to set the severity of the bug, and determine whether it requires immediate attention or not. If the flaw is complex, we discuss it with our team.

Once the vulnerability has been qualified internally, the relevant dev team is notified using a ticketing system provided by the YesWeHack platform.

This ticketing system enables us to monitor the progress of the teams in their patching process and to respond to them if needed.

We then move on to check the fix with the hunter. It’s often a formality because we’ve usually checked ourselves, but it’s always interesting to have an outside eye. We sometimes have surprises: the hunter might tell us it’s not fixed correctly, for instance!

Have you observed any changes to your teams since you began using Bug Bounty?

The security aspect is much more important now. In our internal training, we no longer talk about potential flaws, but we show concrete cases – flaws that have been brought to our attention as part of our program. This has a much greater impact.

How does Bug Bounty fit into your agile approach?

Bug Bounty is integrated into each team workflow via a ticketing system. The idea being that security breaches are tasks just like any other, which we assign to each team concerned with the right degree of priority.

As we deliver continuously, the ability to extend our program scope in one click, and to detect things quickly on these new scopes, also makes us more agile. As soon as an application is updated, we can have it tested, take the results into account, and easily set up a feedback loop.

We will fine-tune our program to continuously improve the quality of our reports and attract better hunters.

If you wish to learn more regarding our platform and service, please do not hesitate to 

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

YESWEHACK PROPHILE ON EBODA

I am the Group CISO of a multinational insurance firm. My team’s mission is to set up a “cyber shield” for the Group and all its subsidiaries, by offering new security services to our subsidiaries – including 

I discovered Bug Bounty following discussions with CISOs from major financial institutions. Having a recommendation from organizations like these with demanding security needs was a key factor in my decision. We started small and the results were conclusive, so we gradually opened several Bug Bounty programs. It’s a new approach, which implies a learning curve.

Bug Bounty offers the guarantee of continuous checking

 – and not just punctual testing, which is what you get with ‘traditional’ penetration testing. If I run a two-week penetra­tion test every year, it implies that we remain ‘unprotected’ for the other 50 weeks, which is no longer acceptable. As a comple­ment, automated tests can also be useful, but are not sophisticated enough. With Bug Bounty, I have researchers working permanently on my scopes.

This continuity is essential, especially when you have frequent deliveries in an increasingly agile development context.

Bug Bounty also allows us to be more flexible.

 For example, I need to test environments which are still in development, or in validation phase, before going into production. Again, this is challenging to do consistently using traditional penetration testing. The 

 platform enables us to adjust the rules for each program, including the bounty grid, accor­ding to the specific phase of each project.

I would also mention responsiveness and availability: it is increasingly difficult, if not impossible, to find skilled penetration testers at short notice, when you need them most, i.e. when you have a new release. 

With Bug Bounty, you just ‘press a button’, and it starts: you can run tests at any time and get confir­mation of remediation in the process very quickly.

Finally, we have been amazed by the diversity of reported vulne­rabilities. We uncover more ‘real-life’ scenarios: for example, researchers have found ‘bits’ of vulnerabilities whose combination made unprecedented attacks possible. Vulnerabilities like these were not addressed until then, as they were not brought to our attention. We are now able to correct them in depth.

Bug Bounty really puts yourself in the head of a hacker.

Does Bug Bounty mean the end of penetration testing, or are the two complementary?

For me it is complementary. The reality however is that there are too few audit firms to keep pace with the number of testing that must be carried out. Hence the key value of Bug Bounty. Moreover, 

penetration testing shows various limitations and constraints: they must be scheduled in advance, with a start and end date, and they demand project manage­ment.

 This synchronization is a real headache, especially with agile developments. If a delivery is two days late on a given scope, the pentesters are no longer available, which poses a real stewardship problem.

What I also like about Bug Bounty is the 

. With traditional penetration testing, you almost never receive a remediation check. Following an audit, if a developer tells me, ‘I fixed the bug’, I only have his word. Bug Bounty allows me to delegate this control to the researcher, who is entirely objective.

This enables me to fix a vulnerability and validate the correction in the process – unlike a traditional cross-verification, which I should run once all my vulnerabilities have been addressed. Now, when a serious or critical vulnerability is discovered, I know it is fixed quickly, and I can sleep soundly! 

Have you seen any other changes since you started the Bug Bounty program?

There is certainly more awareness now, but the major point I’m observing is the 

acceleration of the patching rate / frequency

. Our developers fix much faster. Responding to researchers, rewarding them, closing reports, etc. require developers to react more qui­ckly. This, in turn, leads to much shorter time-to-remedia­tion.

As mentioned earlier, we have implemented speci­fic programs dedicated to test environments, before their release. We therefore detect and fix vulnerabi­lities further upstream of projects. Firstly, this allows us to train our developers ‘on the fly’; second, it accelerates our deliveries since there are fewer patches to manage in the validation and release phases.

We became more responsive, in the interests of both developers and business.

Our first step is to gradually expand the Group’s assets under Bug Bounty. And on these scopes, to gradually move from black box to grey box.

The second step, where we are now, is to make the ser­vice available to our subsidiaries worldwide. We want to offer them something different and forward-thinking, allowing them to renew their vision of cybersecurity and audits.

Bug Bounty’s strengths compared to penetration testing

organises bug bounty programmes to disclose and correct vulnerabilities before malicious tools get in. A year after joining the Paris Call, we look back at how have we contributed to furthering peace in the cyberspace.

On 12 November 2018, hundreds of partners gathered to launch the 

Paris Call for Trust and Security in the Cyberspace

. The Paris Peace Forum kicked off on 12 November 2019, to continue building upon the Call and showcase peaceful global governance from the world over.

YesWeHack is Europe’s bug bounty leader and a first-hour Paris Call signatory. 

 bridges the gap between discoverers and vendors, thus structuring a Coordinated Vulnerability Disclosure (CVD) process and clarifying benefits for all. Bug bounty is , therefore, an accessible legal and value-generating framework preventing state and non-state actors from stockpiling vulnerabilities.

Furthermore, by enabling actual CVD, bug bounty is a viable economic alternative to vulnerability-oriented black markets. Our active contribution to decreasing the proliferation of malicious uses of digital products is thus twofold.

Protecting NGOs and civic-tech initiatives

YesWeHack promotes proactive vulnerability disclosure by providing bug bounty programmes for NGOs and civic tech initiatives, forebears of democratic values. Those programmes unfold during the 

International Forum for Cybersecurity (FIC)

 held yearly in Lille, France. More specifically, YesWeHack provides the full operational power of its ethical hackers’ community and ensures that researchers get an adequate reward for reporting vulnerabilities to the participating NGOs.

For its 2019 edition, “le FIC”, as it is known amongst its French-speaking community, hosted a two-day long bug bounty we organised. 

 benefited from our hunters’ skills: HelloAsso, iRaiser, Croix Rouge, CapCollectif, OpenStreetMap and Destination Rennes. Its 2020 edition will witness again YesWeHack’s recurrent effort to improve the security of NGOs’ infrastructures. The 2020 edition is coming up end of January, and we are currently convening NGOs to join (so, watch this space for more!).

Coordinated Vulnerability Disclosure, a sustainable way to root malware out

A CVD process aims at reducing risk and ultimately mitigating the potential damage caused by a security vulnerability. Even though patch deployment or report publication are indicators of efficient cooperation between vulnerability discoverers and the affected service editors, the CVD process cannot be reduced to any of those events alone.

Instead, Coordinated Vulnerability Disclosure is the process of collecting information from security researchers, coordinating the sharing of that information amongst concerned parties, and subsequently disclosing the existence of vulnerabilities and their mitigation measures to various stakeholders, including the general public.

Bug Bounty ensures and fosters such coordination. 

 thus remains true to its values and commitment to the 

 by actively participating in establishing a 

. By consistently promoting CVD as a means to significantly increase the likelihood of success of any vulnerability response process, YesWeHack thus aims at bringing about a meaningful alternative to malware proliferation.

Fighting malware at the roots

EDU, the world’s first Bug Bounty education platform dedicated to cybersecurity training.

“Cybersecurity is both an economic and societal issue, and this sector suffers from an imbalance between the state of the threat and the market’s defence capabilities,”

 commented Guillaume Vassault-Houlière, co-founder of YesWeHack. He adds: “To remedy this situation, the capacity of public and private actors to detect and correct shortcomings in a professional and ethical manner must be rapidly strengthened – This requires specialized profiles training and better information sharing. »

YesWeHack EDU is aimed at cybersecurity curriculums in schools and universities and more broadly at all European IT curriculums (e.g. development, big data, etc.) that want to accelerate the sharing of quality datasets.

YesWeHack EDU’s educational approach first encourages emulation through gamification and the involvement of each student in securing their institution. Above all, it opens up prospects for future developers towards promising specializations such as DevSecOps, Data Scientist, Security Analyst, etc. Finally, YesWeHack EDU facilitates the implementation of collaborative projects and cross-functional initiatives between academic institutions and the private sector.

“According to a study published by Gartner, 50% of companies worldwide are expected to use Bug Bounty by 2022, compared to 5% today. We are launching YesWeHack EDU to address the talent shortage faced by the cyber security industry. This program provides the academic community with a sophisticated training platform to professionalize vulnerability management and to train for new cyber jobs, such as DevSecOps, Big Data, SOAR, etc. ”

 explains Guillaume Vassault-Houlière, CEO & Co-founder of YesWeHack.

, who will provide YesWeHack EDU to schools and universities globally.

Available throughout Europe, the YesWeHack EDU platform is aligned with the 

 consortium initiative, of which YesWeHack is a founding member, that aims to strengthen both innovation and research in cybersecurity at the European level.

YesWeHack EDU, the world’s first Bug Bounty educational platform

, we talked with Kevin Dubourg, Bug Bounty Program Manager at

. Yousign provides electronic signature (eSignature) services and aims at protecting both its services and users.

Kevin Dubourg, Bug Bounty Program Manager, Yousign:

There are a number of platforms out there, mostly U.S.-based. We requested certain guarantees from the hunters invited to our programs, and 

 offered those guarantees and the confidence to launch a bug bounty program.

What value does bug bounty bring compared with traditional cybersecurity solutions, such as penetration testing?

It offers diversity in terms of perspectives and skills. Every hunter has his own approach, his way of doing the thing: a unique approach that makes a particular attack. This is different from penetration testing, and it provides a much stiffer challenge. With bug bounty, we left the penetration testing world behind, in order to benefit from 10, 20, or 30 different views and really challenge our teams.

It is also interesting that not all hunters are necessarily ‘cybersecurity professionals’. The entire ecosystem is represented here, and we can pick up individuals based on their nationality, skill set, and ranking on the platform.

However, the primary value of bug bounty is the continuity, recurrence, and ‘annualisation’ of the tests: as soon as we release a new version, we integrate the existing program and receive immediate feedback on the security of the new version. We don’t need to wait a year for the next penetration test to check on the security of our update. This approach is embedded within our project lifecycle.

Our scope evolves constantly, and bugs evolve at the same time. Security flaws turn up every day, not just once a year, and bug bounty enables us to detect and fix these in time. It helps us monitor our services almost constantly, which is very reassuring. It would also be impossible financially to do a penetration test on each delivery, although we would need to.

The return on investment is compelling too. Yousign carries out one penetration test each year. And this is quite expensive, compared to a bug bounty program. It’s a bit crazy when you think about it: they cost more or less the same, but bug bounty covers an entire year, whereas an audit only lasts a week.

Do bug bounty programs spell the end for penetration testing? Or will they remain complementary?

For Yousign, the two will continue to be complementary. It could mean the end of penetration testing in some industries, but not in ours: as a trusted third-party provider we are required to carry out regular audits. In a less stringent regulatory environment, I would probably consider only using bug bounty.

However, bug bounty is very important for our sales and marketing: it’s clearly a differentiator to large prospect accounts. We mention it systematically in our request for proposal submissions as it’s seen by the market as a quality hallmark.

How do the results compare between penetration testing and bug bounty?

I’ve had the same reports from both, but there are many more reports from bug bounty than from penetration testing. Moreover, after we have carried out a penetration test on a given scope, running bug bounty always brings additional vulnerabilities.

One of the problems with penetration testing is that results mainly depend on the expertise of the penetration tester. Our last penetration test showed up some relevant things, but when you compare the results with those of the bug bounty program we launched afterwards, there was no comparison.

Have you seen any changes among your teams since using bug bounty?

Yes, definitely. I initially managed the programs on my own, but soon afterwards involved the development teams so that they could manage processes like replying directly to hunters and fixing bugs. Most reports concerned the applications team, so they had to face up to reality and take things forward.

What’s more, we quickly saw that their interactions with the hunters affected their delivery and working methods: not only do they integrate security into their development work more effectively, but they also started to ‘think’ differently, always keeping in mind the security aspects. You could say that they are not only delivering for clients, but for the hunters too!

The next step is to extend the use of bug bounty. Besides the current programs in our production and ‘staging’ environments, we want to embed bug bounty within our CI/CD workflow to add to our battery of functional and unit tests. This should make us even more agile. Bug bounty is certainly a key component of our CI/CD approach.

In time, we may move to a public program.

If you want more informations about Bug Bounty &

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

 (VDP), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

Bug bounty is significantly more cost-effective than penetration testing

 program owing to our short delivery cycles. In the past, we conducted ‘traditional’ penetration testing once a year. However, we have a lot of changes every month to our scopes and could not wait 12 months for the next audit. 

 enables us to carry out continuous checks, for each release, update, and new delivery.

It’s the return on investment. The opportunity to pay based on results is very important for a small organisation like ours with limited budgets. With traditional penetration testing, we have to pay even if nothing is found. Our last penetration test cost around €8,000 and no major vulnerabilities were reported.

After two months running this latest program, dozens of security flaws were reported, including some critical vulnerabilities never reported using previous audits. This was achieved with a reward budget approximately half that of a single audit.

I would also mention diversity: penetration testing is too ‘academic’ and doesn’t meet our real needs. Most penetration testers run tools and tick boxes. As a result, too many vulnerabilities are left undiscovered. The diversity of hunters and their range of skillsets make a big difference.

Lastly, the model is very flexible. Take scope evolution, for example. With a traditional penetration test, a scope is defined in advance: if you want to change anything, you have to pay again for another audit. Now, with bug bounty, we can fine-tune the program over time, adding products or URLs to the scope. This is key to us.

The YesWeHack Blog

Showcasing your vulnerability disclosure policy to the world

Deezer protects their artists & users with a public Bug Bounty program

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

Showcasing your vulnerability disclosure policy to the world

YESWEHACK PROPHILE ON EBODA

Bug Bounty’s strengths compared to penetration testing

Fighting malware at the roots

YESWEHACK PROPHILE ON EBODA

YesWeHack EDU, the world’s first Bug Bounty educational platform

Bug bounty is significantly more cost-effective than penetration testing

Bug bounty agility is key for small organisations

YesWeHack EDU, the world’s first Bug Bounty educational platform

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us