#1 Your teams must understand their roles and responsibilities

#2 A dedicated program manager

#3 A clear, detailed, up-to-date program brief

#4 Efficient, prompt, fair triage

#5 Transparent reward and payment process 

#6 Integration with internal remediation processes – including your bug tracking tools

#7 Empower teams to ‘own’ security

#8 Ensure you stay within budget

#9 Start small, but ultimately target maximum coverage

9 rules for a successful first-time Bug Bounty Program

What ISO/IEC 27017 certification means for our customers

How we demonstrated compliance

More reasons to trust YesWeHack

YesWeHack secures ISO/IEC 27017 certification to boost trust in our cloud-based services

“If I’m a hunter, is this worth my time and effort?”

Rather than overreacting to the “modest” level of hunter activity at the outset of 

, who oversees the assurance and risk management specialist’s BBP, took the perspective of an ethical hacker – to impressive effect.

’ event in Stockholm, Medhurst told senior security professionals in the Nordic region how tweaks to the program description and more hunter invites – increased to 80 from an initial 20 – sparked a surge in reports.

And these were generally high-quality reports too, especially from a prolific hunter who the DNV team dubbed ‘Wreck it Ralph’. “How clear he was with his reports, the intelligence behind it”, and so many ways of escalating privileges, said Medhurst – “we laughed at his ingenuity”.

At the time of speaking, Medhurst, DNV’s Head of Program Management and Testing, Digital Solutions, said the pilot program had generated 55 vulnerability reports, of which 24 warranted a payout – collectively totalling €9,000. A great return on investment, Medhurst concluded.

After a modest beginning, these numbers had been achieved within 18 months of launch, which in turn came only six months after Medhurst became aware (via a pentester) of Bug Bounty. “The concept resonated with me immediately,” he recalled.

Before committing to YesWeHack, concerns about budgetary constraints and securing sign-off from decision-makers were soon allayed by the enthusiasm of DNV’s development team and assurances from YesWeHack – which we subsequently lived up to.

For instance, YesWeHack provided “a lot of handholding and guidance” on assessing scopes and suggested they weren’t attractive enough when incoming bugs began as a trickle.

When reports really started to flow, the triage team worked efficiently to avoid blockages and help developers prioritise the most critical vulnerabilities. “I think it’s world class,” Medhurst said of the in-house triage service. “We’ve shown our technical support teams for software products how they deal with things. We’ve learned a lot – for free.”

Guided by YesWeHack, the vulnerability management process has become increasingly streamlined too, added Medhurst.

DNV, a global brand headquartered in Norway, has derived benefits beyond each remediation’s closure of a single attack vector. They sometimes create automated tests for specific vulnerabilities, for instance.

Supported by an internal ‘security champions’ network, sharing hunters’ findings with developers and pentesters has also made development more secure and improved security testing – in effect creating a positive “feedback loop”, noted Medhurst.

DNV, which is also the world’s largest classification society for the maritime sector, is currently working on strengthening this feedback loop, adding two programs to the existing three and introducing maturity KPIs.

Success factors for the pilot were getting “funding principles in place straightaway, getting buy-in from developers and senior management, and having a strong relationship with the CSM and triage team”, said Medhurst.

In case your program does start strongly – and DNV’s latest BBP began with eight reports on day one – Medhurst advised attendees to “be ready to respond” when you go live.

He also suggested there was more to attracting hunters than offering enticing scopes and bounty grids. “Relationships matter,” said Medhurst, with speed of response, clarity of communication and fairness of rewards pivotal to building trust.

Finally, as we pointed out in a recent article that 

, budgetary constraints needn’t be a dealbreaker when considering whether to launch a BBP. “Don’t worry about running out of budget,” advised Medhurst. “Go with whatever budget you’re willing to invest and you’ll be pleasantly surprised!”

Explore the benefits of a Bug Bounty program for your organisation with our team of experts! 

Quantity AND quality

'A lot of handholding'

Positive feedback loop

"Triage was world class": Bug Bounty success story from risk-management giant DNV 

Duration

Challenges and Points System

Challenge Announcements

Submission of Responses

Prizes

Eligibility and Participation

Fair Play and Judging

Miscellaneous

Introducing the YesWeHack Advent Calendar: 24 Days of Challenges and Festive Fun!

Misconception #1: “Bug Bounty Programs are only for the largest organisations”

Misconception #2: “I don’t have sufficient budget to pay hunters”

Misconception #3: “I don't have enough time to manage a Bug Bounty Program”

Misconception #4: “Ethical hackers can never be trusted 100%”

Misconception #5: “I will spend too much time following up on bug reports”

Misconception #6: “I can't handle a flood of bug reports”

Misconception #7: “My organisation is not mature enough for Bug Bounty”	

Busting Bug Bounty misconceptions

What is DORA?

Threat-led penetration testing

Cut costs on your way to compliance

Rapid scaleup

Certifying compliance

Risk management

ACCELERATE YOUR JOURNEY TO DORA COMPLIANCE 

How Bug Bounty and Attack Surface Management can help you comply with the Digital Operational Resilience Act’s upcoming requirements 

DOJO Challenge #28 Winners!

Continuous Threat Exposure Management

The age of ASM

Unify and simplify your vulnerability management workflow

ASM key features

Coming soon: Asset Coverage aid to strategizing testing

Continuous Threat Exposure Management: Unify your Offsec Strategy with YesWeHack

Loïc Deleforterie on how Withings strengthens its cybersecurity posture…

On the motivations for launching a Bug Bounty program…

On the program’s evolution so far…

On overcoming the biggest challenges faced so far…

On Withings’ plans to scale up Bug Bounty testing…

On what has impressed him most about Bug Bounty…

On choosing YesWeHack to manage the Bug Bounty program…

On a fruitful relationship with YesWeHack…

On the best approach to launching your first Bug Bounty program…

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

ADOPT A PROACTIVE SECURITY POSTURE NOW

Harness the power of crowdsourced security to supercharge the discovery and remediation of vulnerabilities.

The YesWeHack Blog

9 rules for a successful first-time Bug Bounty Program

YesWeHack secures ISO/IEC 27017 certification to boost trust in our cloud-based services

"Triage was world class": Bug Bounty success story from risk-management giant DNV

9 rules for a successful first-time Bug Bounty Program

Introducing the YesWeHack Advent Calendar: 24 Days of Challenges and Festive Fun!

Busting Bug Bounty misconceptions

How Bug Bounty and Attack Surface Management can help you comply with the Digital Operational Resilience Act’s upcoming requirements

Introducing the YesWeHack Advent Calendar: 24 Days of Challenges and Festive Fun!

DOJO Challenge #28 Winners!

Continuous Threat Exposure Management: Unify your Offsec Strategy with YesWeHack

‘YesWeHack adapted to our needs’: The Bug Bounty story so far for connected health pioneer Withings

DOJO Challenge #28 Winners!

DON'T WAIT FOR THE THREATS TO STRIKE

Products

Researchers

Resources

Company

Follow us