As EU member states scramble to transpose NIS 2 into national law, affected organisations are doubtless accelerating their compliance efforts as the transposition deadline (17 October) approaches.

There may be much work to do. After all, there were recent 

 of French organisations being underinformed about their new obligations.

NIS 2 aims to elevate and harmonise cyber-resilience across the bloc more effectively than its predecessor directive. Among other notable additions, national cybersecurity strategies and cybersecurity risk-management rules for “essential” or “important” entities must incorporate supply chain security and coordinated vulnerability disclosure (CVD) policies.

Belgium, the only member state to fully transpose NIS 2, has also mandated that qualifying entities publish a CVD policy. While this goes beyond what NIS 2 demands, perhaps some other member states will follow suit for reasons we’ll explain later.

NIS 2 should be of interest outside the EU too. Like the General Data Protection Regulation (GDPR), this landmark legislation may well inspire copycat regulations outside the bloc (it’s worth noting too that the UK is still updating its own NIS regulation post-Brexit).

This NIS 2 summary outlines the directive's key points, as well as the benefits of 

Continuous Threat Exposure Management (CTEM)

 for cost-effectively achieving compliance. 

 is the second iteration of the NIS (Network and Information Security) Directive, which broke ground as the first EU-wide cybersecurity rules when they came into force in 2016.

, the successor legislation is intended to achieve “a high common level of security of network and information systems across the Union”. It aims to do so by obliging:

Member states to adopt national cybersecurity strategies and designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity and computer security incident response teams (CSIRTs)

Member states to give organisations tools, mechanisms and encouragement to share information on vulnerabilities, threat actors and so on

Organisations providing “essential” or “important” services to implement cybersecurity risk-management measures and promptly report “significant” security incidents

Member states to supervise and enforce compliance

The legislation sets out minimum requirements designed to achieve these goals that national laws will have to at least match, if not exceed.

The NIS 2 Directive entered into force in January 2023, from which point member states had 21 months to transpose its requirements into national law. The deadline of 17 October is now only four months away, with all but two countries (Croatia and Belgium) yet to transpose at the time of writing.

Regarding the obligations of in-scope entities, some requirements will apparently enter into force immediately, while others will be subject to a grace period.

Qualifying organisations must self-assess whether they fall within the scope of NIS2 and notify the relevant state regulator that they fall within NIS 2’s scope by 17 April 2025 (for some entities the deadline is 17 January). 

Why the original NIS Directive was superseded

 to be failing to embed sufficient and consistent cyber resilience across the EU and its critical sectors, create a common understanding between states about the threat landscape, or create a joint crisis response capacity. 

Among other measures, NIS 2 sets out to remedy these shortcomings by applying to a wider range of sectors, introducing incident reporting deadlines and strengthening information-sharing measures. It also introduces minimum financial penalties for violations and makes “management bodies” liable for infringements.

Vulnerabilities and supply chains to the fore

 post-2016 meant NIS 2 was drafted in a much-changed threat landscape to its predecessor.

While the word “vulnerability” appeared only once in the first NIS (and then only in relation to the obligations of CSIRTs), the term “coordinated vulnerability disclosure” appears 11 times in the NIS 2 Directive. Both member states and essential/important entities have obligations around vulnerability management or disclosure. The directive prescribes the creation of a European vulnerability database.

The first NIS was drafted before the game-changing 

 in 2020, which resulted in the downstream compromise of 18,000 customers (including government agencies). Whereas the first iteration did not even feature the term “supply chain”, NIS 2 mandates state-level risk assessments and entity-level measures on supply chain security.

The NIS 2 Directive broadens the scope of critical sectors and divides them into “essential” and “important” entities.

Four new sectors are added to the essential (or “high criticality”) tier, with space, waste water, ICT service management and public administration joining energy, transport, banking, financial market infrastructure, health, drinking water and digital infrastructure (which now also includes trust, cloud and other additional services).

The important category is populated by postal and courier services, waste management, chemicals, food, manufacturing, research and digital service providers, which span online marketplaces, search engines and social networks.

The NIS 2 regulation introduces, with certain exemptions, size and annual turnover parameters too (minimum 250/50 employees and €50m/€10m turnover for essential/important services). Member states have the discretion to make exceptions for high-risk entities that fall outside of these parameters.

Ireland’s National Cyber Security Centre has published a useful 

 (PDF) for understanding whether your organisation will be subject to NIS 2.

It has been estimated that around 100,000 companies in the EU will have to become NIS 2-compliant. YesWeHack qualifies as an ‘important’ entity and we have taken steps to comply.

NIS 2 essential and important entities must comply with risk-based security requirements arranged around six themes.

, management bodies must approve, oversee and be held liable for infringements of these NIS 2 controls. They must also undergo cybersecurity risk-management training and encourage their employees to regularly do likewise.

, meanwhile, “shall be based on an all-hazards approach” and cover a multitude of security areas, from cryptography to human resources security.

These measures should also tackle potential vulnerabilities in their supply chains, while entities should take into account 

coordinated security risk assessments of critical supply chains

Where entities use third-party ICT services, they may be required to use providers that are certified under pending 

European cybersecurity certification schemes

. Member states are also expected to encourage the use of ‘

’, as well as European and international cybersecurity 

reporting ‘significant’ security incidents

 and simplifies the criteria for reportable incidents since the previous conditions led to 

. CSIRTs or competent authorities must be sent an early warning within 24 hours, an incident notification within 72, an intermediate report (where applicable), a final report within a month of the incident notification, then (for ongoing incidents) a progress report. The CSIRT/competent authority should provide feedback, potentially with mitigation measures. Where appropriate, organisations should also notify and provide advice to affected users.

NIS 2 vulnerability management requirements

The risk-management measures qualifying entities must take should encompass “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure”.

National cybersecurity strategies, meanwhile, should generate a policy on “managing vulnerabilities, encompassing the promotion and facilitation of coordinated vulnerability disclosure”.

To this end, a network of national CSIRTs will mediate coordinated vulnerability disclosure where necessary; track and disseminate information and best practices around cyber threats, vulnerabilities and incidents; help NIS 2 sectors monitor their networks and information systems; and hunt for vulnerabilities through non-intrusive scanning of essential and important entities’ online assets.

In consultation with the Cooperation Group, ENISA (European Union Agency for Cybersecurity) is tasked with building and maintaining a European vulnerability database, and to this end has just 

. Entities, whether subject to NIS 2 or not, will be able to voluntarily disclose vulnerabilities in ICT products or services. ENISA’s chief cybersecurity and operational officer has 

 that such a database would itself present an intolerable security risk.

Incidentally, YesWeHack already provides a secure, straightforward and legally protective mechanism for reporting vulnerabilities in the form of 

 (free web browser plugin), should be consulted first in case the vendor has a dedicated Vulnerability Disclosure Programme (VDP).

Violations of NIS 2 could lead to fines of up to €7 million or 1.4% of total annual turnover for important entities, or up to €10 million euros or 2% of total annual turnover for essential entities (whichever is higher). Senior management can also be held liable for violations.

Belgium’s transposition doubles fines for repeat offenders (where the second offence occurs within three years of the first).

Organisations already compliant with ISO 27001 – which 

 – have a head start in the journey to compliance. While ISO 27001 compliance is not a prerequisite for NIS 2 compliance, the overlap between the two makes this ISO standard an excellent springboard.

 (PDF) estimated that compliance with a successor directive would typically require qualifying entities to increase cybersecurity spending by up to 22%. However, it also suggested that increased costs could be offset by costs averted through a reduction in security breaches.

Organisations keen to comply in a way that cost-effectively hardens their digital assets might be interested to hear a couple of relevant insights.

continuous threat exposure management (CTEM)

 – a best-practice methodology for continuously monitoring and hardening your attack surface – could result in a two-thirds reduction in breaches, 

according to market research firm Gartner

. And second, that one Bug Bounty customer estimates that Bug Bounty is typically 

For even greater effectiveness, the YesWeHack platform combines the best of both worlds by integrating attack surface management with vulnerabilities generated by Bug Bounty Programs, automated scanning, traditional pentesting and Vulnerability Disclosure Policies (VDPs).

, as of February 2024, with additional regulations still required.

Belgium’s full transposition was ratified by its parliament on 18 April.

France is likely to be the next to transpose NIS 2, potentially within a matter of days or weeks. ANSSI, the country’s cybersecurity agency, is developing tools to help organisations assess whether they are among an estimated 1,700 French entities that need to comply, for implementing risk-management measures, and for tracking compliance.

 in Austria, Germany, Latvia, Hungary and the Czech Republic. The UK transposed NIS before Brexit and has announced plans to upgrade the regulation.

Belgium sets template with VDP requirement

 goes beyond NIS 2’s minimum requirements by giving entities a new risk-management obligation: implementing a coordinated vulnerability disclosure (CVD) policy.

Belgium’s transposition outlines the process through which a vulnerability can legally (and anonymously if preferred) be reported to the national CSIRT. This includes time limits (including 24 hours for a “simplified notification”) and, where the organisation lacks a CVD mechanism, having evidence that they sought “to contact the organization using ordinary means (e-mail to info@ or contact@ or dpo@)”.

However, Belgium’s prescription for a CVD policy should serve as a wakeup call for any important/essential organisations that blithely assumed the CSIRT mechanism meant they could forgo a VDP.

Many other member states could arguably emulate Belgium given CVD policies are recommended by NIST, ENISA and CISA, and prescribed by ISO 29147 and ISO 30111.

More importantly still, the NIS Cooperation Group’s 

 (PDF) advise competent authorities to urge organisations to adopt their own CVD policy in line with best practices. Public authorities, the document also instructs, should adopt their own CVD as standard, demand the same from their suppliers and include CVD provisions in public procurement contracts.

 conformant with these guidelines and your specific requirements and integrate it into your website. Other product features:

Unified interface for receiving reports and managing vulnerabilities

Receive only valid, actionable reports thanks to our in-house triage service

Triage team can evaluate bug severity and liaise with security researchers

End-to-end encryption ensures confidential communication

Bug Bounty model endorsed by NIS authority

VDPs are not the only form of CVD policy. The NIS Cooperation Group guidelines also endorse Bug Bounty (or vulnerability reward) Programs as a beneficial form of CVD for “most organisations”, citing multiple benefits:

Financial ‘bounties’ incentivise security researchers to generate “more results for the organisation”

A Bug Bounty platform “will coordinate the technical and administrative aspects of its reward programme with the organisation”

“A coordinator or a bug bounty platform can help to establish and maintain a constructive relationship between the parties, or possibly guarantee the anonymity of reporters”

“Promotion of financial reward programmes or bug bounty programmes can help raise awareness on vulnerability research”

Agile security testing adapted to your development model

Results-based pricing – paying only for valid, actionable reports

In-house triageto ensure triage quality, consistency and confidentiality

Vulnerability reports seamlessly integrated with your tools and workflows

Increased security literacy among your devs to reduce the creation of vulnerabilities early in project lifecycles

Risk-based solutions for a risk-based regime

However, Bug Bounty Programs and other forms of security testing only mitigate risks posed by vulnerabilities in 

 internet-facing assets can be continuously discovered by continuous threat exposure management (CTEM), which features among 

Gartner’s top cybersecurity trends for 2024

Therefore a CTEM-based approach combining security testing with attack surface management should form an invaluable plank of the “appropriate and proportionate technical, operational and organizational measures to manage the risks to the security of network and information systems” prescribed by NIS 2.

NIS 2 also mandates all-hazards measures on asset management and supply chain security. Clearly, understanding your attack surface is integral to managing your organisation’s digital assets and its exposure to vulnerabilities in third-party components.

 enables a unified, comprehensive and risk-based approach to security testing that aligns with the risk-based NIS 2 regime and most other modern cybersecurity legislation.

Countdown to NIS 2 compliance: Key insights and implications for your SecOps strategy

A new UK cybersecurity law shows that governments are losing patience with the widespread failure to implement basic security measures for connected devices.

In force since 29 April, the Product Security and Telecommunications Infrastructure (PSTI) Act mandates that Internet of Things (IoT) manufacturers must publish contact information for anyone – from users to security researchers – to report security vulnerabilities in their internet-enabled devices. The information should be “accessible, clear and transparent”, 

Manufacturers are also obliged to give reporters of suspected vulnerabilities timescales for acknowledging vulnerability reports and status updates until the issue is remediated or invalidated.

 (PDF) conducted by UK cybersecurity firm Copper Horse for the IoT Security Foundation, 76% of smart device vendors still provided no means for security researchers to contact them.

LAUNCH YOUR VULNERABILITY DISCLOSURE POLICY

”, the PSTI regime also proscribes weak and easily guessable default passwords like ‘admin’ or ‘12345’. Shipping products with easily guessable default passwords enables devastating attacks such as the corralling of hundreds of thousands of devices into the 

, which brought down numerous popular websites in 2016.

A third PSTI security requirement mandates a commitment to a minimum end date for sustaining security updates – again, “in a clear, accessible and transparent manner”. Committing to finding and fixing vulnerabilities and rolling out patches over the long haul gives vendors an edge in winning consumer trust and complying with increasingly stringent regulation around the world.

UK households own an average of nine connected devices, according to the UK government. Amid reports of vulnerabilities that enable cybercriminals to take over devices and covertly view footage from security cameras, connected toys and smart baby monitors, UK Minister for Cyber Viscount Camrose said the new law should give consumers “greater peace of mind”.

Anyone can report a product they suspect is failing to comply with the PSTI legislation to the 

Office for Product Safety and Standards (OPSS)

. Organisations found to have flouted the law can be fined.

Automotive vehicles are exempt from the law since separate legislation is being drafted for online automotive systems.

Copper Horse CEO David Rogers said: “Manufacturers should not be providing anyone with products like webcams that are so weak and insecure that they are trivial to hack into and takeover. This stops now and people [in the UK] can have greater confidence that the internet connected products that they buy have better security measures built-in to protect them.”

VDP: Best practice for secure, coordinated vulnerability disclosure

 (VDP) is the most secure and efficient means of complying with vulnerability reporting requirements, such as those prescribed by the PSTI regulations.

VDPs are advocated by NIST, ENISA and CISA and prescribed through standards ISO 29147 and ISO 30111. A US government-wide VDP platform “facilitated the remediation of 1,119 vulnerabilities out of 1,330 unique, validated submissions” in its 

As a secure channel for coordinated vulnerability disclosure, a VDP shows your customers that you take security seriously and and can fruitfully complement a 

 in line with industry best practices and your specific requirements and integrate it into your website. Other product features:

UK PSTI Act: ‘World first’ IoT security rules offer reminder of VDP virtues

Cybersecurity is a more pressing priority than ever for US-listed companies and foreign private issuers in the wake of new rules and a landmark enforcement action from the US Securities and Exchange Commission (SEC).

The new SEC cyber rules, in force since 15 December, introduced mandatory reporting of “material” cybersecurity incidents and new annual disclosure obligations around cybersecurity risk management, strategy and governance.

A month earlier the SEC stunned the cybersecurity industry when it 

charged SolarWinds and its Chief Information Security Officer (CISO)

 with fraud and internal control failures related to a catastrophic cyber-attack in 2020 – an unprecedented move for the agency.

Even cybercriminals have noticed the SEC’s increasingly muscular approach to cybersecurity. In November, the BlackCat ransomware gang 

 to the agency for failing to disclose BlackCat’s breach of the digital lending platform.

Added to increasingly numerous and sophisticated cyber-attacks, the SEC’s latest manoeuvres are certainly focusing minds in the boardroom (and not necessarily just for public companies).

With digital transformation ongoing and code vulnerabilities a 

unified, multi-layered offensive security strategy

 is invaluable in reassuring both regulators and stakeholders about your security posture. To this end, for instance, 

YesWeHack’s all-in-one vulnerability management platform

 consolidates auto-scanning, Bug Bounty, pentest management, a vulnerability disclosure mechanism and attack surface management.

Public companies must now disclose in their annual filings “any cybersecurity incident they determine to be material” within four days of deeming it material, 

 when the new SEC cybersecurity rules were adopted in July 2023. Their disclosure must “describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant.”

The SEC cybersecurity rules 2023 also require a description of “their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents.”

Third and final, filings must “describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats.”

These cybersecurity risk management and incident disclosure obligations require comparable disclosures by foreign private issuers.

The SEC cybersecurity rules’ effective date was 15 December 2023. ‘Smaller reporting companies’ have an additional 180 days before they must start disclosing ‘material’ incidents.

Why was the SolarWinds CISO charged by the SEC?

, the observability and IT management platform, and its CISO, Timothy Brown, “for fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities”.

It was the first time the SEC had ever brought cybersecurity-related charges against a CISO.

The bombshell news relates to the nearly two-year-long ‘Sunburst’ attack, which compromised 18,000 SolarWinds customers via a backdoor implanted in a software update for IT performance monitoring system Orion. Microsoft, NASA and the US justice and state departments were among the victims.

The charges allege that “SolarWinds and Brown defrauded investors by overstating SolarWinds’ cybersecurity practices and understating or failing to disclose known risks”. Brown is also alleged to have “failed to resolve” certain “risks and vulnerabilities” or “at times, sufficiently raise them further within the company”.

The SEC cyber disclosure rules show the agency is getting serious about cybersecurity. Why?

The SEC, which enforces securities laws, appears to increasingly see cybersecurity as central to its mission of protecting investors and facilitating capital formation.

“Whether a company loses a factory in a fire – or millions of files in a cybersecurity incident – it may be material to investors,” explained SEC chair Gary Gensler upon the rules’ adoption. He said companies and investors would benefit if their cybersecurity disclosures “were made in a more consistent, comparable, and decision-useful way”.

On the eve of the new rules coming into effect, Erik Gerding, director of the SEC’s corporation finance division, 

 the trajectory of multiple trends highlighted “investors’ need for improved disclosure” about cybersecurity issues. Namely, he cited the AI threat and increases in the digitisation of economic activity, remote work, the profitability of cyber-attacks, the use of digital payments, and reliance on third-party cloud and IT service providers.

Gerding also noted the rising costs – up to $4.45 million per data breach in 2023, 

 – associated with successful cyber-attacks.

Far from simply encouraging “boilerplate disclosures”, Gerding said the new cybersecurity disclosure requirements should elicit “tailored disclosures” that help investors evaluate even “emergent or evolving” risks.

Do the SEC cybersecurity rules for public companies affect other organisations?

The new SEC rules on cybersecurity apply directly only to US-listed companies and 

Organisations not subject to SEC oversight might nevertheless see its new rules as offering a useful framework for being transparent with their own stakeholders.

Moreover, with software supply chain attacks increasing, privately-held organisations can still be held liable as third-party suppliers implicated in cybersecurity incidents disclosed by public companies.

The SEC has not shied away from launching enforcement actions against private entities, most famously over the Theranos blood-testing scandal that 

landed founder Elizabeth Holmes in prison

. More recently, the SEC has targeted private clean energy company 

The new SEC cybersecurity rules and SolarWinds charges are also part of a 

 – propelled by the White House’s cybersecurity-focused 

 of 2021 – making stringent cybersecurity controls a greater legal and compliance imperative.

The trend is global. Across the Atlantic, for instance, the 

 – Digital Operational Resilience Act (DORA) are imposing new compliance requirements on organisations operating within the EU.

What are the implications of the SEC cybersecurity disclosure rules for my cyber-risk management strategy?

In mandating greater transparency and consistency in registrants’ cybersecurity disclosures, the SEC will hope to encourage a more rigorous approach to cyber-risk management.

Specifically how those risks are mitigated amid fast-evolving threats and technology is left to organisations to judge.

“In order to address a potential misconception, the Commission is not seeking to prescribe particular cybersecurity defenses, practices, technologies, risk management, governance, or strategy,” said Erik Gerding. “Public companies have the flexibility to decide how to address cybersecurity risks and threats based on their own particular facts and circumstances.”

In unifying and streamlining offensive security testing and its outcomes, the YesWeHack platform suits organisations of various sizes, sectors and levels of security maturity. It also offers increasingly powerful security benefits in the context of the current threat and infosec industry landscape.

How can I proactively improve my cyber-risk management strategy with YesWeHack in light of the SEC cybersecurity rules?

Our platform can help public companies enhance their SEC disclosures around “assessing, identifying, and managing material risks from cybersecurity threats”.

How? First, our Vulnerability Disclosure Policy (

) product provides a simple, standardised mechanism for receiving external vulnerability reports.

 Program, which is inherently more scalable, draws on a much broader skills base and has fewer methodological constraints than traditional security testing. As such, this form of crowdsourced security testing reliably surfaces serious vulnerabilities even on heavily-pentested scopes.

A Bug Bounty Program extends and maximises your security testing coverage through an unlimited pool of ethical hackers and a continuous, flexible audit of your growing attack surface.

But to comprehensively secure your attack surface, you must first understand its size and composition. Hence Gartner cited continuous Attack Surface Management (ASM) as a 

 that gives a real-time, comprehensive picture of your attack surface (including the third-party assets that the SEC’s Erik Gerding expressed concern about).

The ASM, which leverages a Continuous Threat Exposure Management (CTEM) model, also detects your online assets’ exposure to known vulnerabilities and provides automated, risk-based prioritisation of those security flaws.

How can I reassure investors or other stakeholders over our cybersecurity posture given budgetary and recruitment challenges?

 flat or shrinking cybersecurity budgets in 2023, while the global shortfall in infosec skills reached a 

Fortunately, the YesWeHack platform can both increase the cost-effectiveness of your OffSec strategy and unlock access to various skills – from problem solving to cloud security – apparently 

lacking in the current infosec jobs market

YesWeHack offers a pay-by-results testing model (paying only for valid, actionable bugs, according to severity), and substantially streamlines vulnerability management and remediation.

 solution consolidates pentest findings from all providers into one, user-friendly reporting interface. Similarly, the overall YesWeHack platform combines asset discovery with vulnerabilities from various sources – ASM auto-scanning, pentests, Bug Bounty, VDP – into a single interface.

The result is a unified, comprehensive and risk-based approach to security testing.

What do the SEC’s new cybersecurity rules and enforcement stance mean for the role of CISOs and senior executives?

In addressing boardroom-level oversight of cybersecurity risk management, the new SEC cyber rules are a firm reminder to CISOs and other senior executives that they bear ultimate responsibility for their organisation’s cybersecurity posture. The SolarWinds action serves notice that they can be held to account if they fall short.

“It’s clear that delegating oversight entirely to the security team, striving merely for ‘box-ticking’ compliance, or simply throwing money at the cybersecurity problem will no longer suffice,” says Rodolphe Harand, managing director of YesWeHack. “More than ever, CISOs must frequently ‘reality check’ their online risks.

“To this end, they must source the best, most cost-effective processes and technologies for the proactive discovery, evaluation and mitigation of risks – and in a way that is easy to convey to regulators and their stakeholders. We believe the YesWeHack platform can efficiently facilitate these goals.”

The YesWeHack platform provides real-time visibility of your potential attack vectors and a unified, multi-layered model for uncovering, prioritising and remediating vulnerabilities. It also provides functionality that facilitates the production of what the SEC calls “consistent, comparable, and decision-useful” disclosures.

Real-time tracking of vulnerability reports

Real-time view of your ‘asset coverage’ – ie, seeing which assets are currently being tested, by which methods, and the outcomes so far

Integrations with popular bug-tracking tools

Ability to certify compliance and share vulnerability information with authorities via dashboards and one-click generation of proofs of audit and exportable executive summaries

YesWeHack’s GDPR compliance, CREST accreditation plus ISO 27001 and ISO 27017 certifications can give stakeholders further reassurance. The same applies to our zero-trust network, bombproof infrastructure and state-of-the-art encryption, among 

Proactive, multilayered and unified security testing is a strategic investment. CONTACT OUR SALES TEAM to BOOK A DEMO of our Bug Bounty service or ASM, and to find out more about how your organisation can secure your growing attack surface cost-effectively.

Best Practices

Countdown to NIS 2 compliance: Key insights and implications for your SecOps strategy

UK PSTI Act: ‘World first’ IoT security rules offer reminder of VDP virtues

US SEC cyber rules, SolarWinds CISO charges: How a unified OffSec strategy can enhance your SEC disclosures

9 rules for a successful first-time Bug Bounty Program

Busting Bug Bounty misconceptions

How Bug Bounty and Attack Surface Management can help you comply with the Digital Operational Resilience Act’s upcoming requirements

9 rules for a successful first-time Bug Bounty Program

Turnkey VDP Open Source: making a difference in enhancing cybersecurity as a “public good”

Let’s get the IoT landscape less vulnerable for all

3 Ways Customisable Bug Bounty Programs Improve Flexibility and Agility

Turnkey VDP Open Source: making a difference in enhancing cybersecurity as a “public good”

3 Ways to Increase Profits by Driving Agility with Bug Bounty Programs

3 Ways to Reduce Overhead Costs and Resources with Bug Bounty Programs

3 Ways to Stretch Your Security Budget Further With Bug Bounty Programs

3 Ways to Increase Profits by Driving Agility with Bug Bounty Programs

Produits

Chercheurs

Ressources

A propos

Suivez-nous