Overview
Direct Answer
A crowdsourced security initiative in which organisations offer monetary rewards to external researchers who identify and responsibly disclose software vulnerabilities before public exploitation. This model leverages distributed expertise to uncover defects that internal testing may overlook.
How It Works
Organisations publish vulnerability scope, submission guidelines, and reward tiers on dedicated platforms or websites. Security researchers probe applications, systems, or infrastructure within defined parameters, document findings with proof-of-concept evidence, and submit reports through controlled channels. The organisation validates each submission, assigns severity ratings, and disburses payment upon verification and remediation.
Why It Matters
The approach substantially reduces time-to-discovery for critical flaws while distributing security assessment costs across a global talent pool. Organisations gain access to specialised expertise at lower expense than maintaining equivalent internal security teams, whilst researchers earn income for specialist work.
Common Applications
Major software vendors, financial services platforms, cloud infrastructure providers, and consumer technology firms operate ongoing programmes. Technology companies including Microsoft, Google, and Apple maintain active initiatives; financial institutions and healthcare providers similarly utilise the model to protect sensitive systems.
Key Considerations
Programmes require clear scope definition and legal frameworks to prevent scope creep and litigation. Reward calibration and response timeliness directly influence researcher participation rates and data quality; poorly managed initiatives risk reputational damage or delayed vulnerability remediation.
More in Cybersecurity
Multi-Factor Authentication
Identity & AccessAn authentication method requiring two or more verification factors to gain access to a resource.
Biometric Authentication
Identity & AccessUsing unique biological characteristics like fingerprints, facial features, or iris patterns to verify identity.
Security Audit
Security GovernanceA systematic evaluation of an organisation's information system security by measuring compliance with established criteria.
Security Orchestration, Automation and Response
Defensive SecurityA technology stack that integrates security tools and automates incident response workflows, enabling faster triage, investigation, and remediation of security alerts.
End-to-End Encryption
Data ProtectionA communication system where only the communicating users can read the messages, with encryption at both endpoints.
Secure Access Service Edge
Network SecurityA cloud architecture that converges networking and security services including SD-WAN, firewall, and zero trust access into a unified cloud-delivered platform.
Identity Threat Detection and Response
Identity & AccessSecurity solutions focused on detecting and responding to identity-based attacks such as credential theft, privilege escalation, and compromised service accounts.
Honeypot
Defensive SecurityA decoy system designed to attract attackers and study their methods while protecting real systems.