Overview
Direct Answer
A crowdsourced security initiative in which organisations offer monetary rewards to external researchers who identify and responsibly disclose software vulnerabilities before public exploitation. This model leverages distributed expertise to uncover defects that internal testing may overlook.
How It Works
Organisations publish vulnerability scope, submission guidelines, and reward tiers on dedicated platforms or websites. Security researchers probe applications, systems, or infrastructure within defined parameters, document findings with proof-of-concept evidence, and submit reports through controlled channels. The organisation validates each submission, assigns severity ratings, and disburses payment upon verification and remediation.
Why It Matters
The approach substantially reduces time-to-discovery for critical flaws while distributing security assessment costs across a global talent pool. Organisations gain access to specialised expertise at lower expense than maintaining equivalent internal security teams, whilst researchers earn income for specialist work.
Common Applications
Major software vendors, financial services platforms, cloud infrastructure providers, and consumer technology firms operate ongoing programmes. Technology companies including Microsoft, Google, and Apple maintain active initiatives; financial institutions and healthcare providers similarly utilise the model to protect sensitive systems.
Key Considerations
Programmes require clear scope definition and legal frameworks to prevent scope creep and litigation. Reward calibration and response timeliness directly influence researcher participation rates and data quality; poorly managed initiatives risk reputational damage or delayed vulnerability remediation.
More in Cybersecurity
Extended Detection and Response
Offensive SecurityA unified security platform that integrates multiple security tools and data sources for comprehensive threat detection.
Zero-Day Vulnerability
Offensive SecurityA software security flaw unknown to the vendor that can be exploited before a patch is available.
Denial of Service Attack
Offensive SecurityAn attack designed to make a machine or network resource unavailable by overwhelming it with traffic.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
SOC 2
Security GovernanceAn auditing framework that evaluates the security, availability, processing integrity, confidentiality, and privacy of service organisations.
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.
Biometric Authentication
Identity & AccessUsing unique biological characteristics like fingerprints, facial features, or iris patterns to verify identity.
ISO 27001
Security GovernanceAn international standard for information security management systems specifying requirements for establishing and maintaining security.