An Empirical Study of Bug Bounty Programs.

Walshe, T., & Simpson, A. (2020). An Empirical Study of Bug Bounty Programs. Proceedings of the 2nd IEEE International Workshop on Intelligent Bug Fixing (IBF), 35-44.

Type

Conference paper

Intellectual base

Primary research

Year

2020

DOI

10.1109/ibf50092.2020.9034828

Link

https://doi.org/10.1109/IBF50092.2020.9034828

Cited from

mathematics, security_intelligence

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Community-Distributed Adversarial Learning
  • A partially co-opted version appears in bug-bounty and responsible-disclosure communities, where community learning is routed into deployer-friendly channels rather than public adversarial sharing — instructive because it shows the dynamic can be partially redirected.

    This sourceEmpirical analysis of bug-bounty / vulnerability-reward programs (HackerOne data), showing how community vulnerability discovery is routed into deployer-friendly, coordinated-disclosure channels — the co-opt move.

• Verifier-Prover Asymmetry
  • The cost-ratio is large enough to support separating the two stages, so the right architecture is crowdsourced finding plus internal verification: a bug-bounty programme that lets several hundred external researchers find while the internal team only verifies and triages.

    This sourceEmpirical HackerOne/Bugcrowd analysis showing crowdsourced external finding with internal verification is more cost-efficient than internal hiring — the average annual program cost is below that of two additional engineers.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:a5b0341e3561 · see in the full table