An Empirical Study of Bug Bounty Programs.¶
Walshe, T., & Simpson, A. (2020). An Empirical Study of Bug Bounty Programs. Proceedings of the 2nd IEEE International Workshop on Intelligent Bug Fixing (IBF), 35-44.
Cited by¶
2 citations across 2 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Community-Distributed Adversarial Learning
- A partially co-opted version appears in bug-bounty and responsible-disclosure communities, where community learning is routed into deployer-friendly channels rather than public adversarial sharing — instructive because it shows the dynamic can be partially redirected.
This sourceEmpirical analysis of bug-bounty / vulnerability-reward programs (HackerOne data), showing how community vulnerability discovery is routed into deployer-friendly, coordinated-disclosure channels — the co-opt move.
Supported in partVerified against the work's full text
Walshe and Simpson show bug bounty platforms channel outside hackers' vulnerability discovery to the deploying organisation, noting it displaces cybercrime-market sales; the 'community learning' framing is the article's.
“This also legitimises the work of many hackers who might otherwise sell the vulnerability reports on cybercrime markets for a similar price”
- A partially co-opted version appears in bug-bounty and responsible-disclosure communities, where community learning is routed into deployer-friendly channels rather than public adversarial sharing — instructive because it shows the dynamic can be partially redirected.
- Verifier-Prover Asymmetry
- The cost-ratio is large enough to support separating the two stages, so the right architecture is crowdsourced finding plus internal verification: a bug-bounty programme that lets several hundred external researchers find while the internal team only verifies and triages.
This sourceEmpirical HackerOne/Bugcrowd analysis showing crowdsourced external finding with internal verification is more cost-efficient than internal hiring — the average annual program cost is below that of two additional engineers.
Supported in partVerified against the work's full text
Walshe and Simpson show bug-bounty programmes cost about as much as one to two engineers, so crowdsourced finding is economically viable; they do not analyse a find/verify cost ratio.
“We find that the average cost of operating a bug bounty program for a year is now less than the cost of hiring two additional software engineers.”
- The cost-ratio is large enough to support separating the two stages, so the right architecture is crowdsourced finding plus internal verification: a bug-bounty programme that lets several hundred external researchers find while the internal team only verifies and triages.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 2 of 2 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:a5b0341e3561 · see in the full table