Governance & Risk Management , IT Risk Management , Legacy Infrastructure Security

4 Bug Bounty Myths Dispelled

HackerOne's Laurie Mercer Takes Down Common Misconceptions
Laurie Mercer, security engineer, HackerOne

Bug bounty myths: All such programs must be public, run nonstop, pay cash to bug-spotters and allow anyone to join.

See Also: Expel: Firms Still Threatened by Old Vulnerabilities

Laurie Mercer, a security engineer at HackerOne, says that, in fact, bug bounty and vulnerability disclosure programs are often run as private, invitation-only and time-limited endeavors. In addition, while the average program reward is $600 for finding a significant bug, sometimes simply publicly thanking bug hunters or offering cool swag can suffice as rewards.

In a video interview at the recent Infosecurity Europe conference, Mercer discusses:

  • Bug bounty program common misconceptions and best practices;
  • The emergence of bug bounty millionaire ethical hackers;
  • Better integration with the software development life cycle.

Mercer is a security engineer at HackerOne. His primary focus is on responsible disclosure, vulnerability management and risk reduction for organizations of all sizes and security maturity levels. He's worked with customers as diverse as Queen Elizabeth II and the Chinese government in various roles involving software, security and education.


About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.co.uk, you agree to our use of cookies.