Colin Mc Hugo

0 %
Colin Mc Hugo
Security Engineer Manager & CEO at Quantum Infinite Solutions Group Ltd.

Top 5 Bug Bounty Programs to Watch in 2021

February 8, 2021
Bug Bounty Programs

Whereas Gartner doesn’t have a devoted Magic Quadrant for Bug Bounties or Crowd Safety Testing but, Gartner Peer Insights already lists 24 distributors within the “Software Crowdtesting Providers” class.

Now we have compiled the highest 5 most promising bug bounty platforms for these of you who need to improve your current software program testing arsenal with information and experience from worldwide safety researchers:

1. HackerOne

Being a unicorn backed by quite a few respected enterprise capitalists, HackerOne might be essentially the most well-known and acknowledged Bug Bounty model on the planet.

In response to their most up-to-date annual report, over 1,700 firms belief the HackerOne platform to reinforce their in-house utility safety testing capacities. The report likewise says that their safety researchers earned roughly $40 million in bounties in 2019 alone and $82 million cumulatively.

HackerOne can be well-known for internet hosting US authorities Bug Bounty applications, together with the US Division of Protection and US Military vulnerability disclosure applications. Like another industrial suppliers of Bug Bounties and Vulnerability Disclosure Applications (VDP), HackerOne now additionally provides penetration testing companies full of vetted safety researchers from across the globe. HackerOne has a strong portfolio of safety certifications, together with ISO 27001 and FedRAMP authorization.

2. BugCrowd

Based by cybersecurity knowledgeable Casey Ellis, BugCrowd might be essentially the most inventive and creative Bug Bounty platform. BugCrowd actively promotes not simply the standard crowd safety testing companies but additionally assault floor administration and a broad spectrum of penetration testing companies for IoT, API, and even community, staying forward of their opponents on the quickly rising crowd labor market.

BugCrowd additionally aptly advertises quite a few Software program Growth Life Cycle (SDLC) integration capacities, making the DevSecOps workflow sooner and simpler for his or her rich shoppers.

BugCrowd is legendary for internet hosting Bug Bounty applications for such business giants as Amazon, VISA, and eBay, in addition to the commemorated (ISC)² cybersecurity schooling affiliation. Many freshmen within the safety analysis are effectively accustomed to BugCrowd due to the BugCrowd College, ongoing safety webinars, and coaching BugCrowd well organizes each for his or her prospects and researchers.

3. OpenBugBounty

The skyrocketing OpenBugBounty challenge is the one non-for-profit vulnerability disclosure and Bug Bounty platform on our listing. Its Alexa rank says OpenBugBounty is about to surpass most of its industrial opponents efficiently.

With over 1,200 lively Bug Bounty applications, OpenBugBounty additionally permits coordinated disclosure of safety points on any web site if the difficulty was detected by non-intrusive means. Bug Bounty program creation is completely free, and the web site house owners should not required to make financial funds to the researchers – however are inspired at the very least to thank the researchers and supply a public advice for his or her efforts.

OpenBugBounty hosts Bug Bounty applications for such firms as A1 Telekom Austria and Drupal, with over 20,000 safety researchers and virtually 800,000 safety vulnerabilities submitted up to now. The platform says its insurance policies and disclosure processes are primarily based on ISO 29147 customary.

OpenBugBounty additionally cooperates with nationwide CERTs and legislation enforcement businesses by offering them with a free API to the platform whereas preserving vulnerability particulars confidential except a researcher discloses his or her findings to the general public.

4. SynAck

Backed by many famend VC funds, together with Intel Capital and Kleiner Perkins, SynAck was named “CNBC Disruptor” firm 4 instances in a row, from 2015 to 2019. SynAck stands atop industrial Bug Bounty platforms, additionally named in Gartner’s High 25 Enterprise Software program Startups.

Based by Jay Kaplan and Mark Kuhr, safety visionaries and respected veterans of the US nationwide safety businesses, SynAck provides an elite workforce of totally vetted cybersecurity researchers referred to as “Pink Crew” (SRT). In response to SynAck, the SRT group consists of safety consultants with verified backgrounds and credible business expertise.

SynAck efficiently positions itself because the chief in trusted crowd safety testing companies by performing complete due diligence on their Pink Crew and recording all their actions for future evaluation or overview. Lastly, SynAck has efficiently developed partnerships and know-how alliances with the business leaders, together with Microsoft, AWS, and HPE, demonstrating robust potential for additional development.

5. YesWeHack

YesWeHack is the rising star of our score for 2021. The one European Bug Bounty and vulnerability disclosure firm, YesWeHack effectively attracts EU-based firms whose principal concern is strict privateness and knowledge safety. Not too long ago, YesWeHack introduced a document 250% development throughout 2020 in Asia, demonstrating that European startups are able to scaling globally.

Just like BugCrowd, YesWeHack is effectively ready to spend money on its human capital. Final 12 months, it launched a coaching program to assist Bug Bounty hunters hone their hacking expertise with the YesWeHack DOJO platform. It options introductory programs and coaching challenges targeted on particular safety vulnerabilities and playgrounds.

With DOJO, safety researchers from everywhere in the world can enhance their software program safety testing expertise. Lastly, YesWeHack persuasively demonstrates its capability to draw respected European prospects such because the French OVH conglomerate.

Bug Bounties have began their transformation from pure crowd safety testing to all-in-one cybersecurity platforms, providing basic penetration testing and a myriad of different companies. At present, it’s troublesome to foretell how profitable their providing will probably be in opposition to conventional MSSPs and cybersecurity distributors; nonetheless, Bug Bounties actually created a brand new market area of interest with highly effective potential.

Whereas the open and free OpenBugBounty challenge brings maturity into the enterprise, because the open-sourced Linux did in opposition to Microsoft many years in the past, later giving beginning to a multi-billion Pink Hat enterprise.

That is an indicator that the Bug Bounty market is turning into larger and extra aggressive whereas the newcomers are nonetheless becoming a member of the sport. We might in all probability anticipate much more Enterprise Capital and M&A offers fostering additional growth of the gang safety market.

Posted in SecurityTags:
Write a comment