Designing a Vulnerability Rewards Program

Launching a bug bounty program without prior planning usually creates more problems than benefits, because it opens the door to hundreds of researchers testing the infrastructure without the internal team having the capacity to process the reports that come in. Designing the program correctly means defining a clear scope of which assets can be tested and which are explicitly forbidden, a reward table consistent with the severity of each type of finding, and rules of conduct that limit destructive techniques such as denial-of-service attacks. Many organizations start with a private program, inviting a small group of trusted researchers, before opening it publicly, which makes it possible to calibrate the volume of reports and adjust the reward table with real data before exposing themselves to the whole community. A poorly calibrated program, with rewards too low for the effort required, simply doesn't attract serious researchers and ends up generating only low-quality reports.