Our AI strategy for preemptive security
Bugcrowd and EnDyna have powered CISA’s VDP Platform since its launch in July 2021, providing the infrastructure, triage expertise, and researcher community that make the shared service work at federal scale. What started with eleven Federal Civilian Executive Branch (FCEB) agencies has grown into a program supporting more than 60 customer agencies, all running on the same centralized platform for intake, triage, remediation tracking, and researcher communication.
That growth hasn’t just been about signing up more agencies. Bugcrowd’s role has been to make vulnerability disclosure sustainable for teams that often don’t have the internal bandwidth to manage it alone: dedicated triage teams filter out noise, retesting functionality confirms remediations actually worked, and an integrated bug bounty capability gives agencies an on-ramp to incentivized, crowdsourced testing whenever they’re ready for it.
Five years in, the numbers tell the story of what that partnership has produced across the federal space:
“Five years ago, we set out to prove that preemptive security could work at a federal scale. This report is proof of that,” says Dave Gerry, Bugcrowd CEO. “Every valid disclosure and every remediated vulnerability represents a real reduction in risk for the agencies that serve the American public, and it’s a testament to what happens when the government and the security research community work together with a shared sense of purpose.”
There are a few numbers from the past five years that stand out.
Total submissions have grown from 2,187 in the Platform’s first year to 44,493 cumulatively through June 2026, with nearly 6,000 of those representing valid, actionable disclosures. The Platform’s triage process filters out roughly 87% of inactionable reports before they ever reach an agency, and of the vulnerabilities that are validated, about 95% are ultimately marked resolved.
The researcher community behind those numbers has also scaled significantly, growing to nearly 10,000 unique contributors who’ve collectively engaged with an average of 1.6 FCEB programs each.
The most commonly reported vulnerability classes are:
Bug bounties have also become a meaningful part of the Platform’s value: 15 events run to date have paid out $1.3 million in total rewards, identified 532 vulnerabilities, and attracted 483 researchers. One customer put it simply: “the bug bounty program helps identify high-impact vulnerabilities more quickly through competitive participation, freeing up internal pen testing teams to focus on deeper, more complex attack simulations.”
In 2020, CISA issued Binding Operational Directive 20-01, requiring every FCEB agency to develop and publish a vulnerability disclosure policy. CISA’s VDP Platform was built to give agencies a shared, ready-made way to comply with BOD 20-01 without having to stand up their own intake and triage operations from scratch. Nearly 75% of all vulnerability disclosure reports that have been submitted across the federal government were submitted directly through agencies using the VDP Platform powered by Bugcrowd and EnDyna.
Earlier this year, Bugcrowd announced we achieved FedRAMP Moderate Authorization, sponsored by CISA. This means that federal agencies can now rapidly deploy Bugcrowd’s offensive security testing solutions at scale. This extends beyond vulnerability disclosure. To learn more about Bugcrowd’s solutions for government, check out the solutions guide.
The five-year retrospective is a clear look at what collaborative defense delivers when it’s backed by the right infrastructure and the right community. For more information about the VDP Platform or how to get your agency involved, contact CISA’s VDP Platform team at VDPPlatform@cisa.dhs.gov.