skip to Main Content
Thoughts on our Third Annual State of Bug Bounty Report
Since I started Bugcrowd, the one constant has been continual amazement at the pace of growth of the crowdsourced security movement we initiated back in 2012.
Posts by Casey Ellis
Another Milestone in the Evolution of Bugcrowd
As a founder there is nothing better than watching the company I started grow and evolve. In the four and a half years I’ve watched Bugcrowd grow by leaps and bounds – the team has grown threefold in the past year alone. While our guiding principles, core values, and vision of the future of cybersecurity remain unchanged, today we have evolved as an organization. To use a much-used term from the early aughts, we are now very much Bugcrowd 2.0, and I’m proud to announce a brand-new website that reflects just that.
A Look Inside: Bug Bounties vs. Penetration Testing
Can bug bounty programs replace penetration tests?
This question has come up a lot in the past several months and today we released a guide that begins to answer it.
Ongoing coverage of wide-scale ransom attack in progress: How to protect Internet-facing data stores
[Update] Active attacks now include: MongoDB, Elasticsearch and Hadoop.
Two weeks ago the Internet was hit with the first in what has become a frightening trend of ransom attacks. This first attack affected fewer than 200 MongoDB installations and for the most part flew under the radar given the meager sum requested by the attacker (0.2 Bitcoins). However, this attack marked a significant shift in ransom attack model and just two weeks later we’re seeing a major escalation of this model and its impact.
4 Years of Bugcrowd’s Bug Bounty: Evolution and Learnings
Here at Bugcrowd we take our own advice. Four years ago yesterday we launched Bugcrowd’s first bounty program to uncover vulnerabilities in our own applications and web assets.
Okta Launches Public Bug Bounty Program with Bugcrowd
Today we are pleased to announce that after running an extensive private program with Bugcrowd, Okta is launching its first public bug bounty program.
Bug Bounty: Part of This Complete Breakfast
In the past several months, bug bounties have gained popularity in the press and have been adopted with increasing velocity by enterprise organizations. Along with this popularity, the bug bounty model has also received some criticism, and various actors within the industry have raised some very good questions. In keeping with our commitment to transparency, honesty, and education, we thought it was as good as time as any to discuss two specific areas that have cropped up in the past several months, quality and impact, through examining some misconceptions about bug bounties.
Fiat Chrysler – The First Full-Line Automaker to Launch a Paid Public Bug Bounty Program
2015 was the year the public perception of automobile safety changed forever… Chris Valasek and Charlie Miller’s notorious Jeep Cherokee hack transformed the idea of the humble automobile into a 2-tonne computer that can be hacked just like any other. In recent years, automakers are realising that hackers just like Charlie and Chris are already at the table, ready and willing to help, and are leveraging the work coming out of this community to make their products safer from cyber threats.
We are excited to announce that Fiat Chrysler Automobiles is joining the ranks of those pioneering this relationship, by becoming one of the first automakers to launch a bug bounty program.
Bugcrowd’s 2nd Annual State of Bug Bounty Report – A Note from the CEO
Bugcrowd has always held education and sharing as a core value, which is why I’m very pleased to announce the release of our second annual State of Bug Bounty Report.
This 22-page document gives the reader an up-close and personal look at the evolving dynamics of the bug bounty market, and deeper insight into the early stages of the “unlikely romance” blossoming between hackers and organizations. Read the full report
Bug Bounty Adoption in the Financial Services Industry
During FS-ISAC last week, we had our ears to the ground, chatting with security folks about their concerns, challenges and hopes for application security testing and have set out to distill some of our observations and data to discuss the state of application security…
