It Takes a Crowd to Defeat a Crowd“Cybersecurity isn’t a technology problem — it’s a human one — and to compete against an army of adversaries we need an army of allies.” CASEY ELLIS, Founder, Bugcrowd0%Why Crowdsourced Security?Crowdsourced Security is a powerful tool – used by leading edge firms such as Google, Apple and Facebook – to decrease risk. However crowdsourced security is not yet well understood across the enterprise security community. This brief will define crowdsourced security and describe why it’s a key element of any viable security architecture.There is a fundamental imbalance between the creativity and motivations of cyber attackers, and those of enterprise security defenders.Crowdsourced security eliminates this imbalance by harnessing whitehat security researchers to find and eliminate vulnerabilities.Crowdsourced security provides focused results to support rapid risk reduction, cost control, and lower operational overhead.Partnering with an established crowdsourced security platform largely eliminates overhead and maximizes risk reduction.Crowdsourced security supports the most critical attack surfaces: web and APIs interfaces on server/cloud, mobile and IoT platforms.Highly vetted, trusted security researchers and private programs diffuse concerns of risk associated with crowdsourced security.How It WorksCrowdsourced Security: A Human-Based Approach to Risk ReductionDEFINEDesign Your ProgramYou define the attack surfaces you need to harden, for example web application front ends or a mobile application.PUBLISHConnect to The CrowdDepending on the type of program, you either publish the program broadly to the researcher community, or engage a more limited set of researchers in a private “invite only” program.TRIAGEFind VulnerabilitiesAs vulnerabilities are uncovered by the researchers, they are triaged to determine validity and severity.REWARDIncentivize ResultsYou pay a reward (or grant public “kudos”) to the researcher for finding the problem, patch the vulnerability, and verify that the attack vector has been closed.Learn More About the PlatformWhy it WorksTrue Risk ReductionRewards are tied to successful outcomes — finding vulnerabilities you need to know about.SpeedThe first hacker to find a vulnerability is rewarded, encouraging hacker to work quickly.ValueThe more critical the vulnerability found, the bigger the reward to the hacker, driving better value.Seek Protects Its Employment Marketplace“Being able to use real examples of previous bugs enables developers to look at their attack surface in a different way.”Pamela O’Shea, Principal Security Consultant, SEEK READ THE CASE STUDYWhere it WorksWeb Front-EndAPIx86 Server /CloudMobileIoTCrowdsourced security supports today’s key attack surfaces, on all key platforms, as well as “the unknown.” As organizations move to cloud architectures and applications, the biggest concerns are web application front ends and APIs, which may be deployed on IoT devices, mobile apps, or on-prem/cloud. All of these can be evaluated for risk by crowdsourced security. Furthermore, a public crowd program can uncover risk in areas unknown to the security organization, such as shadow IT applications or exposed perimeter interfaces.Using crowdsourced security lowers security costs and operational overhead. There is no agent software on applications or clients, and no software instrumentation to support. There are no network devices or virtual appliances to install and manage. There is also little to no operational waste caused by false positives or low-priority events. As security budgets come under increasing scrutiny, crowdsourcing becomes an obvious choice for simultaneously controlling costs while still aggressively protecting the business.Explore our OfferingsPenetration TestingCrowdsource human intelligence at scale to discover high-risk vulnerabilities faster.ExploreBug BountyTake a proactive, pay-for-results approach by actively engaging with the Crowd.ExploreVulnerability DisclosureMeet compliance and reduce risk with a framework to receive vulnerabilities.ExploreAttack Surface ManagementFind, prioritize, and manage more of your unknown attack surface.ExploreFree GuideThe Ultimate Guide to Managed Bug BountyA comprehensive guide to crowdsourced security and the how to implement a successful managed bug bounty program as part of your application security strategy.Get your CopyFrom Our BlogJanuary 10, 2021All You Need to Know About Bug Bounty Testing EnvironmentsDecember 17, 2020You’ve Got Mail! – Receiving Bugcrowd Private Program InvitesDecember 15, 2020Put Another ‘X’ on the Calendar: Researcher Availability now live!MORE BLOG POSTSNewsDecember 15, 2020High-Risk Vulnerabilities Discovery Increased 65% in 2020December 15, 2020Bugcrowd Study Reveals 65% Increase in Discovery of High-Risk Vulnerabilities in 2020 Amid COVID-19 PandemicDecember 14, 202026 Cyberspace Solarium Commission Recommendations Likely to Become Law With NDAA PassageMORE NEWSEventsExcellerate your Hunting with Bugcrowd and Microsoft!In partnership with Microsoft, Bugcrowd is excited to announce the launch of Excellerate, a tiered incentive program that will run…Register NowMORE EVENTS
December 15, 2020Bugcrowd Study Reveals 65% Increase in Discovery of High-Risk Vulnerabilities in 2020 Amid COVID-19 Pandemic
December 14, 202026 Cyberspace Solarium Commission Recommendations Likely to Become Law With NDAA Passage