On Bounties and Boffins

Summary: A Trail of Bits review of the chapter 'Fixing a Hole: The Labor Market for Bugs' reports that bug bounty payouts follow a Pareto distribution, with a small group of prolific researchers earning most of the money. In data from 61 HackerOne programs over 23 months and one Facebook program over 45 months, the 7% of participants with 10 or more bugs were paid for 1,622 bounties while the other 93% earned 2,523, and the top 1% in the HackerOne data (6 participants) landed 161 bounties.
Key Takeaway: The top seven Facebook participants averaged 0.87 bugs per month and about $34,255 a year, and the top six on HackerOne averaged $16,544 - so a company's security can hinge on whether a single high performer gives your product enough hobby time, while a critical bug could instead be sold to an offensive buyer for far more.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026