A bug bounty program pays independent researchers who find and responsibly report security vulnerabilities in an organization's software — rewards run from tens of dollars for minor issues to hundreds of thousands, occasionally millions, for critical zero-days, paid on platforms like HackerOne and Bugcrowd or through company-run programs like Google's and Microsoft's. The model has become standard practice: most large technology companies, major government agencies including the U.S. Department of Defense, and an expanding roster of non-tech enterprises run continuous programs, and dedicated vehicle, blockchain, and AI providers have pushed maximum payouts upward through the mid-2020s.
How does a program actually work?
The organization publishes a scope — which domains, apps, and products are fair game — and rules: no denial-of-service testing on production, no social engineering of staff, no public disclosure before the fix. A researcher finds a flaw, writes a report demonstrating impact, and submits it through the platform. Triage staff verify it, the vendor fixes it, and the reward is paid by severity tier. Most programs operate coordinated disclosure: the report stays private, and details publish after a patch. The researcher's incentives align with the customer's safety — an out-of-scope or already-known bug earns nothing, so effort flows toward genuinely new, genuinely exploitable issues.
Where did this come from?
The idea is old — Netscape ran the first named "Bugs Bounty" in 1995, and iSEC-partnered programs preceded the platform era — but the institutional turning point was 2010-2011, when Google and Mozilla formalized continuous payouts and HackerOne's founding (2012, by former Facebook and Microsoft security staff) industrialized the market. The U.S. government followed: the DoD's Hack the Pentagon in 2016 was the first federal bug bounty, and 2021's stand-up of vulnerability-disclosure programs across federal civilian agencies normalized the practice in government. By the mid-2020s, the market's shape is mature: platforms host thousands of programs, top full-time researchers earn competitive salaries, and bounty payments industry-wide have passed the cumulative billion-dollar milestone on the major platforms.
What do payouts actually look like?
Range by severity and target:
- Small programs and low severity: $50-500 for information disclosure or configuration issues — often swag instead.
- Standard big-tech criticals: $10,000-150,000 for account takeover, authentication bypass, or RCE in a major web property.
- Top-tier programs: Apple, Google, and Microsoft have all crossed the million-dollar line for exceptional findings — Apple's maximum for a chain of zero-days enabling silent wormable exploit, Microsoft's cloud and AI-era top tiers, Google's mobile and chip payouts.
- Zeroday-style acquisition: brokers like Crowdfense and Zerodium publicly list seven-figure offers for full weaponized exploits of phones and messaging apps — the gray counterweight that bug bounties exist to outbid.
Why do companies pay? And what do critics say?
The economics: a critical vulnerability fixed through a bounty costs thousands; the same vulnerability sold to a broker or exploited by ransomware costs millions in incident response, regulatory exposure, and reputation. Bounties also buy visibility into classes of bugs internal teams miss, and researchers who might otherwise drift toward darker buyers stay in the legitimate market. The critiques are fair too: bounties can squeeze independent labs whose overhead a one-off payment does not cover; payouts for the same flaw vary wildly between programs, pushing talent toward rich companies rather than vulnerable ones; and "security research" has been used as cover for sloppy or outright malicious scanning that programs must police. The mature view treats bounties as one layer — alongside internal secure development, third-party audits, and coordinated disclosure policy — not a substitute for any of them.
Can you get started as a researcher?
The realistic path runs through learning before earning. Foundations: web mechanics, HTTP, JavaScript, then the common vulnerability classes catalogued in the OWASP Top 10 and practiced deliberately on legal targets — intentionally vulnerable apps, then training platforms like PortSwigger's Web Security Academy and Hack The Box. First money tends to come from wide-scope, low-payout programs where the competition is thinner. The honest expectations: most first submissions are duplicates of known issues, months can pass before a first valid report, and the skill that pays is writing the impact-demonstrating report, not just popping the bug. For everyone else — the readers who will never file a report — bug bounties matter as a signal: when you choose software from vendors that run serious programs, you are choosing vendors that have invited the world to break their product before someone else does it silently.
For more context, read The cybersecurity skills shortage: how many jobs, and does it even exist?.
For more context, read open source security funding.
For more context, read Why schools are ransomware's favorite target.