The researcher bench
Vetted on a live ecosystem, not a résumé.
Researchers who proved themselves hacking our own systems, safely, through our vulnerability disclosure program. The vetted ones test for our clients, by name.
13
valid reports
5
researchers credited
< 1 day
median time to fix
100%
fixed within a week
Why vetted matters
A track record you can read before you hire.
Security work is only as good as the people doing it. So every researcher here has public, fixed findings on real systems, and signs before they test.
Proven on a live ecosystem
Every researcher here earned their place through our own vulnerability disclosure program, on the systems we actually run: identity and sign-in, payments, MCP servers, AI services and web apps. Not a quiz, not a leaderboard on someone else's targets.
Findings you can check
Each credited finding has a public acknowledgment: what kind of issue, how severe, which CWE, and how fast it was fixed. You can read a researcher's track record before you talk to them.
Accountable, not anonymous
Bench researchers sign an Independent Security Researcher Agreement. Every engagement names its testers on a Testing Authorization you sign, with targets, windows, source IPs and rules.
Human-verified, AI disclosed
Tools and AI assistants are welcome and disclosed. Every finding is reproduced by a person with a working proof of concept before it reaches your report.
The researchers
Credited by our vulnerability disclosure program.
Researchers who chose a public profile. Each one links to their findings. Those marked “on the bench” can be scoped onto your engagement.
- Silver
Sakar Bhandari
sakar-bhandari · credited since Oct 2026
7 valid findings · 2,000 points · 4 system types
1 High · 2 Medium · 4 Low
High impactFirst in AI servicesFirst in Web applicationsFirst in Shared sign-in gateway
Status is earned
Researchers unlock more as they prove more.
Like a driver's or host's status on the platforms you know, a researcher's tier comes from their record: points from valid findings plus quality gates, so volume alone never promotes anyone. Tiers are lifetime; seasons add competitions on top.
- Bronze
500+ points
- · Hall of Fame badge
- · Signed, portable credentials for tier, achievements and findings
- Silver
2,000+ points, a Medium or higher finding, findings on two system types, 60% of reports valid
- · Eligible for paid client engagements on the bench
- · Early access to new systems before they open to everyone
- Gold
5,000+ points, a Critical or three Highs, 70% of reports valid
- · First call on engagements and hardware prizes
- · A free membership term
As the program grows, higher tiers will unlock deeper testing access and higher-value work. We're a small, self-funded team and say so: rewards and payouts are what we can sustain, and they're changing as human and AI-assisted work changes.
Working with the bench
How a researcher-led engagement runs.
- 1
Scope it
Tell us what you need tested. Ask for a researcher by name, or let us match skills, systems and time zone.
- 2
Proposal and SOW
Fixed scope and price before anything is signed, under our Master Services Agreement.
- 3
You authorize the testing
A Testing Authorization lists the named testers, targets, out of scope, window, source IPs and test accounts. Testing starts only after you sign it.
- 4
Named researchers test
Criticals are escalated to your contact as soon as they're confirmed, not at the end.
- 5
Report and retest
Reviewed by us before it reaches you, then a retest of what you fixed.
Questions
Common questions.
How is this different from a bug bounty platform?
This is a small, curated bench, not an open crowd. Researchers are vetted on our own live systems, with quality gates on their status, a signed researcher agreement, and named testers on every engagement. And it sits inside a full services marketplace, so the same scope can include vCISO time, compliance work or AI services.
Can we hire a researcher directly?
Some researchers are open to contract or direct-hire conversations as well as scoped engagements; their card says so. Ask on your scoping call and we'll tell you who is available.
Where are the researchers based?
Around the world. Researchers in different time zones mean testing can continue after your own team has signed off for the day. Location also decides which hiring routes are possible, and we tell you upfront.
Why are there so few profiles?
Profiles are opt-in: a researcher's profile is published only after they agree to it. The bench is new and grows as researchers prove themselves through the program.
How do researchers join?
Start with the CISO Marketplace vulnerability disclosure program. Reach Silver or Gold, link your account, and we invite researchers who meet the bar onto the bench.
You're a researcher?
Start with our vulnerability disclosure program. Reach Silver or Gold through valid findings, and we can invite you onto paid client engagements. Along the way you get perks across the whole CISO Marketplace network.