Security testing programs
Your own bug bounty, without running one.
Bug bounty and disclosure programs, run for you end to end: scope, safe harbor, vetted researchers, triage, fixes verified, researchers paid. You see only real findings.
Our own program, on our own systems
54
valid reports
11
researchers credited
< 1 day
median time to fix
81%
fixed within a week
What we run
Pick the shape that fits your stage.
Every option uses the same vetted researchers and the same triage. They differ in how long they run and how you pay.
Managed bug bounty
An invite-only program on the assets you choose. You fund a bounty pool and set what each severity pays; you pay only for valid, reproduced findings.
Researchers at Bronze and up, invited per program
Private bounty sprint
A focused burst before a launch, a funding round or an audit: fixed scope, a set window, our strongest researchers, and a pool that pays per finding.
Silver and Gold researchers only
VDP setup and operation
A vulnerability disclosure program in your name: policy, scope, safe harbor, intake, triage and researcher communication. Run the way we run our own.
Our team, with Gold researchers for retests
Scoped assessments
Penetration tests, red and purple teams with a fixed scope, named testers and a reviewed report.
Bench researchers and our operators
Offensive security →How a program runs
You decide the scope and the spend. We do the rest.
- 1
Scope and rules
Which assets are in, which are out, what testing is allowed, and the test accounts researchers get. We write the policy and safe harbor with you.
- 2
Set the pool
You choose what each severity pays and the most you'll spend per month. The cap is hard: nothing is paid beyond it without your say.
- 3
Invite researchers
We invite researchers by tier and skill. Each one is bound by our researcher agreement and named on your Testing Authorization.
- 4
We triage
We reproduce every report, rate it, merge duplicates and drop noise. You only see findings with working steps, and criticals reach your contact as soon as they're confirmed.
- 5
Fix and retest
Your team fixes; the researcher or our team retests and confirms the fix holds before anything is closed.
- 6
Pay and report
We pay researchers worldwide and handle their tax forms. You get a monthly report: findings, severity, time to fix and spend against the pool.
Included
Everything a program needs, in one fee.
- Program policy, scope page and safe harbor wording
- Report intake, with evidence uploads and a reference per report
- Triage, reproduction and severity by our team, using a published rubric
- Duplicate handling, so you never pay twice for one issue
- Researcher agreements, Testing Authorizations and named testers
- Worldwide researcher payouts and tax paperwork
- Optional public credit: a Hall of Fame and citable finding pages
- Monthly stats: valid rate, time to fix, spend against the pool
Researchers who earned it on live systems.
Every researcher came up through our own vulnerability disclosure program, on identity, payments, MCP servers, AI services and web apps we actually run. Their status (Bronze, Silver, Gold) comes from valid findings plus quality gates: severity, breadth across systems and a minimum valid rate. Volume alone never promotes anyone.
Harder scopes go to higher tiers. Each researcher signs our agreement and is named on the Testing Authorization you sign before testing starts.
Proof, not promises
We run this on ourselves first.
Our own program covers our live domains, with public monthly stats and a write-up of what researchers found and how fast we fixed it. Your program runs on the same process and tools.
Questions
Common questions.
How is this different from HackerOne or Bugcrowd?
Those are open marketplaces with large crowds. This is a small, invite-only bench of researchers vetted on our own live systems, with quality gates on their status and named testers on every program. It also sits inside a full services marketplace, so the same engagement can include fixes, vCISO time, compliance evidence or AI security work.
What does it cost?
A program fee for running it (scoping, triage, researcher management, reporting) plus the bounty pool you fund. You set what each severity pays and a hard monthly cap. Sprints and assessments are quoted as fixed projects. Scope a call and we'll price it for your assets.
Do we pay for duplicates or noise?
No. We pay only for valid findings we reproduced, once per issue. Duplicates, out-of-scope reports and informational items are closed by us without touching your pool.
Who sees our findings?
Only the researcher who found it, our triage team and your contacts. Programs are private by default. Public credit or disclosure happens only if you choose it, and then after the fix.
Where are the researchers, and how are they paid?
Around the world. They contract with us as individuals under our researcher agreement; we pay them in local currency and collect tax forms. You get one invoice from us.
What if nobody finds anything?
Then your pool is untouched and you have evidence that invited, vetted researchers tested your scope and came up empty, which is useful for customers and auditors. You pay the program fee only.
Can we start small?
Yes. Many programs start as a VDP or a single sprint on one application, then grow into an ongoing bounty once the team is comfortable with the flow of reports.
Ready to put researchers on your scope?
We're opening client programs to a small number of teams first. Tell us what you want tested and we'll propose the right shape.