• penetration testing, vulnerability assessment

Over the years we have heard arguments claiming one is better than the other. What will get you the most bang for your buck though… PenTesting vs Bug Bounty, which one is right for you?

Bug Bounty

When should you choose a bug bounty program over a PenTest? This varies and there are factors to consider such as how important the CIA (confidentiality, integrity, Availability) goals are to your (Web/Mobile) application or network. Is your organization a potential high-value target?

Generally speaking, bug bounties should be utilized once PenTesting reports come back empty.

  • Pros

    • Only pay if and when vulnerabilities are discovered.
    • Cost effective when done correctly.

  • Cons

    • Does not meet most information security standards (i.e. PCI-DSS, NIST, etc…)
    • Gives adversaries an excuse to probe your environment.
    • No real commitment or guarantees of high-confidence testing.

Penetration Testing

When should you choose PenTesting over a bug bounty program? Every Time! Joking. Joking. Unless budget is not a concern. You should typically go with PenTesting until two different companies give you an empty report for your application.

  • Fixed Cost

    This may seem counterintuitive at first. However, bug bounties pay per vulnerability. If you have never had a penetration test performed this can add up quickly. If you don’t pay a substantial reward, the hackers may seek higher payments for their findings elsewhere.

  • Fast Results

    When you hire Penetration Testers, they have a start and stop date. They are not only trying to grab the low hanging fruit, they will want to impress you in hopes of future business.

  • Rapport

    Perhaps this one is obvious but having some rapport with the people hacking your organization is incredibly important. Think about it, if a vulnerability is found by a stranger, what keeps them from turning around and selling it to their own government?

    • Typically bug bounties are very low compared to what nation states and organized crime will pay.
      • (This is why competent Ethical Hackers choose the route of professional penetration testing.)
    • Demand vetted professionals within the United States’ jurisdiction or at least a nation with extradition.