Vulfosec

A bug bounty marketplace has to be trusted by two populations who do not trust each other. Companies are being asked to invite strangers to attack their systems; researchers are being asked to disclose an exploit before they have been paid for it. Neither decision is made on features. Both are made on whether the organisation looks like it will behave properly — which is why, for this business, the website is not marketing collateral. It is the first underwriting decision either side makes.

Paid in bug bounties in one year

$81m

Across HackerOne programmes, up 13% year on year, with the top ten programmes accounting for $21.6m of it.

Source · HackerOne figures, as reported by BleepingComputer

Average award for a critical vulnerability

$1,923

With 88 individual rewards above $10,000 in a twelve-month period. The top of the market is thin and the middle is modest.

Source · HackerOne, bug bounty industry report announcement

Of Forbes Global 2000 lacking a disclosure policy

93%

No stated route for a researcher to report a vulnerability without legal risk. This is the unserved demand the category exists on.

Source · Elazari and colleagues, Journal of Cybersecurity (Oxford)

Audiences, one funnel

2

Researchers and companies want different proof from the same pages, and the marketplace is worthless if only one side signs up.

Model · Structural fact about the marketplace, from this case study.

The market has money in it, and most large companies are not in it yet

Bug bounty is no longer speculative. HackerOne's programmes paid out $81m in bounties over a twelve-month period, a 13% year-on-year increase, with the top ten programmes alone accounting for $21.6m 1. The platform's cumulative researcher earnings passed $300m several years ago 2.

The more useful figure for a new entrant is the gap. Peer-reviewed work on the economics of bug bounties, using HackerOne data, notes that 93% of companies in the Forbes Global 2000 have no vulnerability disclosure policy at all 3 — no stated route by which a researcher can report a flaw without fear of being sued.

• ~$71.7m
• $81m

• Prior year
• Reported year

Model · The $81m and the 13% year-on-year increase are as reported by BleepingComputer; the prior-year figure is our back-calculation from those two numbers.

Two audiences, two entirely different objections

60%of the persuasion budget goes to the enterprise buyer

Enterprise security buyer60%

Fewer, slower, and the ones whose budget makes the marketplace exist. Their objection is competence.

Security researcher40%

More numerous and faster to convince. Their objection is whether they will actually get paid, and how quickly.

Model · Our weighting of the two audiences documented in this case study by acquisition difficulty and revenue contribution.

Motion doing explanatory work

GSAP sequences carry the bounty lifecycle: submission, triage, payout. That is the one thing a first-time visitor on either side of the marketplace does not have, and it is genuinely hard to convey in a paragraph. Using motion to explain a process is a different discipline from using it to decorate a hero — the test is whether a visitor could describe the flow afterwards.

1. 01Programme published

   Scope, rules of engagement and reward bands stated up front. For a researcher, out-of-scope work is unpaid work, so ambiguity here costs the marketplace its supply.

   ▾

2. 02Researcher submits

   The moment a researcher gives up their only leverage. Everything after this is a promise the platform has to keep.

   ▾

3. 03Triagedecision

   Validity, severity and duplication assessed. The single most important stage for both sides, and the one the marketing site has to make legible.

   • ↳ Duplicate → the most contested outcome in the industry
   • ↳ Out of scope → rejected, and reputational risk sits with the platform
   • ↳ Valid → severity determines the award band
   ▾

4. 04Disclosed to the company

   With enough detail to reproduce and remediate. This is where the buyer's engineering time is either respected or wasted.

   ▾

5. 05Payout, and a fixed vulnerability

   The researcher is paid and the company is safer. Payout speed and consistency are the marketplace's actual reputation — features are not.

1. L1

   Narrative surface

   Explains the bounty lifecycle to two audiences at once. The hardest content problem in the project.

   • Next.js
   • TypeScript
   • Tailwind CSS
2. L2

   Motion

   Sequences the submission, triage and payout flow. Explanatory, timed to reading rather than to arrival.

   • GSAP
   • Framer Motion
3. L3

   Visual system

   Deep navy and technical typography. In security, restraint reads as seniority and exuberance reads as a startup that will be gone next year.

   • Deep Navy
   • Primary Blue
   • Ice White
   • Technical type scale
4. L4

   Design tokens

   Published with the build so the marketplace product and the corporate site do not drift into two brands.

   • Type tokens
   • Colour tokens
   • Spacing tokens
5. L5

   Component layer

   Composed surfaces built on a shared primitive set, so new pages inherit the visual argument.

   • Aceternity UI
   • Shared primitives

What we would watch

References

1. 1.HackerOne paid $81 million in bug bounties over the past year · BleepingComputer
2. 2.Hackers surpass $300 million in all-time earnings on the HackerOne platform · HackerOne
3. 3.Hacking for good: leveraging HackerOne data to develop an economic model of bug bounties · Journal of Cybersecurity, Oxford University Press
4. 4.HackerOne report shows bug bounty industry and bounty rewards are on the rise globally · HackerOne