Cyber security is a paying profession and I don't think bug bounties undercut that. A company that's not willing to pay and wants to put in place a bug bounty w

Cyber security is a paying profession and I don't think bug bounties undercut that. A company that's not willing to pay and wants to put in place a bug bounty will get what it pays for, which is a mystery to them and us. Others will pay. Fin Tech companies, for instance, have regulations that require a professional audit every year. We recently paid out over $25k for one of them (and it was worth it, their guys found some extremely subtle vulnerabilities). Also hacking on sites for fun and profit is fun and something some people like to do in their spare time. So some people are gonna do it no matter what.