4 ms·

I don't think it's entirely fair to say there is no competition in this market. In the end companies are still competing for a limited supply of ethical hackers

I don't think it's entirely fair to say there is no competition in this market. In the end companies are still competing for a limited supply of ethical hackers. Except that it is a bit of an unusual market, since both sides are operating with very limited information. Perhaps it will become more stable when people realise you can sell negative results as well (either implicitly by cooperating, or through an actual market). Anything that can bridge the gap between hackers wanting to get paid for their efforts and companies wanting to pay for results would help. More volume would also help, in the end it's hard to sustain a whole industry on just tens or hundreds of millions per year.

vmception 6y ago
> I don't think it's entirely fair to say there is no competition in this market Good thing I never said that. The market is inefficient. I like that idea of monetizing negative results. More transaction volume generally helps, I think external market signals and their actual value are whats really missing. Like, how much would someone pay for an exploit should dictate how much a company should pay for letting a crowd try to fix it where only one person/group gets the payment. If there was a way for additional participants to get paid for bothering to look at all that would be helpful too, and different people can focus on how people try to game that instead of worrying about the idea of people gaming it.
- albntomat0 6y ago
  Aren't negative results already monetized, through standard pen-testing servcies? The usefulness of a negative result is dependent on the thoroughness and skill of attacker, while a positive result is useful no matter who submits it. An unknown person finding a vulnerability has clear value, but a negative result from an unknown person doesn't mean much.
  - contravariant 6y ago
    A negative result has value as long as it's clear what vulnerabilities have been tested. Of course it's pointless if you don't trust the person testing it, but that's always going to be a problem. I guess you might need to have reproducibility to make it truly useful.
    - albntomat0 6y ago
      That seems to me to be mostly limited to automated tools, or checklist level evaluation? The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.
      - ozim 6y ago
        Then comes risk management and I would tell you "good bugs that require creativity and deep system knowledge to find" are not dangerous. It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".
      - bashwizard 6y ago
        It's not. Running scanners and report scan results won't get you paid so it's a complete waste of time. Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.

vmception 6y ago

> I don't think it's entirely fair to say there is no competition in this market Good thing I never said that. The market is inefficient. I like that idea of monetizing negative results. More transaction volume generally helps, I think external market signals and their actual value are whats really missing. Like, how much would someone pay for an exploit should dictate how much a company should pay for letting a crowd try to fix it where only one person/group gets the payment. If there was a way for additional participants to get paid for bothering to look at all that would be helpful too, and different people can focus on how people try to game that instead of worrying about the idea of people gaming it.

albntomat0 6y ago
Aren't negative results already monetized, through standard pen-testing servcies? The usefulness of a negative result is dependent on the thoroughness and skill of attacker, while a positive result is useful no matter who submits it. An unknown person finding a vulnerability has clear value, but a negative result from an unknown person doesn't mean much.
- contravariant 6y ago
  A negative result has value as long as it's clear what vulnerabilities have been tested. Of course it's pointless if you don't trust the person testing it, but that's always going to be a problem. I guess you might need to have reproducibility to make it truly useful.
  - albntomat0 6y ago
    That seems to me to be mostly limited to automated tools, or checklist level evaluation? The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.
    - ozim 6y ago
      Then comes risk management and I would tell you "good bugs that require creativity and deep system knowledge to find" are not dangerous. It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".
    - bashwizard 6y ago
      It's not. Running scanners and report scan results won't get you paid so it's a complete waste of time. Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.