The missing figure is how many hours those hackers spent. Most of the companies that were on HackerOne when last I checked are using the platform as a kind of a

The missing figure is how many hours those hackers spent. Most of the companies that were on HackerOne when last I checked are using the platform as a kind of a substitute for contracting with a pen test firm. Things like "will you break my website". With bug bounties, the payout is only for vulnerabilities found, not for analysis effort, and therefore one has to carefully weigh the expectancy. I think that vulnerabilities found is the wrong metric for the industry, because it is really downstream of the true desire. If anything, the metric should be complexity removed. Prove that you made the system simpler.