Actually you are both right. Bug bounty programs are extremely effective because they find serious vulnerabilities for vastly less than the damages you would ex

Actually you are both right. Bug bounty programs are extremely effective because they find serious vulnerabilities for vastly less than the damages you would expect if they were exploited. However, the fact that the bug bounties are so low indicates that the prevailing security is atrocious. To explain, generally speaking a bug bounty is going to the smaller of: 1. Cost of Discovery since that is the amount someone would be willing to find bugs at otherwise they are losing money on each bounty they get. 2. Cost of Damage (risk-adjusted) since that is the most a company would be willing to pay. The reason for this is that as long as the Cost of Discovery is lower than the Cost of Damage (up to ROI), it is reasonable to keep paying the Cost of Discovery since you are paying less than the risk-adjusted harm. But, there is also no point paying significantly more than the Cost of Discovery as long as people keep reporting problems as fast as you can fix them since there is no real reason to pay to get more problems than you can fix. So, to first order the bug bounty for a certain type of problem reflects the cost of discovery of that type of problem. Circling back to the original point, we see problems that can cause millions in damages getting bug bounties on the order of $10K. This means that, to first order, million dollar attacks only cost $10K to execute which results in a crazy high ROI in the 100s. With an ROI in the 100s, it should be no wonder that such attacks have been increasing in frequency given their sheer profitability. The fact that bounties are so low for such critical problems is a major indictment on the prevailing level of security in the industry.