4 ms·
They need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.
by HenryKissinger 5y ago
They need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.
- H8crilA 5y agoNot sure why you're downvoted, but the $3M/year total rewards payoff is likely smaller than the corporate administrative and developer time (for review) costs. I.e. if this was a charity it would pay out less than 50 cents on the dollar.
- tptacek 5y agoI downvoted because "cybersec researchers" do not in fact routinely make 7 figures. For strong pentester types reporting the typical (real) vulnerability the VRP handles, the median is probably in the low 6's.
- na85 5y ago6 figures from breaking systems and reporting them responsibly? Sounds amazing, what's the catch?
- tptacek 5y agoThere's no catch. You want a job as a pentester. That job is in high demand.
- kasey_junk 5y agoFrankly low 6 figures sounds low for a software job. How do you attract talent at that level?
- tptacek 5y agoThe median bounty hunter isn't an SFBA software developer.
- kasey_junk 5y agoIs it international arbitrage? Or something else cause low 6 figures is now the going rate all over the states. *not trying to be argumentative just trying to price the market.
- tptacek 5y agoIt's a combination of the lower value of the median bug bounty submission (we hear about the high-ticket vulnerabilities, but most of them are pretty low-test) and the fact that huge numbers of bounty participants are abroad. I know there are people who claim to make high-6's and even low-7's from bounties, but they're very rare. I think most people who participate in bounties would be best off financially by using them to build a portfolio they can exploit to pivot into consulting or full-time work of some other sort.
- fooker 5y agoNot everyone can move from wherever they are to the Bay area though.