CISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings" CEO: "I'm not sure I like the idea of us i

CISO: "We're going to invite random strangers from all around the globe to hack us, and pay them for their findings" CEO: "I'm not sure I like the idea of us inviting people to hack us - or paying a 'bounty' to hackers holding a knife to our throat. Will they at least agree to a binding NDA and terms of engagement, in advance?" CISO: "No, they won't." CEO: "Well, at least if the hackers are in poor countries, a $500 payout for a critical bug will be plenty, right?" CISO: "No, critical issues will be 10-100x that" CEO: "Well will the average quality of these reports better than those we get from our hired pentesters?" CISO: "On average these will be the lowest quality reports you've ever seen. But 0.1% might be gold. Oh, and I need to hire 3 more guys to sift through these terrible reports. Also our sifters might miss the gold." CEO: "Oh. Well at least we won't be breaking the law though, right?" CISO: "Uh, about that..."