It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those th

It doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noise. Veracode recently put up an infograpic on bounty programs that was kind of interesting, http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-the-internet-safe-infographic/ http://www.veracode.com/blog/2013/01/can-bug-hunters-keep-th...