Organizations’ security vulnerabilities resolve fast whenever hackers are invited to contribute.

HackerOne announced findings from its 2019 Hacker-Powered Security Report -the largest study of bug bounty, vulnerability disclosure and hacker-powered pentest programs. The report examined trends from 120,000+ security vulnerabilities resolved for 1,400+ customers, earning hackers over US$62 million in bounties. 

When the new bug bounty program was launched, in 77% of the cases, hackers reported the first valid vulnerability within 24 hours. 25% of valid vulnerabilities found were classified as being of high or critical severity.

Every five minutes, a hacker reports a vulnerability through a bug bounty or vulnerability disclosure program. Every 60 seconds, a hacker partners with an organization on HackerOne making more than 1,000 interactions per day where hackers works with companies or governments towards a safer internet.

That’s how fast security improves whenever hackers are invited to contribute.

“Hacking is here for good, for the good of all of us,” said HackerOne CEO, Marten Mickos. “Half a million hackers have willingly signed up with HackerOne to help solve one of the greatest challenges our society faces today. We cannot prevent data breaches, reduce cybercrime, protect privacy or restore trust in society without pooling our defenses and asking for external help.”

Report findings include: 

• The average bounty paid for critical vulnerabilities increased to US$3,384 in the past year. A 48% increase over last year’s average of US$2,281 and a 71% increase over the 2016 average of US$1,977. Bounty values for less severe vulnerabilities are also rising, with the average platform-wide bounty increasing 65%.
• Governments had the strongest year over year industry growth at 214%, and last year saw the first launch of programs at the municipal level. Strong program adoption took place in Automotive (113%), Telecommunications (91%), Consumer Goods (64%), and Cryptocurrency & Blockchain (64%) industries.
• The majority of bug bounty programs remain private at 79% with little change from years prior. Public bug bounty programs engage six times as many hackers.  
• Today six out of 10 of the top banks in North America are running hacker-powered security programs on HackerOne. Financial services organisations running hacker-powered security programs increased 41% this year.
• Six hackers surpassed US$1 million in lifetime earnings, seven more hit US$500,000 in lifetime earnings, and more than 50 earned US$100,000 or more in the past year alone. Skilled and dedicated hackers have the potential to build a career and make a competitive living with the opportunities offered by hacker-powered security.
• Globalization of hacker-powered security continues to increase. Several new countries entered the top 10 highest paying, hackers living in 19 countries earned more than US$100,000 in total last year, and more organisations in more countries are hosting live hacking events. Hackers from 84% of all the countries in the world have submitted vulnerability reports. 
• Hacker-powered pentests on the rise as organisations are using hackers to bring simulations of real-world attacks to security testing. In a recent report, one organisation detailed how hacker-powered pen-tests helped them eliminate US$156,784 in total costs and save an additional US$384,793 over three years by reducing internal security and application development efforts.

“Hackers are no longer anonymous guns-for-hire,” the report explains. “They are being embraced by everyone from the insurance industry to government agencies. Today, hacker-powered security is a given part of a mature and proactive security program. It’s not hard to see why. Businesses process more sensitive data and more personal information than ever before. Working with hackers allows you to provide security at the speed of innovation.”

The 2019 Hacker Powered Security Report is the industry’s most comprehensive report on security delivered by hackers, evaluating the topics explained above and more. The data comes from HackerOne’s community of hackers and the database of vulnerabilities reported and resolved.