The “Vulnpocalypse” Is Reshaping the Economics of Bug Bounty Programs

Dark Reading put a pithy term in its headline — the “vulnpocalypse.” That's how the authors describe a situation in which so many vulnerabilities are being found and published that, in their view, it is changing the very economics of programs that reward discovered flaws — bug bounties.

The logic of the claim in the article's title is simple: the more vulnerabilities come onto the market, the differently they are valued. The abundance knocks out the old benchmarks for worth — what once counted as a rare and expensive find loses value amid the glut, and setting priorities among hundreds of reports becomes a task in its own right, both for researchers and for the companies that run these programs.

Unfortunately, we were unable to obtain the full text of the article, so we cannot cite specific numbers, expert assessments, or examples of programs that lost or gained from this repricing. We'll limit ourselves to what is captured in the headline itself: the community notices a structural shift in how the paid vulnerability-hunting market is arranged, and proposes a resonant name for it.

If the topic of bug bounty repricing is close to your heart, the original piece is worth reading in full at the link below.

Source: Lobsters