Look Who it Was Random video

To bounty, or not to bounty? Security@ insights from 500 organizations - Alex Rice - AppSec Ca 2016

572 views · Published 22 March 2016 · 49:50 · Indexed 1 November 2026

Channel: OWASP Foundation · 2016 · Science & Technology

Watch on YouTube

Security@ addresses across the internet are experiencing a surge in activity as organizations embrace collaboration with the security researcher community through vulnerability disclosure programs. In our journey to uncover the perfect approach, one thing became certain: every organization is wildly unique and there is no one size fits all answer. To understand what exactly contributes to a successful program, we've analyzed aggregate Security@ data from over 500 organizations and devised a weighted index across six dimensions:

* Researcher Breadth
* Researcher Depth
* Vulnerabilities Found
* Response Efficiency
* Reward Competitiveness
* Signal Ratio

The result is an advanced framework for quantifying impact and assessing the performance of these programs. Whether you already run an active bug bounty program or still have a security@ address that bounces, you can expect this talk to help you shed blind dogma and walk away armed with an analytical approach to running an effective Security@.

Alex Rice
Alex Rice is a co-founder and the Chief Technology Officer at HackerOne, providing a platform that enables organizations to build strong relationships with a community of security experts. Alex is responsible for developing the HackerOne technology vision, driving engineering efforts and counseling customers as they build world-class security programs. In addition to his role at HackerOne, Alex also serves on the board for the Internet Bug Bounty, a nonprofit organization focused on rewarding friendly hackers who contribute to a more secure Internet. Prior to HackerOne, Alex founded the product security team at Facebook, built one of the industry’s most successful security programs and introduced new transport layer encryption used by more than a billion users.
-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel