Bug bounty upstart thinks there's BIG MONEY in crowdtesting

Security startup CrowdCurity is marketing a cloud-based platform that allows businesses to set up and run their own bug bounty and security testing programmes.

Bug bounty programmes have become fairly commonplace across the IT industry over recent years. The schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Google's bug bounties are probably the best known in the industry but many other vendors including Facebook and (most recently) Microsoft have launched comparable programmes. An extensive (but perhaps not exhaustive) list can be found here.

Jakob Storm, co-founder of CrowdCurity, told El Reg that despite these many schemes there was still an extensive market left unaddressed. He added that firms already running bug bounty programmes could benefit from outsourcing the day-to-day administration of the programme to CrowdCurity.

"Some vendors have already launched bug bounty programmes but compared with the total market this is a very small fraction," Storm explained via email. "Apart from this we have been in contact with some companies already doing their own bug bounty programmes, and for many of them it is a pain to: 1) set up the programme with terms etc, 2) pay the testers (these can come from all over the world) 3) attract enough testers (this is mainly for the smaller businesses), and 4) managing the incoming reports."

The Danish start-up is effectively offering a crowd-based penetration testing service. CrowdCurity's service offers to take care of payments to the testers, using Bitcoins and PayPal. Around 400 testers already signed up to CrowdCurity's scheme, a figure Storm said is growing. "We have a build in bug management system where it is easy to get an overview of what has been reported and what [received] feedback," he added.

Storm named Bugcrowd and Synack as CrowdCurity's most obvious competitors. "They however seem to target larger companies and have a slightly different approach, offering more on the consultancy side," he explained.

Storm acknowledged our point that some businesses would want to keep very tight control about knowledge about vulnerabilities in their platform and would therefore be loth to hand over the management of a bug bounty scheme to a third-party cloud-based service. However he argued that such companies are typically either "not very confident about there security level" or outfits such as banks charged with handling sensitive data.

"We have made some features that makes possible for companies to keep tight control - to an extent," Storm explained. "Companies can run their programmes in test/staging environment, so it will not effect the live processes, and they can choose to do a 'soft launch', where only one to three selected security testers are allowed access."

"This will make it more controlled and even if there are many vulnerabilities they will come in in a lower pace and fewer will know about them. But the test will not be as in-depth as one where the whole crowd has access," he added.

Banks should not shy away from vulnerability reward programmes just because of the nature of their business, Storm argued.

"Banks or similar should be careful, but the fact is they already are exposed. They can then choose to hope that they will find all vulnerabilities in-house or they can choose to also run a programme with high rewards, to make sure that IF a vulnerability is found, people have an incentive to report it instead of exploiting it," Storm said.

CrowdCurity's current client roster includes Bitcoin exchanges, that "fit the bill of companies with a lot to lose" and Bitcoin and merchant intermediaries. Apart from Bitcoin businesses, "we see a potential in to targeting established startups, small and medium sized businesses who find it to expensive to hire pentest/security consultants by the hour and want the benefits of running a bug bounty programme, but who do not have the resources like Google and Facebook to handle it in-house," Storm explained.

Other early clients include software-as-a-service firms within HR, logistics and CRM.

More details of how the scheme works can be found in a FAQ and video available on CrowdCurity's site here.

Businesses only pay out for the vulnerabilities they approve with rewards largely pitched between the $100-$1,000 bracket. CrowdCurity takes a 20 per cent service fee for each reward. This sort of incentive is not going to attract elite testers but it might well be of interest to Reg readers who not infrequently tell us about cross-site scripting and SQL injections flaws on websites.

Whether they get a reward or not would, of course, depend on whether the site involved is signed up to CrowdCurity's scheme. ®