Launch HN: Federacy (YC S18) – bug bounties for startups
What does it mean to &quot;contract an outsourced CISO&quot; to a researcher who reported through a bug bounty program? What&#x27;s an &quot;outsourced CISO&quot;?<p>I think it&#x27;s unlikely that &quot;CISO&quot; is the word you want to use in your copy.<p>How are you vetting researchers? I logged in as a researcher, and it looks like it works just like H1 works: there are public bounties, and private ones for which admission is gated by performance on the public bounties.<p>It is not the case that H1 typically costs six figures; typical costs for a startup on H1, with triage, are low five figures.<p>We manage bug bounties for several of our clients (we run outsourced security teams for startups). If there&#x27;s a problem we have with bounties, it&#x27;s <i>not getting enough</i> submissions from them. Triage can be annoying (I kind of enjoy it), but we do full-scope penetration tests for each of our clients, and it&#x27;s noteworthy how much more a real pentest finds than a bounty program. There are different incentives, different information available, and different kinds of work result.<p>(There are things bounties do better, too; bounties are good for finding oddball XSS and CSRF problems, and good at corner-case web hygiene stuff).<p>How are you attracting talent? I don&#x27;t really understand the business model. Bounty researchers already have a bunch of platforms they can use if they want to do bounty-type scanning. Why are they using yours?