Google launches new vulnerability reward platform
There must be something I am missing, because I dont understand how underpaid most bug bounty programs are.<p>If I ran Googles program, I would immediately 10x all payments, unironically. Yes, that means paying 1 million bucks for something you previously paid 100k for. Drop in the bucket. You also get a ton more eyeballs on you, letting you patch everything ASAP.<p>But they dont do this. I dont know why. Security through obscurity? I suppose that works if you are myspace.com in 2021. Nobody likely gives a shit to try and hack it, but at the end of the day this is still google so that really doesn&#x27;t apply.<p>The downside of not paying handsomely is people realize they can make more money selling to third party vendors, (which some do) then every once in a while you get a bad PR story showing that your stuff was hacked and exploited for months&#x2F;years and it potentially knocks a few points off your stock price.<p>Money is really the end all be all. If you pay more than third party vendors, I can see almost no reason people would sell to them. At that point, your only adversary&#x27;s are gov employees of nation states and the staff of companies dedicated to finding vulnerabilities.