Great questions. We&#x27;ll line up a more analytical post on the topic as I don&#x27;t know all the answers here, and we all should. In the interim, here&#x27;s a few rough from memory answers:<p>&gt; Thats an average of $357&#x2F;vuln<p>The 14,000 includes resolved bugs where no reward was offered (Bounties are optional with ~40% of programs not offering any. i.e., &quot;responsible disclosure&quot;, a drop in replacement for security@company.com). If you reduce the set to reports where a reward was offered, the average is closer to $750.<p>&gt; What % of the $5MM or the 14K did the top hacker or group take home?<p>The top earner last year took $280k.<p>&gt; How long is the tail of zero $$ per hacker in the community of the 2K?<p>This is a diverse group. Several hundred are active &quot;hackers&quot; driven financially. The rest are developers, hobbyist, technical consumers, who just happened to get curious about something in particular or even stumbled across a security problem in passing (this is far more common than you&#x27;d reasonably expect).