companies outside the technology industry, including traditionally conservative organizations like the united states department of defense, have started using bug bounty programs. the pentagon’s use of bug bounty programs is part of a posture shift that has seen several us government agencies reverse course from threatening white hat hackers with legal recourse to inviting them to participate as part of a comprehensive vulnerability disclosure framework or policy.