PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

5 Bug Bounty Insights From SIX Group

hackerone.com | blog | #bug-bounty | #pentesting | #case-study | #vdp | #triage | #financial-services | #security-program | #hackerone | #finance
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SIX Group's Alex Hagenah shares five insights on running VDP and bug bounty alongside pentests in a regulated market, covering researcher creativity, triage effort, and leadership buy-in.
Published
Collected

Related coverage

blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · yeswehack.com
‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty
Security leaders from Crédit Agricole Personal Finance & Mobility explain how they scoped their bug bounty program, the value of crowd diversity and triage, and plans for AI-related scopes.
blog · yeswehack.com
‘No cheaper way of getting security testing’: financial services Bug Bounty success story
Finance-sector case study: Bug Bounty proved ~90% cheaper than pentesting, complements internal testing on internet-facing assets, and began with a VDP after two good-faith bug reports.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · tenzai.com
An open-weight model powered the #1 HackerOne VDP research operation
Tenzai's AI hacker topped the world's largest bug bounty leaderboard on GLM 5.2, a model anyone can download, and the offensive capability once limited to a few frontier labs is now within anyone's reach.
blog · netspi.com
Leading Financial Institution Leveraged NetSPI Red Team Service to Improve Their Security Posture
NetSPI describes a black box red team engagement for a major US bank's subsidiary: OSINT and a robo-caller vishing attack harvested employee credentials used to attempt VPN access to the network.
Back