PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why Every Company Should Have a Vulnerability Disclosure Program

bugcrowd.com | vulnerability | #bug-bounty | #bugcrowd | #crowdsourced-security | #vdp | #vulnerability-disclosure | #ciso | #casey-ellis | #vulnerability-disclosure-program
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd CTO Casey Ellis and CSO David Baker argue every company needs a VDP: as attacks and InfoSec spending grow, disclosure programs act like a neighborhood watch for internet-facing assets.
Published
Collected

Related coverage

vulnerability · yeswehack.com
Vulnerability Disclosure Policy as a first step of GfK’s crowdsourced security strategy
GfK's security team explains why it started with a Vulnerability Disclosure Policy before Bug Bounty, using the VDP as a low-risk first step to build a business case and earn internal trust.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · hackenproof.com
Vulnerability Disclosure Policy: A Guide for Business Leaders
Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.
vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
vulnerability · bugcrowd.com
Bugcrowd Founder on Google Increasing Android Bounty to $1.5 Million
Casey Ellis comments on Google raising its Android bounty to $1.5 million for a full-chain Titan M exploit, arguing top payouts pull rare skills away from brokers like Zerodium toward defense.
vulnerability · bugcrowd.com
[Guest Post] Instructure’s Proven Security Vulnerability Disclosure Program
Instructure's security VP describes its Bugcrowd-hosted VDP, prompted by a DEF CON talk on hard-to-report school software flaws, and invited the young researcher behind it to its private bounty.
Back