PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Measuring Success in Vulnerability Disclosure

hackerone.com | vulnerability | #metrics | #vulnerability-disclosure | #hackerone | #benchmarking | #success-index
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Introducing the HackerOne Success Index: six monthly-scored dimensions — vulnerabilities fixed, reward competitiveness, response efficiency, researcher depth and more — to benchmark programs.
Published
Collected

Related coverage

vulnerability · hackerone.com
The HackerOne Success Index - Response Efficiency
Fourth in the Success Index series: analyzing ~100,000 reports, response speed — especially resolution time — drives program performance; top programs target first responses within 12 hours.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackerone.com
New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure
HackerOne argues vulnerability counts no longer brief boards well and proposes CTEM metrics like Time to Validate, as AI-accelerated discovery compresses exploitation timelines.
vulnerability · hackerone.com
Key Findings From The Hacker-Powered Security Report: Security Responsiveness is Improving (2 of 6)
Key finding #2: time to first response improved to six days in 2017 from seven in 2016, and 77% of programs get their first report within 24 hours; fast communication keeps hackers engaged.
vulnerability · yeswehack.com
CVE-2023-54391 and beyond: excavating silent patches and the attacker-defender information gap
CVE-2023-54391: a Proxmox VE auth bypass fixed silently in 2023, exploited in 2026 before any advisory. The piece taxonomizes 'silent patch gaps' and why AI-assisted diffing makes them cheap to mine.
vulnerability · bugcrowd.com
Track Vulnerability Trends and Drive Action with Updated Insights Dashboard
Bugcrowd announces a major Insights dashboard update for Crowdcontrol, adding submission trends by target, severity and vulnerability type, plus program performance and bounty spending metrics.
Back