CHAPTER 4 Fixing a Hole: The Labor Market for Bugs

Over the past several years, “bug bounty” programs have grown in popularity. Bounty programs offer independent researchers rewards for valid bug submissions. This chapter analyzes the composition of the labor market for bounty programs. It analyzes data collected from 62 different bug bounty programs, including over 650 different participating researchers (“sellers”), 4,145 individual sales, and over $4.7 million in rewards. We note that the labor market is highly stratified, featuring a highly productive (and comparatively well-compensated) core set of workers and a large pool of modestly productive workers. It also uncovers that the majority of sellers demonstrate a low degree of flexibility—the overwhelming majority of participants only sell to a very small number of customers, while a small flexible core trade with several different customers. We consider the implications of the findings for firms experimenting with different bounty models. Importantly, we consider what, if anything, these insights can tell us about the utility of different approaches designed to disrupt the offensive acquisition, stockpile, and use of zero-day vulnerabilities.