Hacker and Program Interaction Essentials

A program manager should never automatically assume that the hacker holds “x” intention. Some hackers are from countries where the value of the US dollar scales exceedingly well with their local currency. Bug bounty program managers should consider the possibility that the security researcher reporting the vulnerability could rely on it as their primary source of income, and treat all researchers as full‐time professionals. One of the most difficult aspects of managing bug bounty programs is the process of invalidating false positives. The chapter provides some general considerations when observing interactions between the bug bounty platform triage team and the security researcher. Toxic interactions may be hard to decipher from actual threats and, in the instance of a threat actor trying to exploit the enterprise, may lead to a lot of confusion.