CyberNew CyberNew
Threat Intelligence & APT Dark Reading 1 month ago

The Vulnpocalypse Is Repricing the Bug Bounty Economy

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"As the "vulnpocalypse" reshapes the bug bounty industry, one class of researcher may face the greatest pressure: independent hunters who rely on midtier vulnerabilities — those worth roughly $10,000 to $50,000 — to make a living. It is no secret that large language models (LLMs) have led to a mass of bug reports and an increase in vulnerability discovery. It is also no secret that the platforms..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

As the "vulnpocalypse" reshapes the bug bounty industry, one class of researcher may face the greatest pressure: independent hunters who rely on midtier vulnerabilities — those worth roughly $10,000 to $50,000 — to make a living.

It is no secret that large language models (LLMs) have led to a mass of bug reports and an increase in vulnerability discovery. It is also no secret that the platforms and companies that run much of the bug bounty industry have faced increased triage and payout times.

Multiple bug bounty operators interviewed by Dark Reading report dramatic increases in submission volume over the past year. HackerOne CEO Kara Sprague says report volume has roughly doubled year over year. Dustin Childs, head of threat awareness for TrendAI's Zero Day Initiative (ZDI), says the company's submission rate went up 450% year-over-year in April of this year, although volumes have moderated since that peak. Bugcrowd CEO Dave Gerry said the firm saw a submissions spike of more than 300% during a three-week surge period, but "now it's normalized where we're about double the volume we saw historically."

Related:Chinese Routers Sold Worldwide Contain Backdoors

Ashish Kunwar, vulnerability researcher at GanaSec and a long-time bug bounty researcher, tells Dark Reading that, "Since last year, the entire pipeline from submission to payout has slowed down significantly."

One other side effect of the vulnpocalypse is that as submissions increase, the price of many vulnerabilities is driven down. While this won't kill the bug bounty ecosystem, it will reshape things — particularly for a certain class of researcher.

The Vulnpocalypse Drives Bug Prices Down

The impact is beginning to show up in bug economics. "I think the community is really nervous because one of the things that no one's talking about yet is that the result is going to be driving the price of bugs down across the board," Childs says.

The ZDI executive explains that reported vulnerabilities previously were more limited, but "now everybody's finding bugs." As a result, the security research economy has become a buyer's market. "The $2,000 to $50,000 bugs," he adds, "I think those are going to become very scarce, or the price is going to be pressed down."

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →