In Hacking for Good: Leveraging HackerOne data to develop an economic model of Bug Bounties, Shackelford, Martell, and Russell (2021) examine how bug bounty programs function at the intersection of cybersecurity and economics. According to the literature review, these programs can be viewed as market-based mechanisms that solicit security testing from ethical hackers, who are then rewarded with monetary incentives for their reports on vulnerabilities. Previous research referenced in the article highlights the expanding role of private actors in cybersecurity governance and assesses how, ranging from financial to skills-based incentives, they motivate hacker participation.

The authors also conduct an econometric analysis of behavior patterns in bug reporting that uses HackerOne data to construct a statistical model first introduced in the discussion of findings. They find that the efficacy of bug bounty programs is not just a matter of high rewards. Instead, program success correlates with such things as how responsive the company is, how clear the submission guidelines are, and how the hackers perceive the value of their contributions. The results indicate that internal motivations to participate, such as building a reputation and seeking a challenge, are significant motivators, particularly among top contributors.

This article highlights the importance of creating bug bounty policies that take into account economic incentives and social dynamics alike. It was also very interesting how program results could be improved through communication and recognition, often much more so than through pay. The study shows that it’s impossible to separate cybersecurity policy from how humans behave, something that sits quite nicely within a social science approach to understanding cyber governance.

Reference:

Shackelford, S. J., Martell, B., & Russell, S. (2021). Hacking for good: Leveraging HackerOne data to develop an economic model of Bug Bounties. Journal of Cybersecurity, 7(1), tyab007. https://doi.org/10.1093/cybsec/tyab007