The Economics of Cybercrime and Security
Bug Bounties and Ethical Hackers
How companies pay ethical hackers to find security flaws, why this market works, and how Indian researchers became top earners on bounty platforms.
Instead of waiting for criminals to find flaws, companies can pay friendly hackers to find them first.
How bug bounties work
- Companies publish rules about what can be tested.
- Ethical hackers search for vulnerabilities.
- They report flaws privately and receive rewards, sometimes thousands or even over a million dollars for critical bugs.
Platforms
HackerOne and Bugcrowd connect companies with researchers worldwide.
Indian researchers
India has become one of the largest sources of bug bounty hunters, with many Indians among top earners, reflecting strong technical talent.
Why it works
- Crowdsourcing: thousands of testers find more bugs than a small internal team.
- Pay for results: companies pay only for valid findings.
- Legal channel for hackers’ skills.
Government programmes
Some governments, including India’s, have run vulnerability disclosure programmes to encourage reporting.
Zero-day markets
Serious flaws can also sell on grey markets to governments or criminals for high prices, competing with bounties.
A college student in Pune finds a flaw in a global app, reports it through a bounty platform and earns several lakh rupees.
Ethical hackers earn legitimate rewards by reporting flaws.
- Bug bounties pay ethical hackers to find flaws.
- Platforms connect firms with researchers worldwide.
- Indian researchers are among top earners.
- Grey markets for flaws compete with bounties.
No recording for this one yet - EconReader can read it aloud for you.