Many years ago I came to the conclusion that in many scenarios the "Bug Bounty" model was economically superior to the typical pricing model of VA vendors, especially as security programs mature. This is how I reasoned though it. /1
When customers license a VA product, it's typically an annual price. In newer InfoSec programs these tools will likely find A LOT of vulns. In year 1, if you divide the license cost by the number of vulns found over during the year, you get a dollars-per-vuln metric. /2
In year 2, we'd expect the InfoSec program to mature and the number of reported vulns to decrease (less to be found), but the VA product licensing cost remains largely fixed. Consequently, the dollars-per-vuln metric actually inceases! Rinse repeat in year 3, 4, etc. /3
This is because the pricing model is essentially based on paying for 'effort' not 'performance.’ Over time there comes a point economically where they are comparatively very few vulns left to be found, and it makes more sense to pay for ‘performance’ (ie reported vulns). /4
If priced right, there is point where the Bug Bounty model become more economically advantageous. A customer is able to model roughly how many vulns are expected to be found and going market rate for the crowd to look for them. /5
This is why we predominately see Bug Bounty successfully deployed against the more mature (aka secure) organizations these days. /6
