Incentives and Outcomes in Bug Bounties
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866908549401018368 |
|---|---|
| author | Wang, Serena Banchio, Martino Kotowicz, Krzysztof Ligett, Katrina McAfee, R. Preston Nava, Eduardo' Vela'' |
| author_facet | Wang, Serena Banchio, Martino Kotowicz, Krzysztof Ligett, Katrina McAfee, R. Preston Nava, Eduardo' Vela'' |
| contents | Bug bounty programs have contributed significantly to security in technology firms in the last decade, but little is known about the role of reward incentives in producing useful outcomes. We analyze incentives and outcomes in Google's Vulnerability Rewards Program (VRP), one of the world's largest bug bounty programs. We analyze the responsiveness of the quality and quantity of bugs received to changes in payments, focusing on a change in Google's reward amounts posted in July, 2024, in which reward amounts increased by up to 200% for the highest impact tier. Our empirical results show an increase in the volume of high-value bugs received after the reward increase, for which we also compute elasticities. We further break down the sources of this increase between veteran researchers and new researchers, showing that the reward increase both redirected the attention of veteran researchers and attracted new top security researchers into the program. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2509_16655 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Incentives and Outcomes in Bug Bounties Wang, Serena Banchio, Martino Kotowicz, Krzysztof Ligett, Katrina McAfee, R. Preston Nava, Eduardo' Vela'' Software Engineering Cryptography and Security General Economics Economics Bug bounty programs have contributed significantly to security in technology firms in the last decade, but little is known about the role of reward incentives in producing useful outcomes. We analyze incentives and outcomes in Google's Vulnerability Rewards Program (VRP), one of the world's largest bug bounty programs. We analyze the responsiveness of the quality and quantity of bugs received to changes in payments, focusing on a change in Google's reward amounts posted in July, 2024, in which reward amounts increased by up to 200% for the highest impact tier. Our empirical results show an increase in the volume of high-value bugs received after the reward increase, for which we also compute elasticities. We further break down the sources of this increase between veteran researchers and new researchers, showing that the reward increase both redirected the attention of veteran researchers and attracted new top security researchers into the program. |
| title | Incentives and Outcomes in Bug Bounties |
| topic | Software Engineering Cryptography and Security General Economics Economics |
| url | https://arxiv.org/abs/2509.16655 |