As a CIO, CISO, CTO or Sys Admin, would you use a crowdsourced platform for penetration tests in order to improve your security issues?

Google, Facebook, PayPal and other big companies have a Bug Bounty Program which works very well. Who's wrong? Them or... ?

  • Mod note: the original version of the question asked if people would use his service. That was obviously off-topic. The more generalised version is far too general and opinion-based.
    – schroeder
    Jan 4, 2022 at 12:10

4 Answers 4


Absolutely not, it may be a great idea in some ways but if I'm going to get a penetration test it is from a company that signs a contract that includes a non-disclosure agreement, otherwise I have no legal recourse if things go wrong. Using this would just paint a big "hack me, I think I may be insecure" on my sites.

  • Greg you're right until one point. There are companies that require such penetration test (e.g. gov. financial etc) and the others that doesn't require but they develop web apps or SaaS servicies. For those who does not require authorized penetration tests this platform is it for. Moreover, startups have two big issues: Scalability ant Security and here, instead to hire pentest specialist, they simply can use this service. Jul 25, 2012 at 15:18
  • 3
    Marius I can see that you really believe in this idea, and I'm sure it will get some uptake amongst startups and small operators. However, your question was "As a CIO, CISO, CTO or Sys Admin, would you use this service in order to improve your security issues?" My answer is no, I would not for the reasons stated above.
    – GdD
    Jul 25, 2012 at 15:24

As far as I can tell from the description on the websites, you can't really tell who tests your application/server and how good they are at finding vulnerabilities. So you can't rely on a statement like "No vulnerabilities found." I would rather use a company with a good reputation. A free test that doesn't find any vulnerabilities really doesn't help. It might even be bad for you by providing you with a false sense of security.


I can't see this being acceptable for any of my clients- their risk management rules would prohibit this sort of thing.

You would need to get vetting for every tester, individual NDA's, signoff and approval to avoid falling foul of the computer misuse act etc.

How will the client validate the testing methodology?

Most of all, they require a provider with a rock solid reputation and decent liability coverage.


I think this is not the best idea because the process is not knows nor documented, such hackery by anonymous parties I have every day, and I have hordes of them, and I cant believe somebody wants even more money to pay to actually get hacked. I got 100 page report every day from all sorts of hacks.

The trick is if I send you my vm image, if you can make it secure and send me it back, you can't make it, because you would require a specific product, and you dont have a product, procedure or anything like this and offer only "hackery", which is very easy to do, obviously you can hack into any LAMP and Windows server and this is nothing really revealing only except how much damage you can really make. So you could say simply: "you are not having enough security to not be crowd hacked".

It would be much better, if you would actually utilize some sort of process like SDL, which would include securing the application, so for this I could spend £100 per month per vm image, and it would have to be bullet-proof including auto-learning and updates, and the test environment for hacking and security tests, with sync from my SVN, and that would include 3rd party patch review and DDoS testing, mailbox abuse, brute-force, the performance report and load tests stats and it would include Network, System and Application, plus the DNS, LDAP and Mail and whatever specific there is.

I dont know any website doing anything like this with these methods, but "these" methods fit in SDL at the two or three last stages, so in order to professionally utilize it that would require all stages, documented, and implemented, which would be a very complex problem, maybe standard LAMP and Windows would be OK to start with.

It fits also with government - you might get a mission which includes hacking into national power and nuclear infrastructure, this way you could test definitely the NHS, but not banks, and definitely you should try with army. If you can make it, you can make it make sense, because for business this is not the most useful thing, because businesses can make this themselves which is more secure, and legally enforced.


Not the answer you're looking for? Browse other questions tagged .