I know this is old, but I still found it on Google while searching, so here is my opinion: Today there's multiple bug bounty programs, in which, for obvious reasons, they need to measure the weight of the information and data that they receive from the ethical hackers and provide to their customers.
As we all know, information is a difficult asset to measure, as it's abstract; however, we normally pay more for professionals with more information, or more experience, than less experienced professionals, as they have more experience, or more training on the specific subject.
In order to estimate the cost or price of a security flaw, you need to consider a few different aspects. Which I'll try to describe:
1) I don't think it doesn't really matter if you find it using or not using an automated tool. By nature, the kind of security flaws that you will be able to find using an automated tool, will have impact, either because the platform or the impact surface will be smaller and limited, compared with those that are harder to find and identify.
2) The security flaws that are better paid are usually flaws or vulnerabilities that do expose or compromise a big surface, ie: vulnerabilities that do expose a lot of users, or vulnerabilities that do expose a lot of data.
3) There's no way to exactly determine this, as it's as well ruled by supply and demand, but generally speaking, we could conclude that:
3.1) the more users that are affected, the more expensive the vulnerability will be.
3.2) the more information exposed, as well, the more expensive the vulnerability will be.
By contrast; we can say that finding low-risk-low-impact security flaw in a software which no one is using, has no value $0 usd.
And, a vulnerability which compromises a lot of information, from a lot of users, will generally be rewarded with +$100,000 usd price tags.
Same applies for vulnerabilities that represent a direct business continuity risk for a big company, as they are generally very well rewarded, or very well paid.
This is nothing else than my personal opinion, as an ethical hacker, with experience with big organizations, and black markets.
Take a look at this chart for some references:
- $2,000,000 - Apple iOS remote jailbreak (Zero Click) with persistence (previously: $1,500,000)
- $1,500,000 - Apple iOS remote jailbreak (One Click) with persistence (previously: $1,000,000)
- $1,000,000 - WhatsApp, iMessage, or SMS/MMS remote code execution (previously: $500,000)
- $500,000 - Chrome RCE + LPE (Android) including a sandbox escape (previously: $200,000)
- $500,000 - Safari + LPE (iOS) including a sandbox escape (previously: $200,000)
- $200,000 - Local privilege escalation to either kernel or root for Android or iOS (previously: $100,000)
- $100,000 - Local pin/passcode or Touch ID bypass for Android or iOS (previously: $15,000)
- $1,000,000 - Windows RCE (Zero Click) e.g. via SMB or RDP packets (previously: $500,000)
- $500,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $250,000)
- $500,000 - Apache or MS IIS RCE i.e. remote exploits via HTTP(S) requests (previously: $250,000)
- $250,000 - Outlook RCE i.e. remote exploits via a malicious email (previously: $150,000)
- $250,000 - PHP or OpenSSL RCE (previously: $150,000)
- $250,000 - MS Exchange Server RCE (previously: $150,000)
- $200,000 - VMWare ESXi VM Escape i.e. guest-to-host escape (previously: $100,000)
- $80,000 - Windows local privilege escalation or sandbox escape (previously: $50,000)
So, what does the cheapest and the most expensive have in common? attack surface, potential information exposed, and assosiated risks.