HackerOne vs. Kali Linux

Our security team will never scale like we'd like to do having this had been extremely helpful to manage, address, and payout vulnerabilities reported. I like having one "door" for this and not multiple ways to report stuff

Incentivized

Kali Linux is especially well suited in environments where high security is needed for your custom developed applications. This is well suited for offensive testing your high security in house developed applications. It is also very good for doing penetration testing on in house developed applications and safe guarding them from external attackers. Kali Linux is tough for use as a day to day Linux operating system as this was never intended to be used by beginners and occasional Linux users.

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• Analyzing SSL certificates
• Analyzing SSL server configurations
• Vulnerability scanning
• Port scanning

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

• Usage wise, it is tough for use by beginners. Can be improved.
• With Kali Linux have noticed driver related issues especially with Nvidia graphics cards.
• Kali Linux can be improved for use as a day to day OS.

Incentivized

I haven't used any other products as such but I have read about bugcrowd.

Incentivized

I would say the number one competitor to Kali is Parrot OS. While they both do the same/similar things, both have over 600 pre-loaded tools. Parrot does use some more offer what may be considered a more intuitive user interface. Parrot OS has been around for longer than people think and still has active development a support. But Kali is used more broadly in Training sessions, demos and is considered to be form all the articles I have read, the gold standard for penetration testing and tool sets

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized

• Initial stages of figuring out back doors in an application hence making them secure.
• ROI is good as it reduces in production security threats by letting us know well in advance.
• Entire development team along with its designers get a huge sigh of relief as all security holes are sealed well in advance before going into production.

Incentivized