Great results for a great price.
Use Cases and Deployment Scope
We use Bugcrowd for their on-demand crowd-sourced penetration test to test our SaaS application. This allows us to get a number of security researchers involved in looking at our product to find potential vulnerabilities.
Pros
- Having a pool of security researchers helps keep the penetration tests broad, getting the most bang for your buck.
- The integration with Slack makes it easy to keep tabs on the program and when new findings are submitted.
- The interface is pretty simple to use and fairly intuitive.
Cons
- The success of your program highly depends on the moderator that is assigned to your project. A good moderator will continue to find researchers until the quota is full. Less than stellar moderators will send out one invite and sees what sticks.
- Not all researchers are as professional as one might hope. This can ruin the experience.
Likelihood to Recommend
Bugcrowd is great for bug bounty programs and as a cheaper alternative to a full-blown penetration test. Small to medium-sized companies who are serious about security, but don't have the budget for a $40,000 penetration test, this is a great solution. Bugcrowd isn't going to be able to do much of the white-box penetration testing (code reviews), as they are more suited for grey-box and black-box. A program like this will need at least one dedicated person to work with the moderator, verify findings, and decide on the severity of the finding.
