Bugcrowd vs. Tenable Security Center

Bugcrowd is great for bug bounty programs and as a cheaper alternative to a full-blown penetration test. Small to medium-sized companies who are serious about security, but don't have the budget for a $40,000 penetration test, this is a great solution. Bugcrowd isn't going to be able to do much of the white-box penetration testing (code reviews), as they are more suited for grey-box and black-box. A program like this will need at least one dedicated person to work with the moderator, verify findings, and decide on the severity of the finding.

Incentivized

[Tenable.sc (formerly SecurityCenter)] does very well for internal scanning for vulnerabilities, however it needs to be combined with Tenable.io in order to do cloud scanning.

Incentivized

• Having a pool of security researchers helps keep the penetration tests broad, getting the most bang for your buck.
• The integration with Slack makes it easy to keep tabs on the program and when new findings are submitted.
• The interface is pretty simple to use and fairly intuitive.

Incentivized

• Vulnerability management from one place
• Maximum endpoint visibility
• Easy to set up and plan the structure
• Support desk quickly responses
• Well-prepared documentation
• Broad scanning type
• Supports various compliance standards
• User groups allows coordination between teams

• The success of your program highly depends on the moderator that is assigned to your project. A good moderator will continue to find researchers until the quota is full. Less than stellar moderators will send out one invite and sees what sticks.
• Not all researchers are as professional as one might hope. This can ruin the experience.

Incentivized

• Centralized vulnerability management with sensors.
• Network health assessment and Incident response.
• For alerting or notification, it should also support the SMS gateway.

Incentivized

On all of the occasions that I have had to reach out to Tenable for assistance, they have been extremely helpful and knowledgeable. Solutions and support are provided quickly, and they work on the issue until it is resolved.

Incentivized

Budget was ultimately the reason we went with Bugcrowd initially. Bugcrowd allowed for us to come up with our own bounty scale to fit out budget. Most other companies had a fixed scale, or the scale was not as flexible as we wanted it. Traditional penetration testing companies were very expensive.

Incentivized

We decided to go with Tenable due to its robust reporting capabilities and competitive pricing vs its competitors. While all tools are very similar in regards to scanning capabilities we prefer Tenable SC's user interface. We also like the option to have both on-prem and cloud with theirs. Tenable io product as well.

Incentivized

• We have received some great results for a great price. We've also received some poor results at the same price.
• Bugcrowd is not always recognized as a "real" penetration test, but for the most part, we have not had any problems with customer accepting our reports.
• Overall, Bugcrowd has been an overall good experience, but we have had a poor moderator from time-to-time that has resulted in less than ideal results.

Incentivized

• Create internal/operational efficiencies
• Improve compliance & risk management
• Cost management
• Solid vulnerability scanner
• Ease, of use, and capabilities when it comes to analyzing vulnerabilities is what makes this product stand out

Incentivized