Skip to main content
TrustRadius
Bugcrowd

Bugcrowd

Overview

What is Bugcrowd?

San Francisco-based Bugcrowd offers a bug bounty platform, for vulnerability management.

Read more

Learn from top reviewers

Great results for a great price.

Rating: 8 out of 10
June 13, 2019
IncentivizedVetted ReviewVerified User
We use Bugcrowd for their on-demand crowd-sourced penetration test to test our SaaS application. This allows us to get a number of security researchers involved in looking at ...
Continue reading
Chase Palmer, CISSP
Engineer - Engineering
Security Engineer II
Lucid
Bugcrowd2 years of experience
Log in with LinkedIn to see content from your network
Return to navigation

Product Demos

Bug Bounty Bugcrowd login demo

YouTube
Return to navigation

Product Details

What is Bugcrowd?

Bugcrowd connects companies' security and dev teams to vetted and talented security researchers worldwide to run crowd-powered private and public bug bounty programs.

Companies like Tesla Motors, Barracuda Networks, and Western Union have teamed up with Bugcrowd to augment their security efforts and quickly realize clearer insights into fixing their application vulnerabilities.

Bugcrowd Features

  • Supported: Private Programs: Invitation-only program partnering you with 50 of our most winning, background-checked security researchers - and our industry veterans who direct the triage and validation of vulnerabilities. This kind of program is best if you're testing new products and apps that are harder to access. Depending on your security needs, private programs can be ongoing or one-time engagements.
  • Supported: Public Programs: Through our crowd-powered platform, engage the collective ingenuity of thousands of security researchers. Simply define your scope of testing, and we will match your needs with the right researchers to find the biggest, baddest vulnerabilities. Similar to private programs, public programs can be ongoing or one-time engagements.
  • Supported: Managed Triage and Validation Service: Add-on service that bolsters your security and dev teams' bandwidth during your program's flight.

Bugcrowd Integrations

Bugcrowd Competitors

Bugcrowd Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo
Supported CountriesUS, Canada, Australia, New Zealand, UK
Supported LanguagesEnglish
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews From Top Reviewers

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

Users have made several recommendations based on their experiences with Bugcrowd:

  • Improve the interface: Some users have expressed that they find the interface of Bugcrowd to be less appealing compared to HackerOne. They suggest making enhancements to make it more user-friendly and visually appealing.

  • Maintain high-quality researchers: Users recommend having a good moderator for Bugcrowd to ensure that only quality researchers are invited to participate. This is seen as crucial for obtaining valuable results and insights.

  • Utilize Bugcrowd for security solutions: Many users recommend using Bugcrowd for security purposes, noting its effectiveness in finding bugs in organizations' code. They find the platform exciting and simple to use, particularly for development tracks and authentication.

It's worth mentioning that while users generally have positive experiences with Bugcrowd, some mention that the cost can be a downside. However, they still appreciate the peace of mind and valuable insights provided by the team of researchers. Some users suggest negotiating with Bugcrowd at the end of a quarter to potentially mitigate the pricing concerns.

View all reviews
(1-1 of 1)

Great results for a great price.

Rating: 8 out of 10
Incentivized
June 13, 2019
Use Cases and Deployment Scope
We use Bugcrowd for their on-demand crowd-sourced penetration test to test our SaaS application. This allows us to get a number of security researchers involved in looking at our product to find potential vulnerabilities.
Pros
  • Having a pool of security researchers helps keep the penetration tests broad, getting the most bang for your buck.
  • The integration with Slack makes it easy to keep tabs on the program and when new findings are submitted.
  • The interface is pretty simple to use and fairly intuitive.
Cons
  • The success of your program highly depends on the moderator that is assigned to your project. A good moderator will continue to find researchers until the quota is full. Less than stellar moderators will send out one invite and sees what sticks.
  • Not all researchers are as professional as one might hope. This can ruin the experience.
Likelihood to Recommend
Bugcrowd is great for bug bounty programs and as a cheaper alternative to a full-blown penetration test. Small to medium-sized companies who are serious about security, but don't have the budget for a $40,000 penetration test, this is a great solution. Bugcrowd isn't going to be able to do much of the white-box penetration testing (code reviews), as they are more suited for grey-box and black-box. A program like this will need at least one dedicated person to work with the moderator, verify findings, and decide on the severity of the finding.
Return on Investment
  • We have received some great results for a great price. We've also received some poor results at the same price.
  • Bugcrowd is not always recognized as a "real" penetration test, but for the most part, we have not had any problems with customer accepting our reports.
  • Overall, Bugcrowd has been an overall good experience, but we have had a poor moderator from time-to-time that has resulted in less than ideal results.
Alternatives Considered
Budget was ultimately the reason we went with Bugcrowd initially. Bugcrowd allowed for us to come up with our own bounty scale to fit out budget. Most other companies had a fixed scale, or the scale was not as flexible as we wanted it. Traditional penetration testing companies were very expensive.
Other Software Used
Return to navigation