Score 8.0 out of 10


What is Bugcrowd?

San Francisco-based Bugcrowd offers a bug bounty platform, for vulnerability management.
Read more

Recent Reviews

Read all reviews
Return to navigation

Product Details

What is Bugcrowd?

Bugcrowd connects companies' security and dev teams to vetted and talented security researchers worldwide to run crowd-powered private and public bug bounty programs.

Companies like Tesla Motors, Barracuda Networks, and Western Union have teamed up with Bugcrowd to augment their security efforts and quickly realize clearer insights into fixing their application vulnerabilities.

Bugcrowd Features

  • Supported: Private Programs: Invitation-only program partnering you with 50 of our most winning, background-checked security researchers - and our industry veterans who direct the triage and validation of vulnerabilities. This kind of program is best if you're testing new products and apps that are harder to access. Depending on your security needs, private programs can be ongoing or one-time engagements.
  • Supported: Public Programs: Through our crowd-powered platform, engage the collective ingenuity of thousands of security researchers. Simply define your scope of testing, and we will match your needs with the right researchers to find the biggest, baddest vulnerabilities. Similar to private programs, public programs can be ongoing or one-time engagements.
  • Supported: Managed Triage and Validation Service: Add-on service that bolsters your security and dev teams' bandwidth during your program's flight.

Bugcrowd Competitors

Bugcrowd Technical Details

Deployment TypesSoftware as a Service (SaaS), Cloud, or Web-Based
Operating SystemsUnspecified
Mobile ApplicationNo
Supported CountriesUS, Canada, Australia, New Zealand, UK
Supported LanguagesEnglish
Return to navigation


View all alternatives
Return to navigation

Reviews and Ratings



(1-1 of 1)
Companies can't remove reviews or game the system. Here's why
Chase Palmer, CISSP | TrustRadius Reviewer
Score 8 out of 10
Vetted Review
Verified User
We use Bugcrowd for their on-demand crowd-sourced penetration test to test our SaaS application. This allows us to get a number of security researchers involved in looking at our product to find potential vulnerabilities.
  • Having a pool of security researchers helps keep the penetration tests broad, getting the most bang for your buck.
  • The integration with Slack makes it easy to keep tabs on the program and when new findings are submitted.
  • The interface is pretty simple to use and fairly intuitive.
  • The success of your program highly depends on the moderator that is assigned to your project. A good moderator will continue to find researchers until the quota is full. Less than stellar moderators will send out one invite and sees what sticks.
  • Not all researchers are as professional as one might hope. This can ruin the experience.
Bugcrowd is great for bug bounty programs and as a cheaper alternative to a full-blown penetration test. Small to medium-sized companies who are serious about security, but don't have the budget for a $40,000 penetration test, this is a great solution. Bugcrowd isn't going to be able to do much of the white-box penetration testing (code reviews), as they are more suited for grey-box and black-box. A program like this will need at least one dedicated person to work with the moderator, verify findings, and decide on the severity of the finding.
  • We have received some great results for a great price. We've also received some poor results at the same price.
  • Bugcrowd is not always recognized as a "real" penetration test, but for the most part, we have not had any problems with customer accepting our reports.
  • Overall, Bugcrowd has been an overall good experience, but we have had a poor moderator from time-to-time that has resulted in less than ideal results.
Budget was ultimately the reason we went with Bugcrowd initially. Bugcrowd allowed for us to come up with our own bounty scale to fit out budget. Most other companies had a fixed scale, or the scale was not as flexible as we wanted it. Traditional penetration testing companies were very expensive.
Return to navigation