Bug bounties work well for publically accessible systems, e.g. a site's web service. As a result, many of the more visible break-ins occur through phishing or spear-phishing and combine social engineering with malware as well as classical intrusion techniques from within the network perimeter.