News for hackers. Stuff that matters.

A comment on Google launches new vulnerability reward platform. Parent comment

Re:Google launches new vulnerability reward platform by tptacek on Tuesday July 27, 2021 @02:31PM (#27975822)
I downvoted because "cybersec researchers" do not in fact routinely make 7 figures. For strong pentester types reporting the typical (real) vulnerability the VRP handles, the median is probably in the low 6's.
[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by na85 on Tuesday July 27, 2021 @05:43PM (#27978030)
6 figures from breaking systems and reporting them responsibly?

Sounds amazing, what's the catch?

[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by tptacek on Tuesday July 27, 2021 @06:16PM (#27978355)
There's no catch. You want a job as a pentester. That job is in high demand.
[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by kasey_junk on Tuesday July 27, 2021 @07:53PM (#27978967)
Frankly low 6 figures sounds low for a software job. How do you attract talent at that level?
[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by tptacek on Tuesday July 27, 2021 @07:55PM (#27978984)
The median bounty hunter isn't an SFBA software developer.
[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by kasey_junk on Tuesday July 27, 2021 @08:30PM (#27979179)
Is it international arbitrage? Or something else cause low 6 figures is now the going rate all over the states.

*not trying to be argumentative just trying to price the market.

[ Parent | on HN ]
Re:Google launches new vulnerability reward platform by tptacek on Tuesday July 27, 2021 @08:34PM (#27979203)
It's a combination of the lower value of the median bug bounty submission (we hear about the high-ticket vulnerabilities, but most of them are pretty low-test) and the fact that huge numbers of bounty participants are abroad. I know there are people who claim to make high-6's and even low-7's from bounties, but they're very rare. I think most people who participate in bounties would be best off financially by using them to build a portfolio they can exploit to pivot into consulting or full-time work of some other sort.
[ Parent | on HN ]