Sounds like a recipe for a "Cobra Effect"[1] where suddenly, credible bribes grow by 10x!

[1] https://en.wikipedia.org/wiki/Perverse_incentive

There's always the fable about the boss who declares that being even a few minutes late to work will cost employees the whole hour's pay, causing them to be reliably an hour late, all the time.

Works both ways. If you keep me in the office for a few extra minutes after quitting time I'm claiming an hour of overtime.

In the Cobra scenario, breeding a Cobra has no "cost" beyond the breeding of a Cobra.

If you reported a fraudulent bribe, which was reported to the police there is a risk the briber and you both are arrested.

It's however trivial to manufacture "real" bribes - hell someone could build an automated spambot spamming bribes to everyone as an act of charity.

That would fail the "credible" test for reward.

So now you expect everyone to engage with their bribers to determine credibility?

In addition, how do you even determine credibility when even real attackers might renege and not deliver on their promise of a bribe?

This sounds like trying to get rid of rats by paying for dead rats, someone will start farming rats.

I see only trouble with this approach.

Just hire good people, treat them right, have sensible audit and monitoring procedures.

You used the “just” word there. Minimizing the difficulty of complex problems is a good way to discredit yourself.

How do you tell competent employees from incompetent ones? By the number of certificates? By the number years in industry? By school? By leetcode score? By salary asked?

It's very difficult.

By paying attention.

edit: By which I mean 1) audit your processes and 2) get to know your people.

Processes require good engineering to thrive; people require good management. When you confuse the two, you get problems.

I have read more than one story of rat-catching incentives ultimately leading to discovery of rat farming.

Another misaligned incentive is to have a Bug Bounty program, but offer ridiculous low compensation, for highly critical findings that show complete compromise of your platform. That will make it clear you don't take security as a high priority, and the Bug Bounty was just to hit a compliance check list.

Some will take it as a sign they should poke further your system, or shop around for others paying better.

> or shop around for others paying better.

That's kind of a weird moral take on things. If you don't like the bounties offered then simply don't invest time in the platform looking for things to exploit.

That was not a statement about my morals, was about the moral of others...

Companies with insulting bug bounty programs deserve to get hacked.

The Bug Bounty Program effectively protects them from that.

You wouldn't know how insulting that is before going through a good of paperwork that legally tames your desires.

If you have access to valuable assets of a company, you must be handsomely paid to avoid stuff like bribes.

Industries ex software know that since time immemorial.

Prob the software way of solving that is with least privileged access, automatic auditing and approvals.

I wonder why not even security companies are doing that correctly though.

For insider attacks auditing is really critical. At some level there will always have to be human beings with superuser access. But if every admin access and action is logged, audited and tied to a specific person then it becomes very hard to abuse that access without getting caught.

Superusers can disable logging, but yea the risk can be reduced.

Same reason why everything is shoddy: customers buy the cheapest or free solution and don't care if it fails.

Why should a business care if it gets hacked? It's the users that suffer and they don't have an alternative.

To add to the other comments this also assumes trust in the employer. If you’re disgruntled and don’t trust your employer than this policy falls flat.

Easy to game the system and offer credible bribes to yourself to collect the bonus. Just giving it some brief thought and it doesn't seem hard to make the chances of getting caught really low.

If not for the threat of involving authorities I might agree with you. How many people would really risk up to 7 years imprisonment (my countries max) to make a bit of money?

With an incredibly low chance of being caught? Many people. Factor in that the initial ask is often something that seems relatively victimless, or at least, not hurtful to any specific person, and ethical flexibility is even easier to come by.

Most people worldwide will take the moral equivalent of a bribe. It may require a sum so large as to be implausible for it to ever happen, but anybody that tells you they wouldn't at least consider illegal activities for life-altering amounts of money is statistically a liar. Millions of people have done and will continue to do it for seemingly trivial amounts of money.

> How many people would really risk up to 7 years imprisonment (my countries max) to make a bit of money?

The prisons of your country are full of such people.

A surprising amount of people, probably.

Sadly a whistleblower protection becomes an organized victim blaming too fast and easily

This assumes money is the only factor and motivation.

> This assumes money is the only factor and motivation.

Only if you assert that it is only useful if it solves 100% of the cases.

There are other motivations, but money is a big one. If you could block X% for a large value of X (I'd say easily > 50) then you're better off than before, even if some insiders driven by other motivations still remain.

I wouldn't say easily over 50%. For example https://www.varonis.com/blog/inside-world-insider-threats-pa... says roughly about half, and that sample might be biased as i assume its easier to take someone to court if they did it for money.

Still your point stands that money is a common factor. However you still have the problem that bribes usually aren't a one time payment but an ongoing thing, so a purely financially motivated adversary would take the total value into account.

Or you could foster a good personal relationship with your employees. If that's impossible for you, some will inevitably hate you enough that they will take the bribe anyway.

You can even go further: tell your employees that you'll be sending out fake test bribe offers, which they'll be expected to report, and that they'll be rewarded for doing so.

Similar to how IT in many large companies nowadays runs internal phishing tests.

That changes the risk/reward, so while every reported bribe is a nice cash bonus, accepting any received bribe becomes significantly riskier, and by 'practicing' bribe reporting it becomes the default reaction.