This is where “managed” bug bounty programs like BugCrowd or HackerOne deliver value: only telling you when there is something real. It can be a full time job to separate the wheat from the chaff. It’s made worse by the incentive of the reporters to make everything sound like a P1 hair-on-fire issue.

Half of the emails I used to get in a previous company were pointless issues, some coming from a honey pot.

The other half was people demanding payment.

Use AI for that :)

Not kidding, I bet llm’s are excellent at triaging these reports. Humans, in a corporate setting, are apparently not.

Training a tech support team of interns to solve all of them would be an enviable hacker or software dev training program.