About the Bug Bounty and Crowdsourced Security category
What belongs in this category
The Bug Bounty and Crowdsourced Security category covers platforms and managed programs that connect organizations with outside security researchers. Typical entries recruit and vet researchers, define what may be tested, take in and check reports, remove duplicates, set rewards and pass valid findings to the organization's teams. Vulnerability disclosure programs, which give anyone a safe way to report a flaw, belong here too.
Penetration testing by vetted testers paid for the test, on a subscription, fits Pentest-as-a-Service (PtaaS), even when the testers come from a crowd; a provider offering both can enter both. Automated attack testing fits Adversarial Exposure Validation (AEV). An organization that ran a successful program on such a platform can nominate that work in Cybersecurity Project of the Year, and researchers' published findings fit Cybersecurity Research.
Related categories to enter
Each category is judged separately, so you can enter a service in every category that matches what it delivers, with a separate nomination for each. Tailor each nomination to that category's focus. The provider behind the service can also be recognized in Cybersecurity Service Provider of the Year or Best Managed Security Service Provider (MSSP).
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against providers of similar size and region, so a small regional provider is not ranked against a global firm. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the reach of the program: researchers active, programs run, valid reports handled, and clients served across sectors.
- Innovation — a crowdsourcing problem solved in a new way, such as matching researchers to the right targets, checking reports faster, or an easy start for organizations new to vulnerability disclosure.
- Impact — results for clients: valid vulnerabilities found, time from report to triage and to reward, share of reports found valid, client retention. Give figures from programs, anonymized if needed.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A provider can enter its own service, and a PR agency can enter it on the provider's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as client names, contract figures or service levels. Deadlines, pricing and entry steps are on the How it Works page.
