Standoff Bug Bounty platform: 2025 year in review

The past year saw a series of cybersecurity incidents with unprecedented financial consequences. Major companies worldwide—including in Russia—faced losses amounting to a massive share of their annual turnover. With direct and indirect costs combined, a single attack is no longer just a multi-million problem—it is a threat to business survival.

Vulnerability exploitation remains one of the most effective vectors for attacking organizations worldwide, appearing in 37% of successful intrusions in 2025. Vulnerability exploitation allows attackers to inflict damage disproportionate to their own costs, resulting in direct financial loss, operational downtime, data breaches, legal fallout, and long-term reputational harm for the victim.

The attack on Jaguar Land Rover in late August 2025 is a stark example of how a single vulnerability can trigger cascading business consequences. Attackers gained initial access to JLR's corporate environment via a flaw in the SAP NetWeaver platform. The company was forced to take a significant portion of its IT systems offline. This halted production in the UK, disrupted the dealer network, and paralyzed the supply chain, affecting thousands of counterparties. The UK Cyber Monitoring Centre estimated that the incident impacted roughly 5,000 organizations and cost the UK economy approximately $2.5 billion. For JLR, the result was a sharp decline in financial performance, including losses in the hundreds of millions of pounds. The incident required emergency government intervention and multi-billion-dollar financing to stabilize the supply chain.

Cases like this demonstrate that even companies with mature IT and information security processes remain vulnerable to attacks exploiting unknown or underestimated weaknesses. Crowdsourced security and bug bounty platforms are no longer just auxiliary tools—they have become essential cybersecurity practices. Continuous testing of digital assets by a global community of researchers allows organizations to identify vulnerabilities faster, more cost-effectively, and in ways that mirror real-world attack scenarios. Companies failing to use the potential of bug bounties risk falling behind the industry's maturity curve and becoming easier targets.

Research shows that half of large global organizations now operate bug bounty programs. What was once the domain of tech giants has become a critical security component for organizations of all sizes. This trend is fueled by a 57% global increase in the number of ethical hackers; this growth signals rising awareness and expanding researcher communities. Furthermore, industry analysts project the global bug bounty platform market will grow from $1.76 billion in 2025 to $2.04 billion in 2026, reaching $6.67 billion by 2034, with a CAGR of 15.94% over the period.

Market growth is further driven by automation and the adoption of cloud technologies, which have significantly increased infrastructure complexity. Mass migration to the cloud, heavy reliance on APIs, and distributed architectures have introduced new risks. Nearly half (49%) of organizations cited cloud security gaps as the primary driver for implementing bug bounty programs. The platforms themselves are evolving: the integration of automated triage and AI-based systems enables faster report processing, reduced team workloads, and better program scalability. This makes bug bounty a more manageable and accessible tool for a wider range of organizations.

Standoff Bug Bounty is a platform where white hat hackers get rewards for discovering vulnerabilities, which helps companies enhance their IT infrastructure security¹.

The platform allows companies to pay only for discovered and confirmed vulnerabilities and provides easy and confidential communications. It takes on all the operations, including reward transfers, and ensures compliance with the principles of responsible disclosure of information about vulnerabilities.

For ethical hackers, the platform provides a regulated, legal environment to hunt for vulnerabilities and earn rewards. Taking part in programs provided by the platform allows independent researchers to show and improve their skills, compete with each other, and enhance digital security to make the world a safer place.

In this study, we summarize the results of the Standoff Bug Bounty platform for 2025 and draw key conclusions based on three primary data sources:

• Platform metrics: the number of reports received, vulnerabilities identified by severity, and total payouts to researchers
• A survey of approximately 100 ethical hackers participating in platform programs, aimed at understanding their motivations, perceptions of processes, and barriers to engagement
• A survey of approximately 30 companies running bug bounty programs on Standoff, aimed at identifying their goals, expectations, challenges, and results

• 233 programs were launched on the platform in 2025 (a 2.2x increase over the previous year). These covered companies with diverse digital platforms and infrastructures, including content platforms (19%), enterprise and SaaS platforms (18%), offline businesses (14%), and financial services (13%).
• The number of registered platform users has reached 32,000, a 74% increase compared to 2024.
• Researchers submitted 2,909 unique reports (up 34% from 2024), most of them in content platform programs. In total, bug hunters submitted 7,870 reports—a 61% increase year-over-year.
• The maximum payment was $65,000², which is 26% higher than the maximum payment in 2024.
• The average payment for an accepted report was over $850, which is 12% higher than in 2024. Rewards are calculated based on risk assessment, including vulnerability severity, exploitation probability, target environment specifics, and potential business impact.
• Content platforms accounted for the largest share of total payouts (24% of the annual total).
• Enterprise and SaaS platforms offer the most generous rewards: the average payout exceeds $1,500, with one in ten payouts exceeding $3,700.
• The total share of detected vulnerabilities of high and critical severity reached 32% (up 1 percentage point from 2024).
• The share of reports on critical security flaws rose by 2 percentage points to 14%, while high-severity vulnerabilities accounted for 18%.
• Offline businesses showed the highest concentration of high-severity vulnerabilities, accounting for 37% of accepted reports.
• Broken access control has been the top vulnerability class—both in 2025 and since the platform launched. 58% of critical and high-severity vulnerabilities belonged to this category.
• In 2025, 43 bug hunters earned more than $13,000, and six of them over $65,000 each.

The primary driver for launching a bug bounty program is the proactive improvement of security posture (cited by 64% of respondents). For 16% of respondents, the catalyst was a directive from the board or senior management. Only 4% of companies turned to bug bounty following an actual incident. Most organizations adopt these programs proactively, treating the platform as a strategic risk management tool rather than an emergency fix.

The main goal for most companies is to obtain an independent security assessment (80%). Unlike automated scanners, which only detect known vulnerabilities and lack context, bug bounties reveal what truly matters: complex, uncommon flaws and business logic vulnerabilities that other testing methods often miss. Scanners lack the creativity and mindset of a human attacker, making them insufficient for deep security testing.

Companies expect bug bounty programs to improve visibility into threats and help mature their security infrastructure. This aligns with the top goals cited by respondents, including increasing test coverage (68%) and developing internal security processes (64%). For nearly half of respondents, participating in bug bounty programs is a key step in maintaining regulatory compliance and adhering to best practices.

Interestingly, only 24% of companies cited cost optimization as a goal. Overall, businesses perceive bug bounty not as a cost-cutting tool, but as an investment in quality, reliability, and resilience.

In most cases, bug bounty programs meet their goals. 80% of respondents stated that their expectations were fully or partially met.

Top concerns prior to launch include unpredictable costs (56%), overburdening internal teams (44%), and low report quality (40%). Additionally, one in three respondents worried about unethical behavior from researchers.

However, these fears prove to be largely exaggerated: only 12% of companies actually encountered the difficulties they feared. In other cases, these risks were either minimal or fully mitigated by configuring the program correctly.

When launching a bug bounty program, companies typically face three main hurdles: assessing vulnerability severity and determining appropriate payouts (64%), financial planning (48%), and a lack of internal resources to process reports (44%). One in five respondents noted difficulties in establishing communication processes and SLAs, whereas only 8% faced legal challenges.

The bug bounty model relies on clear rules, ensuring predictability and control. Rewards are paid only for unique, confirmed vulnerabilities; duplicates or known issues are not eligible for payment. Every vulnerability is assessed based on risk severity. For example, an authentication bypass using default credentials commands a significantly higher bounty than a standard XSS vulnerability. This ensures operational costs are transparent and strictly tied to results.

When it comes to building trust with researchers, bug bounty is not a chaotic gamble; it is a managed, secure process. Researchers agree to strict program rules, including responsible disclosure policies. Violations result in sanctions, including frozen payments, reputational damage, or permanent bans. Additionally, specialized tools allow companies to identify researcher traffic and monitor activity, ensuring transparency and security. We explore who these researchers are and what drives them in a later section.

Concerns about uncontrolled budgets are dispelled in practice. Companies successfully manage costs by defining a clear scope, setting payout limits, scaling gradually, and focusing on high-priority assets.

Effective integration of a bug bounty program into security operations requires top management engagement and formalized processes. The primary success factor is leadership support (32%), followed by clear regulations and workflows (24%). While the technology platform is important, it is secondary to strong management decisions.

Fears of overwhelming teams prove unfounded when the program is configured correctly. By combining clear reporting requirements with strict SLAs and automated filtering, organizations can transform a potential flood of reports into a manageable workflow. Moreover, thanks to streamlined processes, the workload goes down over time. In fact, 72% of respondents describe the workload as minimal or moderate and fully justified by the results. Another 16% noted that the workload actually decreases over time due to automation and refined processes. Only 8% found the program difficult to support without expanding their staff.

Even without precise financial metrics, businesses view bug bounty as a highly effective risk mitigation tool. For 32% companies, the impact is difficult to quantify in monetary terms, but the threat reduction is evident. Additionally, 16% of respondents noted that benefits significantly exceed costs, demonstrating strong return on investment (ROI).

The results speak for themselves: 80% of companies found vulnerabilities that other methods missed, and 80% achieved complete visibility into their attack surface. Additional benefits include improved security culture among developers (32%) and increased trust from partners and clients (20%).

Bug bounty does not compete with traditional methods; it augments them. Companies emphasize that bug bounty programs:

• Enable testing of business logic and complex scenarios (68%), as well as identifying vulnerabilities beyond the reach of automation (56%).
• Do not replace other methods but serve as part of a multilayered security strategy (60%).
• Complement penetration tests and audits through crowdsourcing and diverse expertise (48%).
• Provide continuous testing (40%), unlike one-time assessments.

Given these benefits, companies are motivated to actively develop their programs further. Most organizations that launch a bug bounty program proceed to scale it—68% are already planning expansions, such as adding assets, transitioning to public programs, or hosting live hacking events.

Survey results confirm that bug bounty programs are an essential component of modern cybersecurity. Most challenges arise only at launch and are temporary. Most concerns turn out to be irrelevant or are easily managed with well-designed processes. Companies already on the platform overwhelmingly confirm its value, planning not only to continue but to scale their programs.

Last year, the platform hosted 233 bug bounty programs across various industries—a 2.2× increase year over year. Researchers assessed digital assets belonging to major Russian brands and ecosystems, including Azbuka Vkusa, T-Bank, VK, and Wildberries, as well as small and mid-sized businesses. The growing number of programs and broader industry participation reflect sustained business investment in crowdsourced security.

Researcher activity also rose sharply. In 2025, researchers submitted 7,870 vulnerability reports, up 61% from the previous year. Of all reports, 2,909 were unique and accepted for payout, up 34% versus 2024.

As report volumes increased, so did rewards. The highest single payout in 2025 was $65,000, which is 26% higher than in 2024.

Most platform programs offer the classic vulnerability discovery format. The largest reward is offered under VK's public program for the MAX messenger, where researchers can earn up to $130,000 for vulnerabilities that allow access to private user conversations.

Companies set payouts based on several factors: severity, exploitability, technical context, and potential business impact. The average reward per accepted report exceeded $850, up 12% year over year. Overall, 43 security researchers earned more than $13,000, and six surpassed $65,000.

Our analysis of successful bug bounty programs shows a clear link between reward levels and vulnerability severity. In programs where more than 30% of findings are rated high or critical, the 90^th percentile payout reaches $6,000—297% higher than that of other programs. This reinforces a simple point: rewards need to match the complexity of the scope and the level of risk.

When payouts are too low, experienced researchers tend to shift their focus to more competitive programs or concentrate on "low-hanging fruit"—issues that are easy to find and require minimal effort. As a result, companies receive fewer reports on complex, most dangerous attack scenarios. A flexible and fair reward system is a key driver of both researcher engagement and overall security improvement.

Reports on critical and high-severity vulnerabilities deliver the greatest value. These vulnerabilities are the most likely to be exploited in real-world attacks and therefore require priority remediation. As the platform matures, researchers are identifying an increasing share of these issues.

Over the past year, critical and high-severity vulnerabilities together accounted for 32% of accepted reports—up one percentage point from 2024. The share of critical vulnerabilities rose by two percentage points to 14%, while high-severity issues accounted for 18%. This shift reflects increasing maturity within both the researcher community and the platform's security analysis processes.

Medium and low-severity issues still make up the majority of submitted reports. This is expected: such vulnerabilities are easier and faster to discover, although they command significantly lower payouts.

For critical vulnerabilities, the median payout was $2,600, with an average of $5,000. The difference indicates a limited number of exceptionally high rewards—the top 10% of payouts reached $13,000 or more. For high-severity vulnerabilities, the median payout was $650, the average $936, and the top decile $1,900. By prioritizing the most severe flaws, this reward model motivates researchers to target vulnerabilities with the highest potential impact.

The most common vulnerabilities, as in 2024, remain CWE‑284 (Improper Access Control), CWE‑79 (Cross‑Site Scripting, XSS), and CWE‑200 (Exposure of Sensitive Information). HackerOne lists these as the top three classes of vulnerabilities reported by ethical hackers, underscoring how common they are.

Access control continues to be the top challenge, both in 2025 and throughout the platform's history. In 2025, access control accounted for 58% of all critical and high-severity vulnerabilities. Access control flaws allow attackers to access data, functionality, or internal services without proper authorization, or to perform actions beyond their assigned permissions. Access control vulnerabilities include horizontal and vertical privilege escalation, authorization bypasses, IDOR (Insecure Direct Object References), and execution of administrative operations without proper validation. This class of vulnerabilities remains the most prevalent in global rankings as well. Globally, Access Control continues to rank first in the OWASP Top 10 (2025).

For analytical purposes, organizations are grouped by infrastructure profile and security risk characteristics rather than formal industry classification.

Content platforms include social networks, media and entertainment services, advertising platforms, and educational platforms. Large user bases and extensive personal data processing create broad and constantly evolving attack surfaces. Logic flaws, particularly access control violations and data handling errors, are common.

Financial services, including banks, payment systems, and fintech, represent a security-mature sector with strong regulations and robust risk management. In this sector, bug bounty programs complement internal controls by uncovering uncommon scenarios and business logic flaws.

The retail and e-commerce sector includes online retailers and marketplaces focused on transactions and logistics. The main causes of vulnerabilities are high traffic on web and API interfaces and complex payment processing workflows. Access control and authorization errors are frequent due to numerous roles and promotional mechanisms.

Online services include web and mobile solutions like email, user applications, and support platforms. These services typically feature streamlined business logic but are highly sensitive to data leaks and authentication flaws. Risks center on account, session, and access management.

Offline businesses include retail, healthcare, manufacturing, and logistics organizations where IT supports core operations. Their IT environments usually consist of a mix of legacy systems, on-premises infrastructure, and external integrations. This segment shows a higher share of high-severity and critical vulnerabilities (37% of accepted reports in 2025), indicating a gap between digital transformation and security maturity. In this context, bug bounty is vital for quickly uncovering systemic issues that slipped past the internal security team.

Enterprise and SaaS platforms include corporate portals, collaboration tools, video conferencing platforms, and business cloud solutions. Common characteristics include multi-tenant architectures, complex data isolation models, and extensive role matrices. Common weaknesses involve design flaws and tenant segregation failures.

IT vendors and software developers have robust internal infrastructure, multiple environments, and complex supply chains. These companies typically feature extensive automation and mature development workflows. Risks include component vulnerabilities, integration flaws, and misconfigurations.

Government agencies are highly regulated environments often built on legacy technologies and complex system integrations.

In 2025, bug bounty programs focused on systems with large user bases and complex business logic, where independent testing offers the most value. Content platforms (19%) and enterprise/SaaS platforms (18%) accounted for the largest share of programs.

User-interactive systems and those with complex transactional logic remain top priorities for the research community. Financial services, content platforms, as well as trade and e-commerce account for 49% of all accepted reports, indicating strong interest in these infrastructures. Bug hunters confirm these are their preferred targets.

Total payouts and the highest individual rewards are in segments with complex architectures and high-impact vulnerabilities—specifically content platforms, enterprise and SaaS solutions, as well as online services.

Content platforms accounted for the largest share of total payouts (24% of the annual total). This is unsurprising, as they represent the majority of programs on Standoff Bug Bounty (19%). Enterprise and SaaS platforms pay the most generously: the average payout exceeds $1,500, with one in ten payouts exceeding $3,700. Government institutions remain the most conservative, with a median payout of $130 and only the top decile exceeding $500.

To run a successful bug bounty program, you need to understand who will be testing your systems and how they decide to participate. Bug hunters choose programs based on transparency, quality of communication, and professional treatment. Understanding their motivation, experience, and workflow allows you to build a predictable, effective process and improve report quality.

In 2025, the number of registered bug hunters on the platform jumped by 74% year-over-year, reaching 32,000. They test digital products daily across Russia and abroad, identifying vulnerabilities before criminals can exploit them. Over the last few years, bug bounty has evolved into a mature professional community with clear rules, legal frameworks, and responsible disclosure practices. Today, collaborating with bug hunters is a managed, transparent process, and the success largely depends on how well a company understands the researchers, their motives, and workflows.

The bug hunter community is diverse in terms of experience, which is a key strength of the crowdsourcing model. Our survey shows that nearly half of researchers (46%) have been participating in programs for one to three years. A third (34%) are newcomers with less than a year of experience, while about 20% are veterans with over three years in the field.

For most researchers, participating in bug bounty programs is not a one-off activity. Over 80% dedicate a significant, though limited, portion of their time to bug hunting, usually balancing it with a full-time job in IT or cybersecurity. Nearly one in five (18%) treats bug bounty as their primary profession.

While motivation extends beyond financial gain to include skill development (76%), as well as professional reputation and community recognition (54%), money remains the primary driver (92%). Half of the respondents (50%) are also motivated by the sense of contribution to product safety and the impact on their career development. This means a well-tuned program can build an engaged community genuinely interested in improving your security posture.

The community offers a diverse talent pool with various backgrounds. The vast majority specialize in web applications (96%) and APIs (76%)—the essential skills for perimeter testing. Nearly a third (31%) also specialize in mobile applications.

When testing web applications, bug hunters focus most on business logic errors (43%) and server-side vulnerabilities (34%). These are exactly the types of issues automated scanners miss and which often lead to the most severe incidents. The diversity of tools and approaches ensures your product is tested from dozens of angles, significantly deepening the quality of the review.

AI is entering the bug hunter's toolkit, but it is viewed more as an efficiency booster than a universal solution. Most researchers (55%) are experimenting with AI or using it for specific tasks. About a third (31%) have already integrated AI as an essential part of their workflow.

Currently, AI is used mainly to speed up routine tasks: writing and fixing code (58%), searching information and summarizing documentation (49%), and drafting reports (41%). One-third of researchers (31%) use it as a language support to improve phrasing, which is crucial for international communication. However, finding vulnerabilities, analyzing business logic, and building complex attack scenarios remain human tasks. AI accelerates the work but does not determine the result.

Choosing a program is a conscious, competitive process for researchers. Researchers prioritize a wide, interesting scope (74%) and competitive rewards (70%), though response times (64%) and program reputation (43%) are also key considerations.

The main reasons for declining or leaving a program are poor communication and slow triage (72%), low payouts (54%), and overly narrow scopes (50%). Unclear legal terms (42%) and negative community feedback (38%) are also major deterrents. Notably, product complexity or high security is rarely an obstacle (16%).

Most researchers are ready to work with technically complex, hardened products. Complexity itself does not kill interest if the rules are clear, compensation is high, and interaction is professional. In such conditions, bug hunters view complex targets as a challenge and a chance to prove their expertise.

Cyber stress testing is an advanced bug bounty format for companies with mature security processes and a clear risk model. We recommend launching this format only after a standard bug bounty program has been running stably for at least six months and external perimeter vulnerabilities have been fixed. At this stage, bug bounty fulfills its core function: ensuring regular security analysis and identifying vulnerabilities that have reached production. Cyber stress testing takes the next step, moving from finding isolated bugs to testing the infrastructure's resilience against serious incidents.

This format uses a scenario-based approach. A clear, measurable goal is set—for example, accessing confidential data, executing an unauthorized payment, or compromising admin systems. Researchers do not just look for individual vulnerabilities; they build attack chains, combining different classes of security flaws and building scenarios involving different systems and processes. By closely mimicking the actions of a real attacker, this approach reveals risks invisible to isolated component analysis. If the goal is achieved, the researcher receives a premium reward, motivating them to focus on critical, high-severity scenarios.

The 2025 results confirm the effectiveness of cyber stress testing:

• Of all reports, 95 came through the cyber stress testing.
• More than half (61%) were critical or high severity—30% higher than in traditional bug bounty programs.
• Total payouts exceeded $546,000, with a single maximum reward hitting $13,000.

Cyber stress testing complements secure development and vulnerability management. While standard bug bounty helps systematically clean the external perimeter, cyber stress testing reveals the real-world consequences of those vulnerabilities when chained together. For the business, this answers the key question: "What is the cost of a successful attack, and can we withstand it?" The result is not just a list of technical flaws, but a documented non-tolerable event.

Cyber stress testing marks the next stage in bug bounty evolution, representing the final tier of program maturity. They shift the conversation from abstract security scores to concrete business risks.

The past year demonstrated that companies view bug bounties as a preventative measure and a central pillar of their security strategy. Most organizations launch programs before incidents occur, viewing them as an investment in resilience and process maturity. In the vast majority of cases, business expectations are met: critical vulnerabilities are found, attack surface visibility improves, collaboration between security and development teams tightens, and risk levels drop.

The primary value of a bug bounty program lies in the combination of three factors:

• Realistic testing closely mimics the behavior of real-world attackers.
• Flexibility and scalability allow researchers to focus on priority assets.
• A pay-for-performance approach means you pay for results, not just the process.

Program efficiency depends on how well it is designed and integrated into company processes.

1. Payouts drive behavior. A thoughtful reward program allows researchers to focus their efforts on business-critical assets and scenarios. Rewards should reflect asset value, testing difficulty, and potential damage. For key assets, offer payouts at or above market benchmarks.
2. Scope matters. Programs with narrow scopes lose community interest. A broad, well-defined program scope allows specialists with different skills to find significant vulnerabilities and increases the chance of uncovering complex logic errors.
3. Bug hunters are professionals. For them, speed and transparency often outweigh the reward size. Set clear report confirmation, triage, and decision-making deadlines. Provide constructive feedback, including explanations of vulnerability impact and remediation requirements.
4. Explicitly flag critical infrastructure components, such as new features, rare scenarios, undertested zones, or recent integrations. Temporarily increased rewards and specialized testing formats have proven highly effective for these areas.
5. Increase program appeal with more than just money. Additional documentation, test accounts, expanded access, or unique scope coverage are often just as motivating as higher rewards. This approach delivers better results without uncontrolled budget growth.