Hunters for bugs: hackers can also earn legally

Hackers can be not only villains who hack computer networks and steal money and information. Some hackers perfectly earn an honest way, protecting program developers from cybercriminals.

Companies and individuals who call themselves "hunters for bugs" carefully analyze software codes in search of vulnerabilities that can be exploited by cybercriminals. And the demand for such services is steadily growing, says the Air Force.

Many successful "bug hunters" began their careers with the analysis of popular software - it's no secret that large companies like Google and Mozilla have long and openly offered money for the vulnerabilities discovered through the so-called Bug Bounty programs. However, according to the experts themselves, this is a difficult and long work - you can easily spend about 50 hours searching for one mistake.

At the same time, the sheepskin is really worth the candle. The monthly budget of many Bug Bounty programs reaches $ 50 thousand, and some companies pay voluntary assistants up to $ 1 million per year. As a result, the best specialists who are the first to manage to find serious vulnerabilities can earn more than $ 350 thousand a year.

Some companies built their business to help "white hackers" and create tools for their work. For example, PortSwigger has developed a popular in a narrow circle program to automatically audit the security of Web applications Burp Suite. And crowdsourcing platforms HackerOne, Bugcrowd and Synack help "white hackers" and customers find each other, control their fulfillment of all their obligations and ensure the preservation of confidentiality.

Such sites enable developers to outsource testing of their products for security and to attract specialists from all over the world to perform this work. At the largest of these services, HackerOne, registered more than 120 thousand hackers, and the total amount of payments for the entire time of the platform has already exceeded $ 26 million.

By the way, some "white hackers" use their income in a very original way. For example, the Swedish cybersecurity specialist Frans Rosen invests money received for vulnerability searches in technological start-ups, acting as a venture investor in the seed stage and later helps his clients attract more serious investments. Presumably, with the safety of products developed by such start-ups, everything is in order.