HackerOne will NEVER threaten you or do anything to reduce your security. You can safely ignore our sales emails if that's what you want to do. We are just trying to be helpful.
But we do have the absolutely best set of programs for companies of all stripes. To start with, you can open a vulnerability disclosure program that costs you nothing. It will allow hackers to submit vulnerability reports to you. We run numerous programs of this type for startups and other companies.
Our mission is to empower the world to build a safer internet. That's it.
Generally in the world of bug bounty programs, the signal-to-noise ratio (SNR) is around 10-20%.
Even at this low rate, it is not too bad. Let's say you receive 10 reports. You can relatively quickly identify the 8-9 noisy reports to find the 1-2 valid ones. Of course, a higher SNR is always better. It saves you time and effort.
On HackerOne, the average SNR across all programs is over 30%. The platform can automatically filter out certain reports that are duplicates or out of scope.
The platform maintains an average signal rating for each hacker (aka security researcher). Companies can limit access to their programs to hackers with a certain signal or higher. This will significantly increase SNR for the program.
Companies can also opt for a HackerOne program with triage included, in which case the SNR rises close to 100%.
Thanks tetrep. I agree with your statement "would be a good time for HackerOne to write this stuff down".
We just discussed it this morning internally. If you have suggestions on how to formulate such a policy, please email me at [email protected].
Thinking out loud, HackerOne stands for and supports the security and integrity of every piece of software code, for transparency and openness, for the sovereignty of each human being connected online, and for fair and equitable principles for all online activity. And probably some other aspects that I didn't think of this exact second.
The safest and most convenient way of hiring a white hat hacker (a.k.a. ethical hacker) is to run a bug bounty program and get the input of many of them.
BTW, given that NIST uses Eucalyptus, you could argue that Eucalyptus meets not just the formal definition of cloud computing, but also the practical one.