Median payouts for critical findings have doubled in three years. Yet the researchers who find the best bugs increasingly go to vendors directly or sell to brokers, citing months-long triage queues and arguments over whether a finding is in scope.
Fixing the pipeline
The programmes researchers praise share quick acknowledgement, named contacts and a published severity rubric. Money is necessary but not sufficient; respect for the researcher’s time is what keeps the good ones coming back.
Key takeaways
- Critical-bug payouts have doubled since 2023
- Triage delays drive researchers to private channels
- Clear rubrics reduce scope disputes
This story is part of our ongoing coverage of cybersecurity. We will update it as more details emerge.
