Do you sometimes feel that software and application-testing is a trade of the dark arts? Are you not feeling confident in trusting hackers to work for you? We understand those feelings.Learn more
Our researchers are in a world of their own. We call them the Zerocopter researchers: ethical hackers of a different class. Rigorously vetted and experienced veterans of the white hat hacker world, working for you.
We bring our researchers to you through our platform. Our programs and platform are designed to enable the search and findings of improvements in the software and applications your team wants to be researched. The Zerocopter researcher is critical in that design; they are the ones that hunt in their characteristic way.
Insights presented in a well-written way, supported by proof
Every report is validated before being released to your Dashboard
Over 3000 researchers are connected to our platform
Our researchers are determined to hack for the good
Screened thoroughly by security experts worldwide
No bug or report can be published without permission
We do so by implementing the qualities, and unique capabilities researchers have to offer to improve your security measures. We built our platform for developers and provide the toolset for modern software developers with it that adds powerful security capabilities to your software delivery process. With the right checks and balances, we make sure that the reports you receive are of a high standard and add to the improvement of your security.
Here you’ll find the questions other clients ask us the most.
Bug bounties are compared often to traditional application security assessment methods such as penetration testing. The volume of testers involved and the differing reward models can be defined as the most significant differences between the two. Bug bounties involve a more substantial amount of diverse researchers with all different skills and experience, as opposed to a select few penetration testers. In bug bounties, your pay per vulnerability and the height of the bounty depends on the severity of the vulnerability rather than for effort.
Known vulnerabilities are known to the public because they are published on the internet or when it has a CVE ID. These vulnerabilities are also added to vulnerability scanners so they can be easily detected. A vulnerability scan could be thought of as a surface-level security assessment since it only detects known vulnerabilities. A vulnerability scan cannot spot logic issues. A hacker might be able to intercept traffic and change data in transit, for example. A vulnerability scanner might not deem information disclosure as an issue. Furthermore, this type of assessment may not see images stored on the network without protection or encryption as being anything to be concerned about. However, if these images happen to be of peoples’ ID or credit cards, then that is a severe problem. A researcher can spot this and uncover the unknown vulnerabilities.
With a researcher program we offer the possibility to have a selected group of the best ethical hackers search for unknown vulnerabilities on your website. All researchers in our platform are screened and tested, so we can be sure we only work with the best and the most reliable researchers in the world. All reported issues are reviewed and validated by the Zerocopter’s Triage Team before publishing it to the dashboard. The researchers will be rewarded on a no-cure-no-pay basis, per approved vulnerability.
In a Coordinated Vulnerability Disclosure (CVD) policy you ask when someone discovers a vulnerability in your online environment to report it as soon as possible so you can address it quickly. This policy is visible to all of your users by for example mentioning it on your homepage. Vulnerabilities discovered by users are compiled by Zerocopter and reported to you in an easy to understand overview of the problem. The reports are presented in your own dashboard, you and your team will receive an email when a report has been added or edited.
The scanner finds known vulnerabilities in your site. Our scanner is a combination of the best vulnerabilities scanners available on the market. For example, OpenVAS is implemented in our scanner and we are working to implement more scanners for every aspect of your organisation.
Our community of researchers are from all over the world besides countries that are on the U.S. sanctions list.
For our researcher programs we work with a carefully selected group of security researchers worldwide. We check personal information through an ID verification, review the researchers track record through an internet background check and assess their skills. The selection of Zerocopter Researchers is done by the Zerocopter team. When irregularities occur we are authorized to exclude a researcher from the community.
Zerocopter uses minimal bounties to reward our Researchers for finding unknown vulnerabilities. We subtract an all-in price from your Researcher Program budget per validated vulnerability. The all-in price includes the reward paid to the researcher and a 30% handling fee. You can find the Vulnerability Price List via https://www.zerocopter.com/vulnerability-price-list
A Coordinated Vulnerability Disclosure report has a reward amount of 0 euros by default, but we offer the possibility to assign a bonus to a Coordinated Vulnerability Disclosure report. A bonus bounty is always optional and totally up to the customer.