Effectively manage security developments with our platform

A Coordinated Vulnerability Disclosure report has a reward amount of 0 euros by default, but we offer the possibility to assign a bonus to a Coordinated Vulnerability Disclosure report. A bonus bounty is always optional and totally up to the customer.

Our triage team assesses all submitted reports for validity and completeness. Only complete and validated reports are accepted and forwarded to the customer.

Bug bounties are compared often to traditional application security assessment methods such as penetration testing. The volume of testers involved and the differing reward models can be defined as the most significant differences between the two. Bug bounties involve a more substantial amount of diverse researchers with all different skills and experience, as opposed to a select few penetration testers. In bug bounties, your pay per vulnerability and the height of the bounty depends on the severity of the vulnerability rather than for effort.

Known vulnerabilities are known to the public because they are published on the internet or when it has a CVE ID. These vulnerabilities are also added to vulnerability scanners so they can be easily detected. A vulnerability scan could be thought of as a surface-level security assessment since it only detects known vulnerabilities. A vulnerability scan cannot spot logic issues. A hacker might be able to intercept traffic and change data in transit, for example. A vulnerability scanner might not deem information disclosure as an issue. Furthermore, this type of assessment may not see images stored on the network without protection or encryption as being anything to be concerned about. However, if these images happen to be of peoples’ ID or credit cards, then that is a severe problem. A researcher can spot this and uncover the unknown vulnerabilities.

Our community of researchers are from all over the world besides countries that are on the U.S. sanctions list.

For our researcher programs we work with a carefully selected group of security researchers worldwide. We check personal information through an ID verification, review the researchers track record through an internet background check and assess their skills. The selection of Zerocopter Researchers is done by the Zerocopter team. When irregularities occur we are authorized to exclude a researcher from the community.

With a researcher program we offer the possibility to have a selected group of the best ethical hackers search for unknown vulnerabilities on your website. All researchers in our platform are screened and tested, so we can be sure we only work with the best and the most reliable researchers in the world. All reported issues are reviewed and validated by the Zerocopter’s Triage Team before publishing it to the dashboard. The researchers will be rewarded on a no-cure-no-pay basis, per approved vulnerability.

In a Coordinated Vulnerability Disclosure (CVD) policy you ask when someone discovers a vulnerability in your online environment to report it as soon as possible so you can address it quickly. This policy is visible to all of your users by for example mentioning it on your homepage. Vulnerabilities discovered by users are compiled by Zerocopter and reported to you in an easy to understand overview of the problem. The reports are presented in your own dashboard, you and your team will receive an email when a report has been added or edited.

The scanner finds known vulnerabilities in your site. Our scanner is a combination of the best vulnerabilities scanners available on the market. For example, OpenVAS is implemented in our scanner and we are working to implement more scanners for every aspect of your organisation.

Zerocopter uses minimal bounties to reward our Researchers for finding unknown vulnerabilities. Rewards for researcher programs are determined by the severity of the report. Each severity has a minimum reward. We subtract the average reward amount from your researcher program budget per validated vulnerability, once you set the actual reward this amount will be subtracted from the researcher program budget. The amounts are the rewards paid to the researcher and do not include a 30% handling fee. You can find the Vulnerability Price List via https://www.zerocopter.com/vulnerability-price-list