Our platform brings quality researchers within your reach, so you don’t have to hire security-experts on a full-time basis who are not available anyway.Learn more
In the world of online security, we notice a lot of doubt when it comes to working with hackers.
Although the term ‘ethical hacking’ is gaining ground, there’s still much uncertainty that needs to be erased before the majority of companies are willing to work with hackers. Right now, online security has become a Wild West for companies. Trying to get control of risk levels by assigning security teams, hiring security companies at scheduled intervals and licensing multiple expensive solutions, but eventually, ending up with a security flow that is not insightful and with reports scattered all over the place.
Our platform brings you to the forefront of security technology
Who understand and work for your objectives
By communicating directly with researchers about reports
Just get an account, log in and choose a project. Next, see how Zerocopter researchers from all over the world get to work and deliver well-written, validated reports in your dashboard. We offer you the possibility to start a conversation in a thread with both the researcher and triage team member involved.
After receiving an invite to the platform, you can log in and create a project. Your project can be a Researcher Program, a Coordinated Vulnerability Disclosure, Automated Scanning or for those with a specific project, Dedicated Hacker Time.
You decide which parts of your application are tested by our automated scanners and researched by our team of ethical hackers. You have complete control over the do’s and don’ts that apply to the way vulnerabilities are unearthed and the allowed and disallowed technical methods.
Well-written and evidence-based reports will, after being checked by our experienced Triage Team, pop up in your platform dashboard. Constructive reports by constructive hackers.
After receiving a report with a vulnerability, you can take the required measures to ensure this vulnerability is solved. After, you can ask the involved researcher for a retest in which the researcher will assess if the updated safety measure is adequate and well implemented. Is the vulnerability is resolved, the researcher is paid.
Use automated scanners to regularly check your website for SQL injections, cross-site scripting vulnerabilities (XSS), missing security patches, and hundreds of other potential security issues lurking in your app.
Choose your scope by simply adding URLs you wish to scan and schedule the scanner. Scanner reports are scored by severity, parsed into a readable format and immediately made visible on your dashboard.
Zerocopters scanners are updated daily to scan for the latest vulnerabilities.
Just like researcher reports, reports originating from the Coordinated Vulnerability Disclosure workflow are also reviewed by our triage team of security experts. The check by our triage team means you receive accurate reports about real vulnerabilities only.
You can choose to pay rewards to individuals who report a valid vulnerability via the Coordinated Vulnerability Disclosure program, or you can pay rewards to research program participants only.
Many companies are unable to hire, train and retain a team of world-class security experts, with each team member having a unique set of security skills. Zerocopter gives you access to the world's best ethical hackers, whether you need 10, 50 or more researchers on your project.
Researchers are awarded on a no-cure-no-pay basis, per approved vulnerability report. By doing this, we offer you a cost-effective way to tap into the knowledge of experts without having to employ dozens of security engineers.
In need of a security check done by quality researchers? Want to steer the focus of the research? With our 10.4 - Dedicated Hacker Time, we enable you to start a program for your specific needs in one work day! Want to learn more?
Read all about our Dedicated Hacker Time
Upon launching your Researcher Program, you have to define a maximum budget for rewards. Researchers will see how much you are willing to spend on your Researcher Program. Zerocopter can help you choose an appropriate budget based on your applications and program scope.
This budget has no relation to your monthly subscription fee. You will receive a separate invoice once per month for payments made by us towards researchers who have found vulnerabilities.
Here you’ll find the questions other clients ask us the most.
Payments are done after a report gets the status “resolved”. Payments are distributed via bank, PayPal and Bitcoin. To receive payments, make sure that you have a working PayPal account or Bitcoin address. Unfortunately, some payment providers charge a fee for receiving money.
Zerocopter is a closed platform. This means we don’t have public lists with our customers that use our CVD or researcher program services. We also don’t have a public list with the researchers in our platform and we don’t have a ranking.
We ask you to submit a report via our platform and choose a category for the vulnerability, fill in the URL of the found vulnerability and provide a description of the vulnerability, steps on how to reproduce the vulnerability and a possible solution. This will make it easier for triage to validate your report and easier for our customers to understand your report. Triage validates every report and will ask you questions when something is not clear. After validation, your report will be sent to the customer.
This depends on the subscription plan you use. We work with Triage response times for max. 3 working days (starter plan), 2 working days (professional plan) and 1 working day (enterprise plan).
With App support you get all the support you need to use our platform and our services. With our Services report we will help you with several custom support issues, like attending regular meetings, supporting you with custom overviews and support on the use of our services within your general security policies.
Yes we do! We offer App support (default) and Services support.
A Coordinated Vulnerability Disclosure report has a reward amount of 0 euros by default, but we offer the possibility to assign a bonus to a Coordinated Vulnerability Disclosure report. A bonus bounty is always optional and totally up to the customer.
Our triage team assesses all submitted reports for validity and completeness. Only complete and validated reports are accepted and forwarded to the customer.
Bug bounties are compared often to traditional application security assessment methods such as penetration testing. The volume of testers involved and the differing reward models can be defined as the most significant differences between the two. Bug bounties involve a more substantial amount of diverse researchers with all different skills and experience, as opposed to a select few penetration testers. In bug bounties, your pay per vulnerability and the height of the bounty depends on the severity of the vulnerability rather than for effort.
Known vulnerabilities are known to the public because they are published on the internet or when it has a CVE ID. These vulnerabilities are also added to vulnerability scanners so they can be easily detected. A vulnerability scan could be thought of as a surface-level security assessment since it only detects known vulnerabilities. A vulnerability scan cannot spot logic issues. A hacker might be able to intercept traffic and change data in transit, for example. A vulnerability scanner might not deem information disclosure as an issue. Furthermore, this type of assessment may not see images stored on the network without protection or encryption as being anything to be concerned about. However, if these images happen to be of peoples’ ID or credit cards, then that is a severe problem. A researcher can spot this and uncover the unknown vulnerabilities.
Our community of researchers are from all over the world besides countries that are on the U.S. sanctions list.
For our researcher programs we work with a carefully selected group of security researchers worldwide. We check personal information through an ID verification, review the researchers track record through an internet background check and assess their skills. The selection of Zerocopter Researchers is done by the Zerocopter team. When irregularities occur we are authorized to exclude a researcher from the community.
With a researcher program we offer the possibility to have a selected group of the best ethical hackers search for unknown vulnerabilities on your website. All researchers in our platform are screened and tested, so we can be sure we only work with the best and the most reliable researchers in the world. All reported issues are reviewed and validated by the Zerocopter’s Triage Team before publishing it to the dashboard. The researchers will be rewarded on a no-cure-no-pay basis, per approved vulnerability.
In a Coordinated Vulnerability Disclosure (CVD) policy you ask when someone discovers a vulnerability in your online environment to report it as soon as possible so you can address it quickly. This policy is visible to all of your users by for example mentioning it on your homepage. Vulnerabilities discovered by users are compiled by Zerocopter and reported to you in an easy to understand overview of the problem. The reports are presented in your own dashboard, you and your team will receive an email when a report has been added or edited.
The scanner finds known vulnerabilities in your site. Our scanner is a combination of the best vulnerabilities scanners available on the market. For example, OpenVAS is implemented in our scanner and we are working to implement more scanners for every aspect of your organisation.
Zerocopter uses minimal bounties to reward our Researchers for finding unknown vulnerabilities. Rewards for researcher programs are determined by the severity of the report. Each severity has a minimum reward. We subtract the average reward amount from your researcher program budget per validated vulnerability, once you set the actual reward this amount will be subtracted from the researcher program budget. The amounts are the rewards paid to the researcher and do not include a 30% handling fee. You can find the Vulnerability Price List via https://www.zerocopter.com/vulnerability-price-list