What problems is Bugcrowd solving and how is that benefiting you?
Initially our organisation received bug disclosures via our public facing customer service inbox. This lead to a lot of confusion within our customer service team as to what to do about these disclosures. Often these disclosures were also low quality, and often the output of an automated script that targets high-traffic web applications for bugs and a contact email, prospecting us for a financial reward with little to no remediation advice or proof of exploit.
Bugcrowd provides a layer of filtration away from these submissions, their traige team ensure that we do not see low quality or repeat findings, thanks to their knowledge of previous disclosures that we already were dealing with before onboarding them. They put an onus on researchers to provide remediation advice, evidence to support their disclosures and discretion when submitting bugs.
The platform itself also allows us to integrate crowd based testing into our productivity processes, via Jira tickets that are created for findings, that are programatically added to the correct queue and status for prioritisation by agile delivery managers in development teams. Their slack integration also allows for a natural conversation to occur within our organisation whenever a new finding is submitted, keeping both the development and security teams talking about application security. Review collected by and hosted on G2.com.