Post #1827759

2026-04-30 18:26 UTC

I haven&#39;t been focused on security research since ~November of last year for a reason: to wait and see how VRPs and bug bounty programs adapted to the rapidly changing infosec landscape due to AI tooling. TL;DR: It was hard to make decent money from VRPs. It&#39;s now even harder. It&#39;s not researchers&#39; fault. Thread below.

Replies (1)

@AlesandroOrtiz@infosec.exchange 2026-04-30 18:26

An avalanche of reports (both good and bad quality) had strained existing processes and teams. On the other hand, improved tooling also helped defenders do better internal research and speed up patching, among other processes. Overall, security research might be better with AI tooling, but we also need to throw more humans at the problem. And pay them well. Recent trends are generally good for users (better security, hopefully). But it's bleak for security researchers who focus on bug bounties, myself included. I can probably no longer make decent income from VRPs. I don't know how many others can too, given the widespread suspension of VRPs or narrower scopes of higher-difficulty issues (~good) with historically-low rewards (awful). While I had seen this coming for a year or so, it's still disappointing.

Open ##2393292