All About the Benjamins: Building a Business-Critical Bug Bounty Program

The talk traces the history of Yahoo's bug bounty program, from an early disclosure episode and a small AOL-era recognition page through the merger of several company programs into one public program around 2017. The speaker describes a series of live hacking events in different countries, including a pilot that produced little activity, and explains how later events in San Francisco, Buenos Aires and New York showed that in-person sessions could sustain researcher engagement for weeks. Team-based formats and brand-focused events were also tested.

By 2020, after years of payouts, legal, finance, HR, executives and internal audit began asking whether the program was worth its cost and how it was controlled. The response covered sanctions screening of payees, vendor and contract reviews, and a cost-benefit model that multiplied an estimated breach cost by an assumed probability and the number of relevant bugs. Payment workflows were split into separate steps with independent approvals, and policies were written on whether former employees and contractors could take part.

The main takeaways are to identify every stakeholder early, think like an auditor so that processes are repeatable, and connect security work to business value. Consistent payout rules and operational runbooks keep researchers trusting the program, and a team should have solid product security hygiene before launching, since a new program attracts heavy traffic.