HackerOne, a company that hosts bug bounty programs for some of the world's largest companies, published today its ranking of the 10 most successful programs hosted on its platform.
The ranking is based on the total amount of money awarded to hackers by each company, since April 2020.
The HackerOne list for 2020 is the second edition of this ranking, with the first published last year. The top ranking of 2019 was: (1) Verizon Media, (2) Uber, (3) PayPal, (4) Shopify, (5) Twitter, (6) Intel, (7) Airbnb, (8) Ubiquiti Networks, (9) Valve and (10) GitLab.
In 2020, there were some changes in the Top 10, but the leader remained the same, with Verizon Media maintaining its position at the top and running the most successful bug bounty program on HackerOne.
1)VERIZON MEDIA
2019 rank: #1 (-)
Verizon Media is the undisputed leader of the most active and successful bug bounty program hosted on the HackerOne platform. Verizon Media more than doubled the amount of money awarded to security researchers, from $4 million to more than $9.4 million this year, with the total amount awarded over a one-year period being $5.4 million.
Currently, Verizon Media ranks first in payments and is in first place regarding the hackers it thanked (1,315) and also is first in the most bug reports resolved (5,928). Additionally, one of Verizon Media's bug bounty rewards also ranks among the top 5 largest payments ever given on HackerOne, with a $70,000 prize awarded to a lucky researcher.
2) PAYPAL
2019 rank: #3 (+1)
Despite the execution of one of the most recent programs on HackerOne, which was posted just in August 2018, PayPal has become fully established as one of the most active companies on the platform, paying almost $2.8 million over the past two years and $1.62 million last year.
3)UBER
2019 rank: #2 (-1)
From last year's ranking, Uber's security team has awarded $620,000 in bug bounties, raising the company's total to $2,415,000 awarded on HackerOne from the program that went live in December 2014.
Currently, Uber's bug bounty program ranks in the top 5 of the most satisfied hackers.
4) INTEL
2019 rank: #6 (+2)
Intel rose two spots in the 2020 ranking as the company paid over 1 million dollars in bug bounties to researchers over the past 12 months.
While the total amount has never been made public, Intel has also paid the highest bug bounty ever paid on the HackerOne platform, with the amount believed to be between $100,000 and $200,000 for a vulnerability affecting CPUs.
5) TWITTER
2019 rank: #5 (-)
With one of the oldest programs on HackerOne, launched in May 2014, Twitter has paid out more than $1,288,000 in bounty money to security researchers, with $118,000 of that given out in the last 12 months.
6) GitLab
2019 rank: #10 (+4)
In 2020, code hosting platform GitLab went from #10 to #6 in one of the biggest jumps in this year’s rankings. The company paid out more than $641,000 in bug bounties to security researchers in the past 12 months, bringing its total payouts to $1,211,000.
The company also has one of the fastest response times on HackerOne, responding to security researchers within an hour on average for new bug reports.
7) MAIL.RU
2019 rank: 14 (+7)
A new entry in HackerOne’s Top 10 is Russian email service Mail.ru, which saw the biggest jump in the rankings. The company paid out more than $819,000 in bug bounties over the past 12 months to reach a total of $1,119,000 since it joined the platform in April 2014.
8) GITHUB
2019 rank: 11 (+3)
Another program that has been very active over the past 12 months has been GitHub. The company has paid out more than $467,000 to security researchers for bugs reported over the past 12 months, bringing the total to $987,000 since its launch in April 2016.
9) Valve
2019 rank: 9 (-)
Valve maintained its spot in the Top 10 this year, remaining at #9. Over the past 12 months, the company has paid out an additional $381,000 in bounties to “bug hunters,” bringing its total to $951,000 since the launch of program in October 2017.
10) AIRBNB
2019 rank: 7 (-3)
Despite awarding more than $344,000 in bug bounties over the past 12 months, it wasn't enough for Airbnb to maintain its #7 spot from last year. In 2020, the company moved up to #10 after awarding more than $944,000 in bug bounties since February 2015.
