[tptacek]

Every startup with significant bounty programs I've talked to either staff an internal triage team or outsource triage --- but, either way, they are spending extra money on triage. I haven't talked to any that don't do this.

The concerns I've had raised to me about the value of these programs in practice all assume you're already paying extra to triage.

[SamHoustonCM]

Right but the cost differential between staffing it yourself and paying someone else to do it is substantial. Doing it yourself will cost you 3-5x more than paying someone else who is able to do it at scale.