|
|
|
|
|
|
by eganist
2881 days ago
|
|
|
Your bullets all line up with what Synack and Cobalt.io are doing. How do you differentiate from the two of them, who themselves are already competing hard with each other? Both of them strictly curate their test base, allow for strictly-private programs, allow for researchers to work closely with firms for resolution, can launch and operate your whole program, and charge per finding. |
|
|
That said, I don’t think there can be too many people trying to help companies secure themselves.
I think HackerOne and BugCrowd have <1,000 customers each. I’d guess Synack and Cobalt have less. I think less than 1% of YC companies have a bug bounty program -- and almost none below 50 employees have one.
We would like every company to have a bug bounty program, and that is what we’re tailoring our product to. (We’d certainly rather pay an outside researcher if they find a vulnerability than risk our customer’s data). Synack et al, I’m guessing, run tens to hundreds of thousand per month and accordingly, their software is focused on supporting a small number of large/enterprise customers. We think something important happens when you have tens of thousands of startups/companies using the same marketplace for bug bounties and pentests.
I think we probably all share the same general mission -- but our approach is a bit different: to build software that will be tailored to startups, and to have a lot more of them.