[yaleman]

Only the biggest companies can really afford to have the scale and skill available from the vast range of people working for bug bounty money - and as one of the other posters mentioned - you still have to have internal staff to confirm and patch the bugs. It's almost like the best side of outsourcing, where the outsourced talent is driven to do their best work because otherwise they'll never get paid.

Then again, I can imagine some teams would get utterly spammed with inane, wrong or non-bounty-able reports, which could be an issue.