Merchants of Vulnerabilities: How Bug Bounty Programs Benefit Software Vendors

Esther Gal-Or, Muhammad Zia Hydari, Rahul Telang

We study how bug bounty programs (BBPs) shape software vendors' security and release choices. We develop a game-theoretic model in which a vendor chooses release timing and severit…