AI overwhelms bug bounty programs, forcing closures and payout cuts
AI-generated vulnerability reports are overwhelming cybersecurity firms, leading to program closures and reduced payouts for basic bugs. Verification has become the main bottleneck, with the market splitting between cheap automation and high-value exclusives.
The cybersecurity industry's long-standing bug bounty model is under strain as AI tools churn out vast numbers of vulnerability reports. Vendors are being flooded with low-quality submissions, forcing many to close their bounty programs or slash payouts for common flaws.
According to a new report from ForkLog, the core issue has shifted from discovering bugs to verifying them. The market is polarizing: automated scanning services offer cheap, bulk submissions, while a handful of researchers command million-dollar exclusives for critical zero-days.
The article warns that upcoming EU regulations could turn the flood of AI-generated reports into a corporate liability nightmare. The imbalance between discovery and validation threatens to undermine the entire incentive system.
Source: ForkLog