Cobalt Offensive Security Testing vs. HackerOne

Our security team will never scale like we'd like to do having this had been extremely helpful to manage, address, and payout vulnerabilities reported. I like having one "door" for this and not multiple ways to report stuff

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

I haven't used any other products as such but I have read about bugcrowd.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized