Bug bounty vs Vulnerability Disclosure Programme: differences and when to use each
By Kike Gandia · Co-Founder & CEO, OSCP
Bug bounty and Vulnerability Disclosure Programme (VDP) are two mechanisms for external researchers to report vulnerabilities in your systems. But they have different goals, costs and audiences. Choosing the wrong one — or launching one without being prepared for the other — can be counterproductive.
What a VDP is and how it differs from a bug bounty
A VDP is a formal responsible disclosure channel: it defines how and where researchers can report vulnerabilities, what to expect in return (a response, acknowledgment) and the programme rules. It does not offer monetary rewards.
A bug bounty is a rewards programme: researchers receive payments proportional to the severity of the vulnerabilities they find. It requires a bounty budget on top of the management cost.
Key differences:
• VDP: no bounty cost, lower report volume, regulatory compliance.
• Bug bounty: bounty + management cost, higher volume and quality of reports, attracts the best researchers.
When to start with a VDP
A VDP is the recommended starting point if:
• You have never had a formal disclosure programme.
• Your product is not security-mature enough to handle the volume of a bug bounty.
• You need to comply with NIS2 or the Cyber Resilience Act (both require disclosure channels).
• You have no budget for bounties but do have budget for programme management.
• You want to validate the process before committing to monetary rewards.
When a bug bounty makes sense
A bug bounty makes sense when:
• Your security posture is strong: you have done recent pentesting, have a mature SDLC and the obvious critical vulnerabilities are patched.
• You have a bounty budget: well-managed programmes pay thousands of euros per month in rewards.
• You want to attract the best researchers: the most technical profiles only participate in programmes that pay.
• You need a continuous flow of security findings as part of your development cycle.
The mixed model: VDP first, bug bounty later
The most common and recommended transition:
1. Start with a private VDP (invited researchers only) to validate the triage and response process.
2. Open the VDP publicly once the process is working well.
3. Launch a private bug bounty with a limited budget for the most active VDP researchers.
4. Open the public bug bounty when you are confident in the volume of reports you can handle.
This progressive approach reduces the risk of being overwhelmed and builds a community of trusted researchers.
FAQ
Can I have a VDP and a bug bounty at the same time?
Yes. Many large companies have a public VDP (for general vulnerabilities) and a private bug bounty for their most critical assets. It is a valid combination that maximises coverage without compromising the budget.
Does a VDP legally protect me from researchers who hack my systems?
A VDP establishes a framework for responsible action but does not grant automatic legal immunity. For effective legal protection, the policy must clearly specify the safe harbour conditions: which activities are permitted, which systems are in scope and that no legal action will be taken against researchers who act within the rules.
How much does it cost to have a VDP?
The direct cost of a VDP is the management cost (there are no bounties). If you manage it internally, the cost is your team's time. If you outsource it, the cost is the management service fee. In both cases, it is significantly lower than the cost of an active bug bounty.
Related service
bug bounty and vulnerability management services