"Crowdsourced security was very interesting. Financially first, with the notion of bounties. You only pay if bugs are found – it encourages performance. Secondly, there are no compromises. A traditional service provider will often adapt to the client’s request, directing the research or even the results according to the objectives. …

“We’ve done a lot of pentests, we always do some for compliance or to get back on critical applications. But with bug bounty, it’s different. You’re not waiting for a report, you’re waiting for a critical vulnerability. That’s the difference as well. And with Yogosha, criticals have almost always been …