Software vendors would love nothing more than to pay the most money for bugs that, if not patched, would cause the most amount of pain for customers. But vendors and exploit finders have no way of knowing whether a particular bug will go nuclear. In my more than two decades of experience, I've become aware of a few bugs each year that I knew could go nuclear — but didn't. Conversely, the bugs that do go big often aren't all that new or interesting. Many have even had patches available for a long time.
You might think that patching a bigger number of security exploits would directly reduce security risks for customers. This is not true. For example, Microsoft software (I work for Microsoft) has had far lower numbers of known exploits than any of its nearest competitors (including Apple, Google, and Red Hat) for a long time now, but Microsoft software is still among the most exploited products. This is mostly due to the fact that it's the most popular software.
There's a patch for that
More to the point, 99 percent of all successful client computer exploitations do not involve unpatched vulnerabilities. They involve vulnerabilities that are known and for which patches are available — just unapplied. Or they don't involve a code vulnerability at all, such as socially engineered Trojans, phishing, and so on.
It could even be argued that a bug bounty program, because it results in a larger number of known exploits and patches, could actually result in more exploited customers, not fewer. I know this goes against conventional wisdom, but if you look at the methods by which most users are successfully exploited, I can't come to any other conclusion.
If found vulnerabilities could be addressed with more consistent patching, then we might have something. Actually, Microsoft does fairly well in this area, as its software consistently ranks among the most promptly patched software in the cyber ecosystem. Google often patches its software in hours to days after a bug is reported. The problem is that a certain percentage of users don't patch their software in a timely manner — and certain categories of software tend to be badly patched. Of course, if you don't apply publicly available patches, you can't really fault the vendor.
Plus, a large percentage of client exploits involve inducing users to install something they shouldn't (such as fake antivirus programs or other bogus applications). Bug bounty programs don't affect these sorts of attacks, and aren't meant to.
The return on bug bounties
In theory bug bounty programs should result in decreased risk for a vendor's customers, but the ultimate measure of success is whether that vendor's customers are actually attacked successfully less often over time. Realistically, this is almost impossible to isolate for.
Sign up for Computerworld eNewsletters.