Frontify’s bug bounty program: How hackers make us safer

At Frontify, we know about the importance of information security and have tried-and-true mechanisms and policies in place to protect assets, data, and customers. However, the more we rely on the digital world, the more we invite vulnerabilities into our environment: Security measures that worked yesterday might introduce weaknesses today. To provide the best and most secure platform to help brands thrive, we need to be one step ahead of ever-evolving cyber threats.

Penetration tests versus bug bounties Our developer team has grown dramatically in the last two years — and so has our product. We asked ourselves if classic penetration tests still do us justice. In our case, one to two testers performed a test for about five days and generated a report. The problem with this process was, and still is, that with such a small team, we only got one or two sets of skills at a time. Another aspect that’s even more important: After the test, the application could already have new vulnerabilities.

If classic pen tests are not providing enough relevant results, what’s a more efficient solution? Get an internal pen tester? Do even more pen tests with different companies? We concluded that none of these solutions use our resources effectively, so we looked into a different approach: a bug bounty.

A bug bounty is a monetary reward given to ethical hackers for successfully discovering and reporting a vulnerability or bug to the application's developer. Bug bounty programs allow companies to leverage the skills of the hacker community to continuously improve their systems’ security posture. Providing tens of thousands of highly skilled security researchers with access to our platform so that they can “snoop around” was exactly what we needed.

After various conversations and demonstrations with different programs, we decided that Bugcrowd would work best for our needs, technical setup, and budget. To gain some experience, we started with a private program and narrowed the scope for the launch to the web application and the API. Our goal is to have the entire Frontify ecosystem in scope by Q1 2023.