VDP vs Bug Bounty: Which One a Small Company Needs First

When I counted the CVE Program's partner list on 18 October 2026, 20 of its 557 CNA entries were typed "Bug Bounty Provider," against 146 typed "Open Source" and 124 typed "Researcher." Bounty platforms are a recognized part of the disclosure system, but they are a small part of it. Most reporting still goes straight to vendors, and the first thing a vendor needs is a place for it to land.

Customers ask for a VDP. Founders sometimes hear "bug bounty" and assume it is the same. It is not.

What's affected

Any company deciding how to receive outside security reports. The two programs differ in what they promise and what they cost.

CISA's BOD 20-01 is a clear example of the line. It asks agencies to consider stating in their policy that reporters will not receive payment and waive claims to compensation, and it allows a link to a separate bounty policy where one exists. A VDP and a bounty can coexist, with the VDP as the base.

How to check if you're exposed

Ask the questions below before you commit to either.

• Can you answer a report within two working days, every week, including holidays?
• Do you have a place to track findings and an owner for each?
• Can you fix a high severity bug in days, not quarters?
• Do you know your scope well enough to say what is out of bounds?
• Who approves a payment, and from which budget?

If two or more answers are "no", a bounty will not help. It will create a queue of unpaid and unanswered reports with your name on it.

What to do now

1. Publish a VDP first. It satisfies most customer questions and gives researchers a safe route. The companion template post gives a one page starting point.
2. Add a security.txt pointing at it, so the contact is easy to find.
3. Run the VDP for a quarter. Count reports, valid findings and time to respond.
4. If valid findings arrive steadily and you fix them quickly, consider small rewards or a private invite program. Define severity bands, a maximum, and what is excluded.
5. Decide whether to use a platform or handle payments yourself. A platform brings a triage layer and a researcher pool, with fees and its own rules. Handling it yourself keeps control, with the workload.
6. Keep the VDP page after you add rewards. Researchers who do not want money still need a route.

How to avoid this trap

1. Do not announce a bounty before you have fixed the last three valid reports. Unfixed findings make payments look like hush money.
2. Do not offer cash for classes of bug you will not accept, such as missing headers or self-XSS. List exclusions.
3. Do not skip legal review of the payment terms. A reward changes expectations about confidentiality and timelines.
4. Do not treat the bounty as your security testing. It finds what outsiders happen to try. A penetration test with a defined scope remains a separate control.

Why it matters

Founders often reach for a bounty because it sounds like proof of maturity. For an enterprise buyer, the proof is a working report path and a record of fixing things. Both come from a VDP.

The reverse trap is also real. A company with a big customer base and a quick fix pipeline can use the market a bounty creates. The decision is a staffing and budget one, not a moral one.

Try it yourself

Open the last security questionnaire you received and find the rows about vulnerability disclosure, penetration testing and bug bounty. Write an honest one sentence answer for each. Then try the walkthrough below to see how questionnaire answers can be drafted and reviewed.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CVE Program CNA partner list data, fetched 18 October 2026
• CISA BOD 20-01
• RFC 9116