HackerOne, Synack win DOD contracts to expand bug bounty program

The Department of Defense has awarded two contracts to expand its bug bounty program across a variety of its digital assets.

DOD awarded contracts to San Francisco-based HackerOne and Redwood City, Calif.-based Synack, allowing crowdsourced security researchers to scour its applications, websites and networks for vulnerabilities.

The contract awarded to HackerOne will allow it to run DOD bug bounty challenges similar to the Hack the Pentagon program conducted earlier this year. The contract awarded to Synack is modeled after a private bounty program, focused on the DOD’s sensitive IT assets and utilizing only highly vetted researchers.

The combined contracts are valued at $7 million and are expected to cover up to 14 challenges.

“As adversaries become more sophisticated and the threat environment continues to evolve, maintaining the highest levels of security has never been more important,” said Mark Wright, a spokesman at the Office of the Secretary of Defense. “By partnering with these leading crowdsourced security companies, we can take a much more innovative, diverse, scalable and effective approach to better protect and defend our digital assets.”

Earlier this year, the Pentagon awarded $71,200 in bounties after people participating in the Hack the Pentagon program found 138 vulnerabilities. In that program, hackers were limited to searching for vulnerabilities on the Pentagon’s public-facing websites, and most commonly they found errors in cross-site scripting, information disclosure and cross-site request forgery, according to HackerOne.

“No government or organization is so powerful that it does not need outside help identifying security issues. Working with the external hacker community will supplement the crucial cybersecurity work that DOD is doing internally,” said HackerOne CEO Marten Mickos in a release. “Securing our online society is paramount and this puts the U.S. federal government in the forefront.”

“This award really marks a turning point in harnessing innovation to secure the nation’s most critical assets.” said Synack CEO Jay Kaplan. “As attacks become more sophisticated, the DOD is taking a much needed innovative approach to security by harnessing the world’s best security researchers.”