The pinnacle of crowdsourced security. What a live hacking event with Intigriti can do for businesses

Intigriti typically runs two types of hacking events.  

• Live hacking events are targeted engagements where hand-picked ethical hackers are invited to hunt for vulnerabilities in a specific company’s systems.  

• Conference hacking events take place on site at existing industry gatherings, bringing a company’s program to hackers who are already in the vicinity. 

In this article, the first of two parts, we focus on live hacking events to understand what they involve, what they mean for companies, and how they work. For a deep dive, I spoke with Ottilia Westerlund-Trew, Hacker Engagement Manager at Intigriti, who has a great deal of experience in successfully running live hacking events on a global scale.  

Quick introduction!  

Ottilia Westerlund-Trew is the Hacker Engagement Manager at Intigriti, with a professional background in application security and software engineering. Ottilia has had a great deal of experience in running large-scale bug bounty programs and brings practical, hands-on experience to her role. She bridges the gap between security teams and the hacker community, combining technical expertise with a people-first approach to supporting engaging bug bounty programs.  

Let’s dive right in! 

“Once an Intigriti customer decides they want to run an event, planning usually starts four to six months in advance. But the longer the better; we’ve seen some companies start planning a year ahead, partly for budget reasons, but also so they can let hackers know as early as possible. The program opens two weeks before the live date, and hackers spend those two weeks doing reconnaissance and hacking from home. Then there are usually three days on site.  

The first day is for travel, with a welcome event in the evening. The second day is hacking in the morning and a fun social event in the afternoon. The last day is a full day of hacking, finishing with an award ceremony, a show and tell, and a party before everyone goes home. 

Some of the top hackers around the globe only go to live hacking events. They might do bug bounty on the side for the big programs that pay very well, but mostly they travel from event to event. Researchers may have other things going on, like their own companies, but once hackers reach that level, a lot of them only do bug bounty at live hacking events. That’s also an indication of the talent you get. By running a live hacking event, you’re attracting the best people in the industry.” 

“The highlight for me is that every event includes a show-and-tell. A few hackers are hand-picked by Intigriti and the customer to walk through how they found a vulnerability: where they started, what made them look in a particular place, and so on. That’s incredibly impactful. If you tell anyone in security, ‘Here’s an app, find a vulnerability,’ the first question is where to start. Hearing a hacker explain, ‘I wondered why this part of the product behaved this way,’ and then how they escalated it, for example, ‘I initially thought it was a medium, but then I chained it with another vulnerability, and now it’s a critical’, is fascinating. We encourage customers to bring their team to watch and learn from these, because that helps stop those vulnerabilities from existing in the first place.” 

“The company must show up with its scope ready, prepared to remediate, and ready to answer questions. Everything else is taken care of. Literally all the logistics: travel, hotels, food, swag, everything. Each live hacking event has a unique theme that we come up with together with the customer, and we carry it through the swag, the poster, written assets like one-pagers, and the venue. We also organize the social events and produce an after-movie video of the event. I think the themes are one of the things that make our live hacking events unique. Everything is custom and ties together, which sets them apart from other platforms’ events.” 

Visit the live hacking event page for more on what Intigriti provides.  

“The location depends on the attendee list and the scope. If you only want European hackers, it doesn’t make sense to hold the event in the US. Likewise, if testing your product requires a Filipino phone number, the US doesn’t make sense either. There are a lot of factors like that to consider. Cost matters too: hosting in San Francisco is a lot more expensive than somewhere in Belgium. But it really depends on the company, their location, and scope.”  

“The Intigriti team hand-selects the right hackers by looking at the scope, and if the company already has a bug bounty program, we usually invite the people who’ve been performing well on it. If they’re starting fresh, we go out and find top hackers for that specific scope. If it’s something specific like AI, for example, we reach out to the top AI hackers. We’ve invited some of the biggest names in the bug bounty industry who weren’t very active with us, and they came, because it’s a live hacking event specialising in a certain area.” 

“It can go either way. Usually, companies have something in mind. Ideally, you want quite a big scope, because testing just one new feature is limiting when you have so many hackers. There are typically between 20 and 50 hackers at an event, sometimes more, sometimes fewer, so you want enough scope to spread them out. Untested scope is what every hacker wants. If you can include something that’s never been part of your program before, hackers will be really excited to test it for the first time.

A lot of companies think that if they limit the scope to one thing, everyone will focus on it and they’ll get great results. I’d say it’s better to have a big scope and then steer hackers towards what matters most with awards or bonuses. Keep as much as possible in scope, then put a juicy target on your crown jewels. We’ve seen a 100K bonus for being able to transfer money out of a bank account, for example. 

Imagine the worst-case scenario for your company, the thing that would ruin you, and put a price tag on it. That focuses hackers, while still leaving room for them to work on less critical assets and find vulnerabilities there too. You get a good spread: some hackers go after the edge cases; others go after the 100K. It’s a great way to guide hackers to where you want them.” 

“Live hacking events are really for our more mature customers, or at least customers with a very hardened scope. As a business, it’s not something you’d usually start with on your security journey. It’s the pinnacle of crowdsourced security, and something a company works up to. The main reason for this is that they are expensive to run, both logistically and in terms of bounties, because you need to offer high bounties to attract the best hackers in the first place. But in return, you get the full attention of top hackers for over two weeks, looking as hard as humanly possible on just your environment. You really get a lot of bang for your buck in terms of the number of reports, and the critical vulnerabilities unveiled.” 

“They need to be mature in their application security, because they must be able to deal with everything the event uncovers. On average, a live hacking event can produce hundreds of valid submissions, many of which are high severity or above. Most companies have internal policies requiring critical vulnerabilities to be fixed within 24 hours, so the question is whether you can handle that volume. Sure, they don’t all arrive on the same day; they come in over two weeks, but you still need the capacity. 

The same goes for triage. Intigriti has full-time triagers dedicated to live hacking events while they’re running, but the company also needs to be there. They need the people and the time to focus fully on the event while it’s happening, in person for the live portion of the event. 

Hackers want to talk to the customer, socialise with them, and have that face-to-face interaction. One of the main benefits of a live hacking event is the human connection it creates between the program and the hackers. We wouldn’t really run a live hacking event without the customer on site.” 

“Finding anything critical for a company is, in my opinion, a success. That’s a very scary vulnerability that would have been out in the wild if it weren’t for the event. Ideally, you want quite a few of them. If anything, you want to be slightly alarmed by how much people found. 

The human aspect is also important, especially in the current age of hacking agents. Seeing hackers collaborate with the customer, having direct conversations instead of leaving comments on a vulnerability report, being able to walk up and ask a question: that’s very valuable. It means hackers are more likely to keep testing that scope afterwards. 

Your business is building connections and a reputation as a good bug bounty program with researchers. Hackers can pick and choose which programs they work on. A lot of that comes down to money. But if you, as a business, can’t compete on money, you can compete by being a good program, with nice people who communicate well and treat researchers well.

Strong communication is key. If hackers get ignored, feel they’re being treated unfairly, or have no way to communicate with the program, that’s very off-putting.” 

“Being able to promote that you ran a live hacking event tells other hackers you have a program in place, and that you’re mature enough to host an event like this. It also shows the world that you take your security seriously and have a mature security team. Companies can make statements in their marketing like: “Every year we spend X on bounties, and we were very open about it, because it showed how much we cared about security.” 

“Access to the best hackers is an important distinction. Technically, a public program gives you access to all hackers, but whether they’ll test you is another question. A live hacking event gives you much more direct access to the top hackers. It’s also a chance for companies to learn from hackers in person.” 

Want to see a real-life Intigriti hacking event in action? Watch this video 

In summary, through a live hacking event with Intigriti, companies get a personalized experience with access to the best hackers available across the globe, the speed and concentrated efforts of those hackers, as well as measurable security outcomes where businesses pay for results. 

Thank you, Ottilia, for sharing your insights and experiences. I look forward to discussing conference hacking events with you in our next blog!  

Interested in learning more about setting up a live hacking event with Intigriti? Learn more about hacking events here.  

Not yet ready for a live hacking event, but want to engage more with the hacking community? Keep an eye out for our next blog on ‘Conference hacking events with Intigriti’ to learn how they differ from Intigriti’s live hacking events and how you and your business can join in and reap the rewards!