Skip to main content
DEFENZ
Sign inSign up

Join forces with ethical hackers and reduce your risk, without borders.

Launch a programI'm a researcher

Signed contract + safe harbor · pre-funded escrow · VAT invoice · 48 h acknowledgement and USD payout

Team credentials

What every program covers

  • Scope written and accepted before any submission.
  • In-house triage, acknowledgement within 48 hours.
  • P1–P5 severity validated, duplicates grouped.
  • Fix verified before any payout.

Every step is timestamped and exportable for your internal audit.

The problem

Legacy security workflows can't keep up

Your attack surface changes faster than your visibility

APIs, subdomains, mobile apps and exposed services change constantly. Without continuous visibility, you can't tell what is actually exposed.

Too many findings, not enough validated risk

Scanners produce volume, not value. Without human validation and exploitability context, critical fixes drown in noise.

Compliance evidence stays painfully manual

Testing and reporting live in separate tools. Teams collect screenshots instead of using live security activity as ongoing evidence.

Continuous offensive security

One platform for the full cycle

From the first test to the final payout, every step is traced.

Bug bounty

Continuous hunting inside a contractual scope; you only pay for valid vulnerabilities.

Responsible disclosure (VDP)

A governed public channel for external reports, with no bounty obligation.

Managed triage

48h acknowledgment, P1–P5 severity validated in 5 days, duplicates grouped, disputes mediated.

Escrow & global payouts

Pre-funded escrow; USD payouts within 14 days, with receipts.

Pre-funded escrow · tamper-evident audit log · CSV export

Recent activity

No disclosures yet

Publicly released reports will appear here after hunter consent and company validation.

  • Reports received2
  • Vulns fixed0
  • USD paid0 $

Live now

Open programs

Explore all programs

For companies

  • Strict scopeNo authorized scope, no testing. Contractual safe harbor with a signed testing authorization.
  • Pre-funded escrow750 USD minimum locked before a program can go live.
  • Managed triageOur expert team qualifies every report — you only receive actionable signal.
Launch a program

For researchers

  • Fast mobile payoutstransfer issued within 14 days of a verified fix.
  • 48h acknowledgmentEvery report gets a reasoned answer, never silence.
  • Verified reputationPoints, KYC badge and a Hall of Fame on every program.
I'm a researcher

The journey

From signature to payout

  1. Scope & escrow

    The company declares its assets and funds escrow. Our team approves before publication.

  2. Guided hunting

    Researchers test only authorized assets and file structured reports (CVSS, PoC, HTTP requests).

  3. Human triage

    48h acknowledgment, P1–P5 severity validated in 5 days, duplicates grouped.

  4. Fix & payout

    Fix verified, reward paid in USD within 14 days.

Everything you need to operate

Public & private programs

Open hunting or invited researchers, with per-program requirements (KYC, PoC, 2FA).

Triaged inbox

Only P1–P5 validated reports reach the company; noise is filtered out.

Escrow & billing

USD vault, 20% commission, receipts and reconciliation.

Dashboards

MTTA, escrow and earnings: every role gets a live space.

Our commitments

48h acknowledgment
5-day triage
Payout within 14 days
Min. 750 USD escrow

Priority sectors

Built for exposed organizations

  • Banking & insurance
  • Telecom & fintech
  • Fintech & payments
  • E-commerce & retail
  • Healthcare
  • Government & institutions

Transparency

The platform in numbers

Real statistics from the DEFENZ database, reported unfiltered.

Reports received
2
USD paid
—
Average first response
—

The severity breakdown will appear once reports have been triaged.

Reports per month (last 6 months)

Legal framework

Security & compliance, by design

Every test, state transition and payout is written to an append-only audit log retained 3 years. Personal data is encrypted and coordinated disclosure is the default.

  • OWASP-aligned testing process (WSTG)
  • Coordinated 90-day disclosure by default
  • KYC & anti-Sybil researcher vetting
  • Written scope, rules accepted before publication, pre-funded escrow and an exportable audit log.

Pricing

Company pricing

Best for first programme

Starter

The baseline for launching a first programme with submissions.

990USD/ yr

Minimum escrow 750 USD

Programs
1
Assets
2
  • Always-on VDP (public disclosure channel)
  • Ack-only triage (48 h)
  • Submissions dashboard + CSV export
Choose this plan
Most popular

Business

Recommended for teams that want triage handled for them.

2,490USD/ yr

Minimum escrow 2,500 USD

Programs
3
Assets
10

Everything in Starter, plus:

  • DEFENZ-managed triage · CVSS · 48h/5d/14d SLA
  • Monthly activity reports
Choose this plan
Banks & telecoms

Professional

Researcher coordination, retest and oversight for critical lines.

5,990USD/ yr

Minimum escrow 8,000 USD

Programs
5
Assets
25

Everything in Business, plus:

  • Outbound webhook integrations
  • Researcher coordination · retest · exec dashboard
Choose this plan
Custom onboarding

Enterprise

Unlimited coverage, dedicated TAM and quarterly review.

14,990USD/ yr

Minimum escrow 16,000 USD

Programs
Unlimited
Assets
100

Everything in Professional, plus:

  • Dedicated TAM · priority triage · quarterly exec review
Choose this plan
  • Setup fee waived on annual plans.
  • 2 months free · Annual = 10× monthly.
  • 20% commission on rewards paid out.
  • Unused escrow is refunded at program close.

Estimating your bounty budget? See the severity ladder (P1–P5) →

Good to know

Frequently asked questions

What if a researcher goes out of scope?

No scope = no test. Out-of-scope testing is rejected and logged under a contractual safe harbor.

How are rewards paid?

In USD, within 14 days of a verified fix. Funds are pre-funded and escrowed for the life of the program.

Who triages reports?

An expert team: 48h acknowledgment, severity validated in 5 days. Duplicates are grouped, never penalized.

Is my data protected?

Encrypted personal data, 3-year audit log, bilingual safe harbor, deletion on request.

What does a program cost?

SME from 99 USD/month + 20% per reward, or on quote. 249 USD setup, 19.25% VAT extra.

DEFENZ

Launch your programme in 7 days

See how DEFENZ discovers your exposure, validates risk, prioritizes remediation and produces audit-ready evidence.

Book a discovery callI'm a researcher

DEFENZ · USD · EUR · XAF · NGN · GHS