Where security researchers earn online
Security researchers get paid bounties for finding and reporting vulnerabilities in companies' software, under rules each program publishes. Payouts depend on severity, from tens of dollars to six figures.
Also for: ethical hacker, pentester, cybersecurity analyst
How security researchers earn online
- Public bug bounty programs open to anyone who signs up
- Private, invite-only programs once you have a track record
- Paid penetration-testing engagements through vetted networks
Tip: Read each program's scope and rules first: testing outside scope can get you banned and earns nothing.
What security researchers earn in the US
- Median pay a year
- $129,180
- Median pay an hour
- $62.11
- Range (10th to 90th percentile)
- $75K–$200K
- Employed in the US
- 190,700
US employees in the closest official occupation (SOC 15-1212), from the Bureau of Labor Statistics. Freelance rates online vary widely by country, experience and platform, so treat this as a benchmark for what the work is worth, not what a platform will pay.
The top 11 platforms for security researchers, compared
| Platform | Type | Fees | Pays via | Who can join |
|---|---|---|---|---|
 HackerOne |
Bug bounty platform | Bounties set by each program | PayPal, Bank transfer, Bitcoin, USDC | Worldwide except Cuba, Iran, North Korea and Syria |
 Bugcrowd |
Bug bounty platform | Bounties set by each program | PayPal, Bank transfer | Worldwide except Cuba, Iran, North Korea and Syria |
 Zerocopter |
Bug bounty platform | Severity-based bounty rewards | Bank transfer | Worldwide |
 HackenProof |
Web3 bug bounty platform | Severity-based bounties per program | Crypto, Bank transfer | Worldwide |
 Intigriti |
Bug bounty platform | Bounties set by each program | Bank transfer | Worldwide |
 Immunefi |
Web3 bug bounty platform | Severity-based bounties up to $10M | Crypto, Bank transfer | Worldwide |
 YesWeHack |
Bug bounty platform | Bounties set by each program | Bank transfer | Worldwide |
 Cobalt |
Vetted pentest platform | Pentesters paid per project | Bank transfer | Worldwide |
 Open Bug Bounty |
Vulnerability disclosure platform | Voluntary rewards from site owners, free non-profit | Direct from site owner | Worldwide |
 Synack |
Vetted security platform | Vetted researchers earn per vulnerability | Bank transfer | Worldwide |
 Tidelift |
Open source funding | Pays maintainers per package by usage | Bank transfer | Worldwide |
A dash means we haven't verified that detail yet.
Bug bounty platforms
10 for security researchers
HackerOneThe largest bug bounty platform, where security researchers report vulnerabilities to companies and earn bounties. Open sign-up, with invitations to private programs as reputation grows.
Fees Bounties set by each programhackerone.comBugcrowdA crowdsourced security platform running bug bounty and vulnerability disclosure programs. Researchers earn cash for valid findings, ranked by a points system.
Fees Bounties set by each programbugcrowd.comZerocopterA Dutch security platform running bug bounty and coordinated vulnerability disclosure programs with a community of invited researchers.
Fees Severity-based bounty rewardszerocopter.comHackenProofA bug bounty platform from the Hacken security ecosystem, focused on web3 and crypto projects with public and private programs.
Fees Severity-based bounties per programhackenproof.comIntigritiA European bug bounty platform connecting ethical hackers with companies across the continent and beyond. Known for community events and fast triage.
Fees Bounties set by each programintigriti.comImmunefiThe leading bug bounty platform for web3 and smart contracts, known for some of the largest payouts in security - top bounties run into the millions.
Fees Severity-based bounties up to $10Mimmunefi.comYesWeHackA French bug bounty platform serving European enterprises and public institutions. Researchers worldwide hunt on public and private programs.
Fees Bounties set by each programyeswehack.comCobaltA pentest-as-a-service platform whose vetted Cobalt Core community of pentesters earns from structured engagements rather than open bounties.
Fees Pentesters paid per projectcobalt.ioOpen Bug BountyA non-profit, open platform for responsible disclosure of website vulnerabilities. Researchers report issues and site owners may reward them voluntarily.
Fees Voluntary rewards from site owners, free non-profitopenbugbounty.orgSynackA vetted security testing platform whose Red Team accepts researchers only after skills assessment and background checks. Members get steady, well-paid engagements.
Fees Vetted researchers earn per vulnerabilitysynack.comOpen source funding platforms
1 for security researchers