Key Highlights of 2018 Hacker One Report
With 1,698 respondents, The 2018 Hacker Report is the largest documented survey ever conducted of the ethical hacking community. One in four hackers have donated bounty money to charity, many hackers share knowledge freely with other hackers and security researchers, and they have helped the U.S. Department of Defense resolve almost 3,000 vulnerabilities - without receiving a cash bounty.
Below are the key highlights.
- Bug bounties can be life changing for some hackers. The top hackers based in India earn 16x the median salary of a software engineer. And on average, top earning researchers make 2.7 times the median salary of a software engineer in their home country.
- Nearly 1 in 4 hackers have not reported a vulnerability that they found because the company didn’t have a channel to disclose it.
- Money remains a top reason for why bug bounty hackers hack, but it’s fallen from first to fourth place compared to 2016. Above all, hackers are motivated by the opportunity to learn tips and techniques, with “to be challenged” and “to have fun” tied for second.
- India (23%) and the United States (20%) are the top two countries represented by the HackerOne hacker community, followed by Russia (6%), Pakistan (4%) and United Kingdom (4%).
- Nearly 58% of them are self-taught hackers. Despite 50% of hackers having studied computer science at an undergraduate or graduate level, and 26.4% studied computer science in high school or before, less than 5% have learned hacking skills in a classroom.
- While 37% of hackers say they hack as a hobby in their spare time, about 12% of hackers on HackerOne make $20,000 or more annually from bug bounties, over 3% of which are making more than $100,000 per year, 1.1% are making over $350,000 annually. A quarter of hackers rely on bounties for at least 50% of their annual income, and 13.7% say their bounties earned represents 90- 100% of their annual income.