How much should a bug bounty program pay for a critical vulnerability?

Public program data from HackerOne, Bugcrowd, and Intigriti shows critical payouts that range from about $1,500 at small programs to $50,000 or more at mature programs. The calculator maps your program maturity and asset criticality onto that range.

What does a bug bounty program cost per year?

Annual cost is the sum of expected valid findings per severity multiplied by the payout at each severity, plus platform fees (often 15 to 20 percent of bounties) and a reserve for unexpected criticals. The budget mode shows the low, expected, and high estimate.

Where do the benchmark numbers come from?

The defaults are derived from public bounty tables and platform reports. They are estimates for planning. Adjust the payout tiers to match your own policy.

Bug Bounty Calculator

Free bug bounty calculator. Estimate a fair payout for a finding by severity and asset criticality, or model the annual budget for a bug bounty program.

Program · Step 1 of 4

Program maturity

How established is the program? The preset sets the payout table.

StarterFirst program. Small scope, limited budget, a few hundred researchers.$1.5K–$5K criticalEstablishedPublic or large private program. One to three years of history.$5K–$15K criticalMatureBroad scope, dedicated triage team, competitive payouts.$15K–$50K criticalTop tierLarge technology company or financial institution with headline payouts.$50K–$250K critical

How it works

Payout mode starts from a benchmark range for the severity at a program of your maturity, scales it by asset criticality, and recommends the geometric midpoint plus 25 percent for a working proof of concept. Budget mode multiplies expected valid findings per severity by the same ranges, then adds the platform fee and a reserve.

Input	Effect
Program maturity	Selects the benchmark payout table. Edit the table to match your policy.
Severity or CVSS score	Selects the row. CVSS 9.0+ is Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium, below 4.0 Low.
Asset criticality	Core assets pay the full range. Secondary assets pay half. Peripheral assets pay a quarter.
Proof of concept	Adds 25 percent to the geometric midpoint, rounded to 50 dollars and capped at the maximum.

Benchmark tables

Program	Critical	High	Medium	Low
Starter	$1,500 – $5,000	$500 – $1,500	$150 – $500	$50 – $150
Established	$5,000 – $15,000	$1,500 – $5,000	$500 – $1,500	$150 – $500
Mature	$15,000 – $50,000	$5,000 – $15,000	$1,500 – $5,000	$300 – $1,500
Top tier	$50,000 – $250,000	$15,000 – $50,000	$5,000 – $15,000	$1,000 – $5,000

Worked examples

Example	Inputs
Stored XSS in checkout	Established program, High severity, core asset, proof of concept included.
Remote code execution at a bank	Top tier program, CVSS 10.0, core asset, proof of concept included.
IDOR in an internal tool	Mature program, Medium severity, secondary asset, no proof of concept.
Open redirect on a demo site	Starter program, Low severity, peripheral asset, no proof of concept.
Budget for a first private program	Starter preset, 20 percent platform fee, 15 percent reserve.
Budget for a public launch	Established preset, twice the expected findings in year one, 25 percent reserve.
Budget for a self-hosted mature program	Mature preset, no platform fee, 10 percent reserve.

Frequently asked questions

More free tools

Start testing in minutes

Connect your GitHub repos and domains, and get fully set up in a few clicks.

Start for free All free tools →