Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service
The fifth part of the practical series “Vulnerability Management for Beginners” examines three service-based models that let organizations outsource key tasks instead of building everything in-house: pentest as a service, VM as a service, and bug bounty programs.
Pentest as a Service
Penetration testing simulates an attacker’s attempt to find weaknesses that allow unauthorized actions. Most external pentests follow a black-box approach where testers receive no credentials and must discover entry points the way a real adversary would. Automated scanners rapidly check thousands of hosts for known vulnerabilities, open ports, and version fingerprints, while human teams with certifications such as OSCP combine findings into multi-step attack chains that tools rarely detect.
Automated pentest-as-a-service offerings let companies quickly scan internet-facing assets without deploying their own infrastructure. Customers simply provide IP ranges or domains and prove ownership through domain-registration certificates or signed authorization letters. The provider’s scanners run from external servers and deliver structured reports or API data that can be imported into internal vulnerability-management systems. Limitations include reduced configuration flexibility and the inherent sensitivity of vulnerability data, which must be protected as confidential information.
Market figures show strong growth: the global pentest-as-a-service market reached approximately $1.6 billion in 2024 and continues to expand at roughly 20 percent annually. In Russia the segment also grew by tens of percent in 2025, with several large vendors dominating corporate projects. Tools such as the Russian PT Dephaze platform now provide controlled automated testing that mimics attacker behavior safely.
VM as a Service
Vulnerability Management as a Service extends beyond black-box perimeter scanning by deploying agents or establishing tunnels that allow authenticated, white-box scans of internal assets. This approach produces far more accurate inventories of installed software versions and reduces both missed vulnerabilities and false positives. Results are delivered as reports or API feeds, yet organizations must still maintain internal processes with IT teams to remediate findings within agreed SLAs.
Service customers can define asset criticality, set remediation deadlines, and integrate outputs with patch-management platforms such as Microsoft SCCM or its Russian equivalents. Benefits include rapid deployment, continuous scanner updates handled by the provider, and access to benchmarking data that compares an organization’s remediation speed against industry peers. Risks involve potential data leakage and the need to treat tunnels to internal agents as part of the attack surface.
Prioritization can leverage modern metrics including the fourth version of EPSS, the CISA KEV catalog that now exceeds 1,500 actively exploited vulnerabilities, and the updated FSTEC methodology released on 30 June 2025, which combines CVSS 3.1 base scores with exploit availability and consequence categories.
Bug Bounty Programs
Bug bounty programs invite independent security researchers to examine defined assets in exchange for monetary rewards. Platforms such as HackerOne, Bugcrowd, and Synack manage researcher onboarding, triage, and payments, while Russian platforms Standoff Bug Bounty and BI.ZONE Bug Bounty have become major local players.
In 2025 the two leading Russian platforms received nearly 14,000 vulnerability reports and paid out approximately 260 million rubles. Standoff Bug Bounty alone grew its active programs 2.2 times to 233, registered over 32,000 researchers, and recorded a maximum single payout exceeding 4.9 million rubles. BI.ZONE increased payouts by 50 percent to reach 100 million rubles. Government bodies, including the Ministry of Digital Development, have launched multiple rounds of programs covering systems such as Gosuslugi, while regional administrations and major companies including Sberbank have followed suit.
Successful programs begin in private mode with moderate rewards, clearly defined scope, and established triage workflows. Researchers are incentivized to discover high-impact issues that automated scanners miss, creating a realistic simulation of diverse attacker perspectives. Global payouts underscore the model’s maturity: HackerOne alone distributed about $81 million to researchers between mid-2024 and mid-2025, while Google awarded a record $17 million in 2025.
Related articles
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.
5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected
A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.
AI System iFinder Uncovers 84 Zero-Day Vulnerabilities in 4G and 5G Networks, 23 CVEs Still Unpatched
Researchers from Nanyang Technological University deployed the AI-driven system iFinder against software managing 4G and 5G networks, discovering 84 previously unknown vulnerabilities. Developers confirmed 83 of the findings, with 81 receiving CVE identifiers. Only 58 issues have been patched so far, leaving 23 confirmed vulnerabilities with CVE numbers awaiting fixes. The most severe flaw enables session hijacking by injecting a network rule that reuses an existing identifier but carries a higher priority, bypassing uniqueness checks and redirecting subscriber traffic to the attacker. The attack was fully reproduced on OpenAirInterface and validated in two commercial 5G networks, with one vendor releasing a patch for CVE-2026-8233. iFinder operates through three coordinated AI agents that identify unvalidated inputs, cross-reference 3GPP standards, and iteratively develop working exploits, though manual verification remains necessary due to false positives. Open5GS, SD-Core, and free5GC have begun remediation, while three of seven tested projects have issued no patches.
Researchers Expose GPON Optical Network Eavesdropping via Modified ONU Devices at DEF CON
At DEF CON 34, two researchers demonstrated how inexpensive hardware modifications allow interception of downstream traffic in GPON fiber networks shared among multiple subscribers. The passive optical design means all clients connected to the same splitter receive identical data streams, with separation handled only at the ONU level through 12-bit GEM port identifiers. By acquiring Realtek RTL960x-based SFP modules and systematically bypassing built-in restrictions on GEM port reassignment, VLAN tagging, switch forwarding, and checksum validation, the team achieved access to traffic intended for up to 128 neighboring users. Exposed data includes DNS queries that can reveal occupancy patterns, unencrypted SIP voice traffic, and in some cases traffic from nearby cellular base stations. The researchers also identified exploitable vulnerabilities in the VSOL G100S OLT device that could grant root-level control and compromise provider routers. Additional coverage in the same Kaspersky report examined Head Mare's compromise of TrueConf servers, EvilFontTool font-based evasion, an OpenAI presentation on an accidental AI attack against Hugging Face, and the SCTPhantom Linux kernel flaw present for 18 years.