Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service
The fifth part of the practical series “Vulnerability Management for Beginners” examines three service-based models that let organizations outsource key tasks instead of building everything in-house: pentest as a service, VM as a service, and bug bounty programs.
Pentest as a Service
Penetration testing simulates an attacker’s attempt to find weaknesses that allow unauthorized actions. Most external pentests follow a black-box approach where testers receive no credentials and must discover entry points the way a real adversary would. Automated scanners rapidly check thousands of hosts for known vulnerabilities, open ports, and version fingerprints, while human teams with certifications such as OSCP combine findings into multi-step attack chains that tools rarely detect.
Automated pentest-as-a-service offerings let companies quickly scan internet-facing assets without deploying their own infrastructure. Customers simply provide IP ranges or domains and prove ownership through domain-registration certificates or signed authorization letters. The provider’s scanners run from external servers and deliver structured reports or API data that can be imported into internal vulnerability-management systems. Limitations include reduced configuration flexibility and the inherent sensitivity of vulnerability data, which must be protected as confidential information.
Market figures show strong growth: the global pentest-as-a-service market reached approximately $1.6 billion in 2024 and continues to expand at roughly 20 percent annually. In Russia the segment also grew by tens of percent in 2025, with several large vendors dominating corporate projects. Tools such as the Russian PT Dephaze platform now provide controlled automated testing that mimics attacker behavior safely.
VM as a Service
Vulnerability Management as a Service extends beyond black-box perimeter scanning by deploying agents or establishing tunnels that allow authenticated, white-box scans of internal assets. This approach produces far more accurate inventories of installed software versions and reduces both missed vulnerabilities and false positives. Results are delivered as reports or API feeds, yet organizations must still maintain internal processes with IT teams to remediate findings within agreed SLAs.
Service customers can define asset criticality, set remediation deadlines, and integrate outputs with patch-management platforms such as Microsoft SCCM or its Russian equivalents. Benefits include rapid deployment, continuous scanner updates handled by the provider, and access to benchmarking data that compares an organization’s remediation speed against industry peers. Risks involve potential data leakage and the need to treat tunnels to internal agents as part of the attack surface.
Prioritization can leverage modern metrics including the fourth version of EPSS, the CISA KEV catalog that now exceeds 1,500 actively exploited vulnerabilities, and the updated FSTEC methodology released on 30 June 2025, which combines CVSS 3.1 base scores with exploit availability and consequence categories.
Bug Bounty Programs
Bug bounty programs invite independent security researchers to examine defined assets in exchange for monetary rewards. Platforms such as HackerOne, Bugcrowd, and Synack manage researcher onboarding, triage, and payments, while Russian platforms Standoff Bug Bounty and BI.ZONE Bug Bounty have become major local players.
In 2025 the two leading Russian platforms received nearly 14,000 vulnerability reports and paid out approximately 260 million rubles. Standoff Bug Bounty alone grew its active programs 2.2 times to 233, registered over 32,000 researchers, and recorded a maximum single payout exceeding 4.9 million rubles. BI.ZONE increased payouts by 50 percent to reach 100 million rubles. Government bodies, including the Ministry of Digital Development, have launched multiple rounds of programs covering systems such as Gosuslugi, while regional administrations and major companies including Sberbank have followed suit.
Successful programs begin in private mode with moderate rewards, clearly defined scope, and established triage workflows. Researchers are incentivized to discover high-impact issues that automated scanners miss, creating a realistic simulation of diverse attacker perspectives. Global payouts underscore the model’s maturity: HackerOne alone distributed about $81 million to researchers between mid-2024 and mid-2025, while Google awarded a record $17 million in 2025.
Related articles
Positive Technologies Develops Dynamic Crawler for Single-Page Applications in PT BlackBox Scanner
Positive Technologies engineers have detailed the development of a dynamic crawler for their PT BlackBox DAST scanner to handle modern single-page applications built with frameworks such as React and Vue. The crawler must discover attack surface elements that only appear after user interactions because static parsing of initial DOM fails on SPAs where navigation occurs without URL changes. Key challenges include identifying interactive elements whose handlers are attached via JavaScript, detecting state changes after clicks or inputs, and managing combinatorial explosion of states caused by independent UI toggles. The team models the application as a labeled transition system and defines state equivalence using sets of 64-bit fingerprints of interactive elements rather than raw HTML similarity or URL values. This equivalence relation satisfies reflexivity, determinism from external observations, cheap hash-based comparison, slower growth than action count, and preservation of enabled actions across equivalent states. The approach allows the crawler to visit representatives of equivalence classes instead of every reachable state, keeping scans finite and practical within action budgets of several thousand interactions.
Over 8,300 Gitea Servers Remain Exposed to Remote Code Execution via CVE-2026-60004
Thousands of publicly accessible Gitea instances were still unpatched against CVE-2026-60004 as of late August 2026, leaving them open to remote command execution. The critical vulnerability combines abuse of the diffpatch endpoint with the ability to install and trigger attacker-controlled Git hooks, allowing unauthenticated attackers to run commands on the server. Exploitation requires only write access to a repository, which is often trivial due to default open user registration in many deployments. The issue was fixed in Gitea 1.27.1 released on July 27, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 28 for U.S. federal agencies. In observed incidents, attackers used the access to deploy cryptocurrency miners inside Docker containers. A related authentication bypass affecting the official Docker image, CVE-2026-20896, was also noted when reverse-proxy headers such as X-WEBAUTH-USER are enabled.
Microsoft Defender Displays False 'Enable Virus Protection' Alerts on Windows Despite Active Real-Time Protection
Microsoft has confirmed a bug in Microsoft Defender that causes Windows to show persistent notifications urging users to enable virus protection even when the antivirus is already running with real-time protection active. The issue emerged after recent Defender updates and affects home users as well as enterprise environments running Windows 11 versions 23H2, 24H2, and 25H2, along with Windows 10 and Windows Server editions. Notifications appear at startup or during normal operation, ignore Do Not Disturb settings, and clicking them only opens the Windows Security app without resolving the alert. Microsoft is developing a fix to be released in a future Defender update but has not provided a timeline. Users are advised not to dismiss all such banners automatically, as similar messages could originate from malware, and should verify protection status through Windows Security or PowerShell commands. The problem stems from configuration errors introduced by the antivirus updates rather than specific Windows builds.
Weekly Roundup: Next.js Leads Critical Vulnerability Reports as Chrome, Tomcat, and PostgreSQL See Major Patches
Security NEXT has published its list of the ten most-read articles for the week of August 23-29, 2026. The top story covered multiple serious vulnerabilities in Next.js that prompted an accelerated release schedule. Other high-interest items included a critical flaw in Zscaler Client Connector, several issues in Apache Tomcat rated critical, and Google’s Chrome 152 update fixing 327 vulnerabilities. Additional reports highlighted a ransomware incident at a systems development firm, flaws in SKYSEA Client View, 28 vulnerabilities fixed in PostgreSQL, and confirmed exploitation of six known flaws in SQL Server and NetScaler. The list also featured a vulnerability in the Android version of the Digital Agency’s My Number Point app and warnings about active exploitation of a WebLogic module flaw.