Rent, Don't Build: Penetration Testing, Vulnerability Management, and Bug Bounty as a Service
The fifth part of the practical series “Vulnerability Management for Beginners” examines three service-based models that let organizations outsource key tasks instead of building everything in-house: pentest as a service, VM as a service, and bug bounty programs.
Pentest as a Service
Penetration testing simulates an attacker’s attempt to find weaknesses that allow unauthorized actions. Most external pentests follow a black-box approach where testers receive no credentials and must discover entry points the way a real adversary would. Automated scanners rapidly check thousands of hosts for known vulnerabilities, open ports, and version fingerprints, while human teams with certifications such as OSCP combine findings into multi-step attack chains that tools rarely detect.
Automated pentest-as-a-service offerings let companies quickly scan internet-facing assets without deploying their own infrastructure. Customers simply provide IP ranges or domains and prove ownership through domain-registration certificates or signed authorization letters. The provider’s scanners run from external servers and deliver structured reports or API data that can be imported into internal vulnerability-management systems. Limitations include reduced configuration flexibility and the inherent sensitivity of vulnerability data, which must be protected as confidential information.
Market figures show strong growth: the global pentest-as-a-service market reached approximately $1.6 billion in 2024 and continues to expand at roughly 20 percent annually. In Russia the segment also grew by tens of percent in 2025, with several large vendors dominating corporate projects. Tools such as the Russian PT Dephaze platform now provide controlled automated testing that mimics attacker behavior safely.
VM as a Service
Vulnerability Management as a Service extends beyond black-box perimeter scanning by deploying agents or establishing tunnels that allow authenticated, white-box scans of internal assets. This approach produces far more accurate inventories of installed software versions and reduces both missed vulnerabilities and false positives. Results are delivered as reports or API feeds, yet organizations must still maintain internal processes with IT teams to remediate findings within agreed SLAs.
Service customers can define asset criticality, set remediation deadlines, and integrate outputs with patch-management platforms such as Microsoft SCCM or its Russian equivalents. Benefits include rapid deployment, continuous scanner updates handled by the provider, and access to benchmarking data that compares an organization’s remediation speed against industry peers. Risks involve potential data leakage and the need to treat tunnels to internal agents as part of the attack surface.
Prioritization can leverage modern metrics including the fourth version of EPSS, the CISA KEV catalog that now exceeds 1,500 actively exploited vulnerabilities, and the updated FSTEC methodology released on 30 June 2025, which combines CVSS 3.1 base scores with exploit availability and consequence categories.
Bug Bounty Programs
Bug bounty programs invite independent security researchers to examine defined assets in exchange for monetary rewards. Platforms such as HackerOne, Bugcrowd, and Synack manage researcher onboarding, triage, and payments, while Russian platforms Standoff Bug Bounty and BI.ZONE Bug Bounty have become major local players.
In 2025 the two leading Russian platforms received nearly 14,000 vulnerability reports and paid out approximately 260 million rubles. Standoff Bug Bounty alone grew its active programs 2.2 times to 233, registered over 32,000 researchers, and recorded a maximum single payout exceeding 4.9 million rubles. BI.ZONE increased payouts by 50 percent to reach 100 million rubles. Government bodies, including the Ministry of Digital Development, have launched multiple rounds of programs covering systems such as Gosuslugi, while regional administrations and major companies including Sberbank have followed suit.
Successful programs begin in private mode with moderate rewards, clearly defined scope, and established triage workflows. Researchers are incentivized to discover high-impact issues that automated scanners miss, creating a realistic simulation of diverse attacker perspectives. Global payouts underscore the model’s maturity: HackerOne alone distributed about $81 million to researchers between mid-2024 and mid-2025, while Google awarded a record $17 million in 2025.
Related articles
Enodia: Open-Source Go Tool Automates Service Inventory, EOL Tracking and CVE Correlation
A DevOps engineer has released enodia, a single-binary Go CLI that discovers real versions of services across large heterogeneous environments and correlates them with end-of-life calendars and vulnerability databases. The tool was built after manual Ansible-based inventories and existing solutions such as endoflife.date, nvchecker, Renovate and Uptime Kuma proved insufficient for covering both infrastructure and application services while also providing actionable lifecycle, patch and branch status. Enodia uses product-specific probes for 123 technologies including PostgreSQL, MySQL, MariaDB, Jira, Confluence, Bitbucket, VMware vCenter, ESXi, pfSense and multiple Linux distributions, falling back to a generic URL-plus-regex probe when needed. Data collection is deliberately separated from evaluation so that inventory.jsonl files can be generated inside air-gapped networks and later analysed where CVE feeds are available. The project also contributed dozens of missing products and corrected EOL dates to the endoflife.date project and integrates both NVD and Russia’s FSTEC BDU vulnerability databases. Special handling was added for MySQL/MariaDB connection-error counters, version-string masquerading, and vendor-specific update nomenclature to avoid false reports.
Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that enables remote code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and the flaw was present in versions 8.6.2 through 12.10.3 released between March 2022 and September 2026. Telegram addressed the issue in version 12.10.4, released at the end of September 2026. The root cause lies in improper handling of the MediaState message exchanged during calls, specifically when processing rotation values and missing video state fields, leading to out-of-bounds memory reads. The same underlying fix was deployed earlier to shared call libraries, iOS, and desktop clients, but reached Android later. Researchers confirmed the impact only on private calls running on ARM64 Android devices, with no evidence of exploitation in the wild or public CVE assignment as of October 29, 2026.
360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform to Government and Enterprise Users
360 Security Cloud has launched a dedicated self-assessment platform that allows organizations to scan their PHP-based websites and systems for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small-to-medium businesses. Users can apply by scanning a provided QR code to determine how many of their assets run PHP, identify affected versions, and check whether any systems have already been compromised. The platform addresses key questions about exposure: the number of PHP-powered sites and systems, the presence of vulnerable versions, and signs of prior intrusion. The announcement emphasizes that the tool helps organizations proactively assess risk without requiring external assistance. The original Chinese report was published on October 30, 2026, and the service is positioned as a practical response to ongoing PHP-related security concerns.
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.