How much you earn in bug bounty (real figures 2026)

Quick answer: In bug bounty there's no salary: you get paid per valid flaw. Rewards range from €0 (VDP programs with no payout) to five or six figures for a critical at a large company. An average high-severity reward is around $1,000–5,000; a critical, several thousand and up to tens of thousands. But the reality is harsh: most beginners take months to earn their first bug and very few live off this alone.

The wrong question: "how much do you earn?"

In bug bounty there's no salary. You don't get paid by the hour or for being online: you get paid only if you find a valid, non-duplicate flaw and report it well. That means two hunters with the same hours can earn €0 and €20,000 in the same month.

That's why the right question isn't "how much do you earn", but "how much does each flaw type pay and how many can I find". Let's get to the numbers.

Average rewards by severity

Rewards are assigned by severity (usually aligned with CVSS or Bugcrowd's VRT). These are rough ranges you'll see repeated in the public tables of the most active programs (HackerOne, Bugcrowd, Intigriti, 2023–2025). They vary enormously by company:

Two important nuances:

• The same vulnerability pays differently depending on where it is. An SSRF in a boring internal endpoint is worth little; the same SSRF that reaches the cloud credentials (AWS metadata) jumps to critical.
• Big tech inflates the ceilings. Programs like those of Google, Apple, Microsoft or crypto can pay $50,000, $100,000 or more for flaws that touch money or mass data. They're the exception, not the average.

Average rewards by vulnerability type

Broadly speaking, what pays most is what comes closest to money, personal data or code execution:

You have the technical explanation of each one in the vulnerability dictionary. If you want to maximize income, specialize in the families at the top (access control, business logic, SSRF), not the ones at the bottom.

How much do top hunters earn?

This is where the headline figures appear. According to the platforms' annual reports (HackerOne, Bugcrowd, 2019–2024):

• In 2019, HackerOne announced its first hunter to surpass $1,000,000 in cumulative earnings. Since then, dozens of hunters have crossed the million in cumulative earnings, and a handful exceed $2–4 million.
• Live Hacking Events routinely hand out hundreds of thousands of dollars in a single weekend among the invited participants.
• The best full-time hunters can earn six figures a year, comparable to or higher than a good security engineering salary.

But careful: those figures are cumulative (over years) and belong to the top 1%. They're the equivalent of looking at the income of the biggest YouTubers to decide whether "you can make money" uploading videos.

The reality for beginners (the honest part)

This is the section almost no one tells you:

• A large share of those who sign up never earn a single bounty. The platforms' reports show that the bulk of rewards is concentrated in a minority of very active hunters.
• Your realistic first payout comes after months of study and practice, not in the first week.
• Duplicates hurt. You'll find flaws that someone else already reported. You don't get paid, even if your work was correct.
• Income is irregular. One month you make $3,000 and the next two you make $0. It's variable income, not a paycheck.

This isn't to discourage you: it's so you go in with the right expectations. Whoever starts thinking "I'm going to quit my job in three months" quits after six weeks, frustrated. Whoever starts thinking "I'm going to learn to find a real flaw" ends up getting paid.

How to increase what you earn

The difference between earning €0 and earning for real is almost never "knowing more exploits". It's usually this:

1. Pick the right program. Broad scope + little veteran competition > famous program saturated with duplicates.
2. Master a few families deeply. Better to be very good at access control and business logic than mediocre at everything.
3. Report like a professional. Clear impact, reproducible PoC, well-argued severity. An excellent report raises the reward for the same flaw.
4. Chain flaws. A "medium" IDOR + an info disclosure can turn into a critical Account Takeover.
5. Practice with real cases. In the BBLABS labs you reproduce flaws taken from real reports: you learn to recognize the pattern that pays before spending hours on a live program.

If you're coming from scratch, the sensible path is ordered theory in Learn bug bounty and then labs in difficulty order. Money is the consequence, not the goal of the first month.

Frequently asked questions (FAQ)

Can you make a living from bug bounty?
Yes, but it's a minority. A small percentage of hunters turn it into their main income; many use it as a supplement to a salary. Treat it first as profitable learning, not as an immediate replacement for your job.

How long does it take to earn your first bug?
For someone starting from scratch, the realistic answer is several months of consistent practice. Someone who already has a development or pentest background can shorten it considerably.

How much does an XSS pay?
It depends on the type and context. A reflected XSS is usually low-to-medium severity (hundreds of euros); a stored XSS in a sensitive panel can be high. Context matters more than the label.

Do they pay in euros or dollars?
US platforms pay in dollars; European ones (Intigriti, YesWeHack) usually operate in euros. Remember to declare your income: bug bounty is income and it's taxable.

Is it better to have quantity of reports or quality?
Quality. A well-reported critical is worth more than twenty informationals. Plus, the reputation you earn with good reports opens up better-paid private programs.

Conclusion

In bug bounty you can earn anywhere from €0 to life-changing figures, but the real median for someone starting out is far more modest than the headlines suggest. Rewards favor impact (access control, logic, RCE, SSRF) and good reports, not hours online. Go in with the right expectations, specialize in what pays and train with real flaws: money is the consequence of learning to recognize the pattern, and that can be trained.