Crawl, Walk, Run: How Twilio Has Successfully Harnessed the Power of the Crowd for Years

Improving Product Security with the Crowd

Twilio, the cloud communications company out of San Francisco, CA, is an early adopter and innovator in the cybersecurity domain. Although they have consistently prioritized Product Security, they wanted to concentrate their efforts on the areas of greatest risk. To help augment their internal and external testing efforts, they turned to the crowd to start uncovering more vulnerabilities and learn from those findings.

Crawl, Walk, Run Approach

Not only have they leveraged the global crowd of independent security researchers through Bugcrowd for over two years, but they have utilized the model in a variety of ways and have benefited from their consistent engagement.

Working Closely With The Crowd

Through their private and public bug bounty program, they have strengthened their relationship with the researcher community and received steady contributions with many top researchers. This collaboration has been successful, as proof of the depth and breadth of their results and strong engagement across the researcher community.

This is one of the most important aspects of their bounty program, and their commitment to maintaining a healthy relationship with researchers has been noticed. At left are two top contributors on why they appreciate the Twilio program

Key Learnings

In addition to receiving high-quality results through their bug bounty program, Twilio has learned a lot from working with the security researcher community.

With Bugcrowd’s support, their bounty program has helped them meet their overall Product Security needs and goals:

• Crowdsourced testing has improved upon their existing Product Security initiatives, finding additional unknown and high-value vulnerabilities and an incredible return on investment.
• The additional layer of triage and validation provided by Bugcrowd has allowed them to increase their vulnerability finding capabilities while freeing up resources and allowing their security team to focus on other areas of the business.

Their success is indicative of their commitment to Product Security, and they will continue to evolve and maintain their bug bounty program.