Resources

Article

Partnering with ethical hackers to keep our software secure

Article

Partnering with ethical hackers to keep our software secure

Article

Partnering with ethical hackers to keep our software secure

Security

Article

Partnering with ethical hackers to keep our software secure

Security

No matter how rigorous cybersecurity efforts are, bugs and vulnerabilities in software are inevitable. That’s why many organisations turn to bug bounty programs, inviting ethical hackers to test their applications for security weaknesses. By leveraging the expertise of hacker communities, organisations can uncover vulnerabilities that might otherwise go unnoticed until they are exploited.

→ Learn more about ethical hacking

The benefits of bug bounty programs

At Visma, our bug bounty program plays a key role in strengthening our overall cybersecurity. Whenever hackers discover a vulnerability, they report it directly to our developers, who assess and address the issue before it causes any harm – ultimately helping to protect our customers, employees, and organisation as a whole.

In return, the hackers earn a spot on Visma’s Hall of Fame. This serves as a quality stamp in the security community, and a recognition of ethical hackers’ expertise and contributions. Many choose to showcase this credential on their resume, LinkedIn profile, or in their portfolio, as it’s highly valued by recruiters and employers looking for top talent in security.

The vast complexity of the modern-day software makes it impossible to catch all bugs, regardless of how advanced the automated tests and checks may be. Nothing compares to having skilled people looking for security issues. Visma’s bug bounty program allows us to leverage the immense power of thousands of brilliant minds from all over the world. And the hackers have an incentive to continuously look for and report security issues in a responsible manner.
– Joona Hoikkala, Application Security Architect at Visma

All applications are built on code – the foundation of every software product. Modern programs, web services, cars, and even airplanes rely on thousands or even millions of lines of code to function. For example, the average iPhone app has fewer than 50,000 lines of code, while Google’s entire codebase contained around two billion lines as of 2017. The reality is that all software has bugs, and as a software company, it’s our responsibility to find and fix them as quickly as possible.

→ Discover how to fix security issues in code faster

Bug bounty in action: Nmbrs by Visma and their security-first mindset

When Dutch software company Nmbrs joined the Visma family earlier this year, their commitment to security was clear from the start. As part of their onboarding process, they introduced their Responsible Disclosure Policy – an initiative they’ve upheld for over three years. By inviting ethical hackers from around the world to test their platform, network, and products, Nmbrs ensures that security remains a top priority.

Floris Drost, Data Protection Officer at Nmbrs, is clear on the importance of this approach: “Hackers will be hackers. They’re going to hack you either way, so it would be stupid not to leverage their skills to improve your product. But you do need to facilitate them, which is why we have a Responsible Disclosure Policy.”

Through their bug bounty program, Nmbrs actively collaborates with ethical hackers to identify and resolve vulnerabilities before they can be exploited. This proactive mindset aligns with the broader Visma security philosophy and is shared by major tech companies like Apple, Google, Airbnb, PayPal, and Uber, all of whom have implemented similar policies.

→ Explore Visma’s Responsible Disclosure Policy for security researchers

Related content