Proactive cyber security measures
In addition to being a bug bounty platform with a unique incentive model, Defend Iceland will be the centre of public security knowledge and awareness. Its aim is to change cyber security culture by bringing information about security vulnerabilities to the surface and serving as a training platform for companies, software engineers, and the public.
What is a bug bounty platform?
A bug bounty platform is a service that connects organizations with ethical hackers to identify and fix security vulnerabilities in their systems. Organizations create programs offering rewards for discovering and reporting specific types of bugs, such as vulnerabilities in software, websites, or applications. Ethical hackers participate by testing the systems within the agreed-upon scope, providing detailed reports of their findings. The platform facilitates secure communication, manages submissions, and ensures payments are made to defenders who contribute valuable discoveries. This model helps organizations enhance their cyber security posture cost-effectively by leveraging a network of experts.
Defend Iceland is a unique, nationwide bug bounty platform that aims to accelerate bug bounty uptake for SMEs and governmental institutions in Iceland by providing an innovative bug bounty platform that eliminates common barriers that have so far prevented rapid uptake of such solutions.
Over 95% of the security vulnerabilities that our ethical hackers identify were previously unknown. This percentage can be attributed to the fact that ethical hackers working for Defend Iceland simulate real-world attacks and discover new vulnerabilities in the custom-built software infrastructures used by our customers. Traditional scanning tools rely on known vulnerabilities (opnast í nýjum glugga), which indicates that, according to Defend Iceland’s statistics, it is more likely for unknown vulnerabilities to exist than known ones within Defend Iceland’s client base.
Defend Iceland’s bug bounty platform is a proactive cyber security initiative that leverages the expertise and skills of ethical hackers for the benefit of our society. This crowdsourced approach harnesses collective efforts to identify and address security vulnerabilities in companies’ systems before they lead to serious breaches, ransomware incidents, or data leaks.
Defend Iceland’s vision is for all companies and organizations in Iceland to have access to the bug bounty platform. This way, we strengthen the security of Iceland's digital infrastructure and enhance the resilience of society.
How does the triage process work?
Report draft: The Defender completes and submits the vulnerability report.
Review (Not started): The Triage team runs an initial screening. Reports that meet the triage standard move to In review; those that don't are returned to the Defender with comments.
In review: The Triage team reproduces and verifies the vulnerability and writes a detailed report. A confirmed vulnerability is approved; others are rejected, or marked as a duplicate if the same issue was already reported by another Defender.
Waiting for confirmation: The customer reviews the full report and sets the bounty they wish to pay. They may also reject the report at this stage.
Waiting for acknowledgment: The Defender selects a payment method and can optionally donate part of their bounty to the community fund.
Waiting for payment: The bounty is paid out. This step can take up to three business days.
Finished: The triage process is complete.
Good to know
- Defenders and customers can message the Triage team directly at steps 02–06 and Finished (marked with a chat icon).
- A typical case takes one to five business days. Complex vulnerabilities (hard to prove, missing data, and so on) can take longer.
Want to report a vulnerability?
We encourage everyone to report any security vulnerabilities they find in software systems of companies, institutions, and organizations throughout the community.
Discovery
Did you find a vulnerability in a software system? Join the ethical hackers at Defend Iceland and contribute to the fight against cybercrime.
Experience and Knowledge
Your knowledge and skills can play an important role in strengthening Iceland's cyber security.