Bug bounty vs penetration testing: which one should you do?

Short answer: bug bounty pays per valid finding and most participants earn nothing, because the easy issues in mature programs are already reported. Penetration testing pays a salary regardless of what you find. Bounties are a superb portfolio and a poor first income — do them alongside a job, not instead of one.

The two look similar from outside — someone attacks an application and reports flaws — and they are almost opposite as careers.

The structural difference

A penetration test is bought. A client pays for a defined period of expert attention over a defined scope. You are paid for the time whether you find a domain admin path or a well-configured environment with three medium findings. Coverage is the deliverable: the client needs to know what you looked at, not only what broke.

A bug bounty is a prize. A program invites the world to look, and pays only for valid, novel, in-scope findings. Nobody pays for your time, your duplicates, or the weekend you spent on an application that turned out to be solid.

That single difference cascades into everything: income predictability, what you learn, and how it looks on a CV.

What bug bounty hunters actually earn

The published numbers are dominated by a small number of full-time specialists, and they are not representative.

The realistic distribution: most registered participants never receive a payout. Of those who do, most earn a few hundred to a few thousand dollars a year — real money, rarely a living. A minority in the top few percent earn a professional income, and a very small group earn considerably more than they would in employment.

The reason is not difficulty exactly. It is competition and staleness: a mature program has been examined by thousands of people, so the reachable issues are gone. What remains requires either deep specialisation, novel technique, or being first on a newly launched asset. That is a real skill and it is not a beginner's income.

Three costs the headline figures omit:

• Duplicates. You find a genuine bug, someone reported it eleven hours earlier, you are paid nothing.
• Triage disputes. Arguing severity with a triager who has 200 open tickets, unpaid.
• Dry spells. Weeks with nothing. Salaried testers do not have those.

What each one teaches

This is where the comparison gets interesting, because the learning curves point in different directions.

	Bug bounty	Penetration testing
Income	Per valid finding, unpredictable	Salary or day rate
Teaches	Depth on one class of bug, creativity, persistence	Breadth, methodology, reporting, client work
Scope	Whatever the program lists	Whatever the engagement covers, including internal networks
Feedback	A triage verdict	Client debriefs, senior review, retests
CV value	Excellent proof of ability	Excellent proof of professionalism
Access to internal networks	Essentially never	Routinely

That last row matters more than people expect. Bounties are almost entirely external and web-facing. Internal engagements — Active Directory, lateral movement, segmentation, the work that decides whether a ransomware event spreads — barely exist in the bounty world, and they are half of what consultancies sell. Somebody who has only done bounties often has genuinely strong web skills and no exposure to Active Directory attacks or network pivoting.

Use bounties as a portfolio, not as a salary

The strategy that works for people entering the field:

1. Learn the methodology first. A structured pass over an application beats scattered curiosity. The free penetration testing course covers the full cycle, including the reporting that bounty triagers reward.
2. Pick one bug class and go deep. Access control at scale, or SSRF, or authentication chains. Generalists get duplicated; specialists find what the crowd walked past. Web Hacking and API Hacking are the two areas where depth still pays, because modern applications are mostly APIs now.
3. Choose fresh scope. New programs, newly added assets, recently acquired subsidiaries. Being early beats being clever.
4. Write reports as if a client were paying. Impact in business terms, clean reproduction, suggested fix. Triagers pay attention to the ones they can act on, and those reports become your portfolio.
5. Keep the day job until bounty income has been stable for a year. It almost never is.

Three or four accepted reports, well written, will get you interviews. That is their real value, and it is considerable.

Read the scope like a contract

A bug bounty program's scope statement is what makes your testing lawful. It is a conditional authorisation, and stepping outside it removes the safe harbour that protected you.

In practice that means: only listed assets, no denial of service unless explicitly permitted, no social engineering of staff, no testing of third-party infrastructure the program does not own, and stop at proof rather than extracting real user data. People have been prosecuted after a genuine finding because they went one step beyond demonstrating it.

If any of that is unclear, where to practise hacking legally sets out the line and what authorisation must contain.

Which should you choose?

Choose penetration testing if you want a career with a salary, mentorship, breadth, and internal network experience. It is the better foundation, and it stays available.

Choose bug bounty as a supplement — evenings and weekends — to build proof of ability, to specialise deeply, and because the feedback loop is honest in a way courses cannot be.

Choose bug bounty full time only after twelve months of consistent income, or with savings you are genuinely willing to lose. Some people thrive on it. They are visible precisely because they are unusual.

Frequently asked questions

How much do bug bounty hunters make?

Most registered participants earn nothing. Of those who do get paid, most make a few hundred to a few thousand dollars a year, and only a small minority earn a professional income. The published totals are dominated by a handful of full-time specialists and are not a useful forecast.

Is bug bounty a good way to start in cybersecurity?

As a portfolio, yes — three or four well-written accepted reports get you interviews. As a first income, no. Mature programs have already been examined by thousands of people, so what remains needs specialisation or novelty, neither of which a beginner has yet. Start with the free pentest methodology course.

What is the difference between bug bounty and penetration testing?

A penetration test is paid time over an agreed scope, where coverage is the deliverable and you are paid whether or not you find anything. A bug bounty pays only for valid, novel, in-scope findings, with no payment for time, duplicates or coverage.

Do bug bounties count as professional experience?

They count as demonstrated ability, which is not quite the same thing. Hiring managers value the reports as proof you can find and communicate real issues, but they will also probe internal network skills that bounties rarely teach — Active Directory, lateral movement, segmentation.

Is bug bounty hunting legal?

Inside the published scope, yes: the program grants conditional authorisation through a safe harbour statement. Outside it, no. Test only listed assets, avoid forbidden techniques, and stop at proving the finding rather than extracting data — going further removes the protection entirely.

Which bug class is worth specialising in?

Broken access control and business logic flaws, because scanners cannot find them and they persist in mature programs. Authentication chains and API-layer issues are close behind, since most modern applications are APIs with a thin front end, and coverage there is thinner than on classic web vulnerabilities. See the API hacking course.

Where to go next

Whichever route you take, methodology comes first: the free penetration testing course runs from scoping to the client report. Then pick a depth — Web Hacking or API Hacking — and read how to become a penetration tester for the longer career picture.