Empirical evidence that connects firm investment in cybersecurity defenses to the likelihood of being attacked has been very hard to come by. The Israel National Cyber Directorate (INCD) and the Israeli Central Bureau of Statistics (CBS) recently surveyed Israeli firms about their ICT operations...

In this paper, we first provide background on the "nuts and bolts" of a bug bounty platform a two-sided marketplace that connects firms and individual security researchers ("ethical" hackers) to find and be rewarded for discovering software vulnerabilities. We then empirically examine the effect...