From bug bounty to vulnerability research

Bug bounty selects for a particular kind of skill. You're parachuted into a target you've never seen, given a wide scope, and rewarded for being faster than the next hunter. The economic loop is brutally simple: time-to-first-bug is the only metric that matters for your hourly rate, and the platforms shape the work to optimise for it.

Vulnerability research selects for the opposite. You pick a target, often something the platforms wouldn't even host, and you sit with it. Weeks. Months. Sometimes a year. The aim is to develop a model of the target deeper than what any individual developer holds in their head, and to find the bug that nobody else is going to find because nobody else has paid that price.

Both are real jobs. Both pay (eventually). The shift between them is bigger than people expect, and a lot of the surprise is on the operational side rather than the technical side.

The workflow shift, in one sentence

Bug bounty is breadth at speed. Vulnerability research is depth over time.

That sounds like a slogan and is also genuinely the heart of it. The followups all flow from there.

The bounty loop is short and self-priming. You ship value (a report) every few days, and each report restarts the cycle on a new target. The VR loop is long and self-doubting. You ship value (a vulnerability, an exploit, a paper, a fixed product) every few months, and you spend the long stretches in between not knowing whether the next thing will pay off.

If you have a personality that needs frequent positive reinforcement, the bounty loop suits you. If you can sit in confusion for weeks because you trust that confusion is what learning looks like, VR suits you. Neither personality is better. Both fields need both kinds of people, but inside their own sub-niches.

Skills that diverge

The toolchains overlap surprisingly little once you're past the basics. A bounty hunter has Burp, a wordlist collection, a few favourite recon scripts, and an instinct for which endpoints look interesting. A VR person has IDA or Ghidra, a fuzzer (or three), a debugger they've configured to within an inch of its life, and a Git history of patches they've read line by line.

The recon skill that makes bounty hunters effective (finding subdomains, identifying tech stacks, spotting endpoints that the developer forgot to gate) has a faint echo in VR. You still need to know your target's surface. The difference is granularity. A bounty hunter cares about endpoints. A VR researcher cares about which compiler flag enabled which optimisation in which build, because the bug they're chasing might exist only in builds compiled before a particular date.

Scripting carries over. If you've automated your own bounty workflow you've already got the engineering muscle. The substance changes: you're now writing fuzzer harnesses, IDA scripts, custom triagers, sometimes small kernel modules. The skill underneath ("automate the boring bit") is the same.

What doesn't transfer is comfort with low-level mechanics. Reading assembly. Modelling the heap. Understanding what a particular kernel object's reference-counting policy means for use-after-free reachability. None of this comes from a year of bounty work. All of it has to be acquired separately, and the acquisition is non-trivial. Plan a year of part-time study before you'll feel competent on a meaningfully complex target.

The role of fuzzing

In bug bounty, fuzzing exists at the edges. Some hunters use it for parameter fuzzing or content discovery; very few of them write harnesses for native code in the targets they hunt.

In VR, fuzzing is closer to the centre. Most modern memory-corruption discoveries come out of a fuzzer with a well-designed harness, often with significant per-target tuning. Knowing how to write a libFuzzer harness for a specific parsing function, set up persistent mode for a daemon, or run AFL++ on a kernel subsystem with snapshot-based fuzzing is the day-to-day craft.

Honest version: fuzzing is mostly preparation. Setting up the harness correctly is 90% of the work, and the actual run is overnight. The skill is in choosing what to fuzz, instrumenting it well enough that crashes are reachable, and triaging the output without drowning in duplicates. None of that is glamorous, and all of it is what separates productive VR from people who run AFL on a target and walk away.

The economic shift

Bounty income is per-bug. The distribution is heavy-tailed: most hunters make modest sums and a small minority make a great deal. You can scale by being faster, by having a deeper target inventory, or by getting the first crack at newly-published programs.

VR income is mostly salaried. Industry researchers (Project Zero, Trail of Bits, Trellix's old labs, various government-adjacent shops) get paid regular salaries to do the work. The pay is good, the security is good, and the upside is capped — you're not getting rich on a single discovery the way an exceptional bounty hunter occasionally does.

The non-salaried VR income streams exist but are narrower. Brokers buy specific exploit categories. ZDI pays for vulnerabilities in their target list. Pwn2Own offers specific targets and substantial sums. None of these are a steady living for most people, and the brokerage market in particular has ethics questions that most people end up wanting an opinion on.

The honest summary is that VR pays well if you're willing to take a salary. It pays unevenly and rarely if you're going freelance. Most successful researchers I know are salaried, with the occasional extra from Pwn2Own or a bounty on a specific high-value bug.

Where the two worlds overlap

This is the bit nobody talks about, and it's the most interesting bit. The overlap is genuine and growing.

Web bugs in native code. Server-side WebAssembly. Native protocol parsers in HTTP/3 stacks. Authentication middleware written in Rust or C++. The web is increasingly a thin shell over native components, and bugs that look like web bugs (SSRF, parser confusion, header smuggling) are increasingly memory-safety bugs underneath. A bounty hunter who can recognise these and dig in below the HTTP layer has a niche almost nobody else can fill.

Server-side memory corruption. Languages that are nominally memory-safe (Rust with unsafe, Go's cgo boundary, JavaScript engines) leak corruption opportunities at the seams. Researchers who can move between web-style probing and native-style exploitation can find bugs that pure web specialists miss and pure VR specialists never look at.

Mobile app surfaces. Mobile pentesting blends web bugs (the API the app talks to), native bugs (the binary itself), and OS bugs (interaction with the underlying iOS or Android stack). The career path between mobile bug bounty and mobile VR is short and well-trodden.

IoT. A field-deployed device usually has a web interface (bounty territory) and a native firmware (VR territory). Researchers who can move between layers find bugs that single-layer researchers can't.

If you're a bounty hunter wondering where the natural on-ramp into VR sits, mobile and IoT are the two places where your existing skill counts for something rather than needing to be abandoned. The transition is much easier from those starting points.

A note on patience

The single biggest difference between hunters who make this transition successfully and those who don't is patience. Bug bounty, even at its slowest, gives you positive feedback every couple of days. VR can give you nothing for three months and then a beautiful bug in week thirteen. The bounty hunters who quit VR usually quit somewhere around week six, just before the inflection point would have arrived.

If you can sit with that, this is one of the most rewarding fields in security. If you can't, stay in bounty work. There's no shame in either.

Where this fits in

The VR Foundations track is the path I'd send a bounty hunter down if they asked me where to start. It covers the toolchain (debuggers, disassemblers, fuzzers), the workflow (target selection, harness design, triage), and the technical depth (memory model, calling conventions, exploitation primitives) that the field assumes you have. Treat it as the apprenticeship; the bug-bounty mindset comes along for free.