I'm quoted in the article. I was not paid for it. I am a practitioner, and I believe what I am saying. Which, to reiterate succinctly, is:

- Bug bounties are a waste of time and money for most startups, because you will drown in nonsense scanner findings.

- There is a straightforward explanation in which HackerOne benefits from that dynamic, and their business model incentivizes them to make that dynamic worse, not better.

I would be happy to debate those points, but frankly they don't seem that controversial.

While I am not speaking for Latacora in the article, I obviously make money when Latacora does, so your claim warrants analysis. Latacora's business model is long term proxies for an initial security hire. It does not include "triage consulting" as a revenue line item. We do not do one-off 2x2 pentests. There is relatively little overlap between our clientele (startups considering their first security hire) and the companies spending a lot of money on bug bounties. Most of our clients do not, and generally should not, host bug bounties. For clients that do, we operate the program, but do not bill separately for that service. Therefore Latacora's financial incentive would clearly be to have H1 run the program with triage, because it straightforwardly removes a cost. Our business incentives are aligned with security outcomes, because we stick around long enough for the impact of our choices. I think bug bounties are fine for a subset of customers. Given the size of our consultancy and our customer base and the somewhat obvious fact we're resource constrained in scaling, it's fairly clear I have no financial stake in this: people do not buy more Latacora because they bought less HackerOne. I can't speak for HackerOne, but I can't imagine they think we're a competing service, not do we think the converse.

COVID-19 has impacted a lot of consultancies. It has also made stock markets overall drop 30%, so the suggestion that this article is some kind of consultancy cabal master plan to screw over bug bounty programs specifically I think requires a more evidence to be credible. As Thomas has pointed out: the idea that this is some kind of PR campaign does not pass the sniff test. Our headcount is a baker's dozen. We do not employ a PR firm. You're probably right that, say, NCC does, perhaps NCC considers themselves a proxy good for H1, but no NCC representative is quoted in the article.

Moussouris is a former executive and current shareholder of HackerOne. It's true that she is still in the bug bounty business! But if you look at how their business is structured, it emphasizes fewer, larger corps and governments and longer-term engagements with a strong compliance and legal focus. Whatever upside she gets from bug bounties being painted in a positive light but HackerOne in a negative one (stipulating this article does that, which I think is questionable), does not weigh up to the clear likely financial incentive she does have where HackerOne does extraordinarily well, IPOs, and her shares turn liquid and she gets a big payday. Do you have evidence that is not the case?

I don't really see how the legal experts in the article taking the position that e.g. these bug bounty companies regularly violate AB-5 unless they mean it. Perhaps they are getting paid, but that's a pretty serious allegation I haven't seen any evidence for. And, if they're just in it for the money, wouldn't it be much easier for them to take it from the allegedly-violating side and argue _their_ case? The contractor-turned-employee side isn't exactly where the money is, and I can't imagine whatever the going rate for a quote is is the most effective way for a lawyer to make money. (Regardless, I am not a legal expert, and AB-5 violations are not part of my argument--the extent of my argument is that "this is a paid hit piece" seems unlikely for them.)