Ethical hackers, bug bounties, and the future of India’s startup security

Anand Prakash, an ex-security engineer at Flipkart and ethical hacker, has developed a platform that connects companies with technology experts to find loopholes and weaknesses in their systems’ security.

While Prakash worked for Flipkart, his job was technically hacking, that is, he was charged with detecting security loopholes in the app’s firewall. While launching his ethical cyber attacks, it struck him how useful it would be to crowdsource ‘ethical hacking’ to address companies’ growing need for cybersecurity solutions.

And in 2016, Prakash turned his idea into reality and started the crowdsourced cybersecurity platform Appsecure. the platform leverages Hackhive- which is essentially a network of trusted and well-reputed hackers that operate on the platform, and the concept of Bug Bounties- which is the price companies are willing to pay to have certain aspects of their digital platforms scanned for loopholes.

“Currently, how it works is that if I find a bug in a website or a product, it becomes difficult for me to report that to the company. We want to create a channel where it becomes easier for hackers to reach out to companies and explain the loopholes present,” Parakash told YourStory.

How it works

• The customer provides the name of the app they want the hacker to scan and ascribes a bounty brief to Appsecure
• A trusted hacker within the Hackhive takes on the task and searches for possible weaknesses in the system 
• The ethical hacker reports any security weak points and works on fixing the vulnerabilities and recommends changes that would further protect the app
• Optional: companies put up continuous bounties to keep ethical hackers interested in regularly checking those systems.

In the light of recent major hacks and 27,000 security threats reported in India during the first half of 2017, Appsecure gained traction on a massive scale. Due to the platform’s success, Appsecure has managed to gather a client portfolio that includes tech giants such as Google, Paypal, Twitter and Facebook.

Furthermore, Appsecure can also be used with a subscription model where companies can organize to have their systems regularly checked for vulnerabilities, whilst still providing bounties for each weakness found.