Coles makes a special offer to hackers: help to take us down
Ever wanted to hack the Coles website or other software applications? The giant Australian retailer is not only inviting would-be hackers to find breaches in a number of its online assets, it will also pay them if they are successful.
Coles is one of a growing list of companies that are utilising bug bounty programs to augment their regular software security testing. Bug bounties are a form of penetration testing that call upon the skills of freelance computer security professionals to join organised bug hunts designed to uncover weaknesses in websites and online applications. Anyone who discovers a weakness is encouraged to discreetly inform the target organisation and is given a financial reward.
In the case of Coles, it is managing its bug bounty program through the Australian start-up Bugcrowd. According to CINToles' group general manager for IT, Conrad Harvey, Bugcrowd caught his attention during an investor session organised by the Startmate incubator program. Within 48 hours Coles had signed up, and its first bug bounty was launched the following Saturday.
Harvey said Bugcrowd gave Coles access to security testing skills that it could otherwise not reach, particularly in newer fields such as Android applications. Harvey said the service would also be used to help secure other customer-facing applications, and would act as an additional layer of security alongside Coles' existing protocols and procedures.
Bugcrowd's growing list of customers includes Rabobank, Bigcommerce and Google. It recruits security testers and manages the bug bounty program, ensuring that all parties are treated fairly.
Company co-founder Casey Ellis is currently in the US raising Bugcrowd's first round of capital. He said the company had taken off much faster than anticipated after he and business partner Serg Belokamen launched it late last year. He described Bugcrowd as bringing balance to the economic advantage possessed by "the bad guys".
"For companies like Coles or Google or Rabobank, every time they have to get their stuff tested they have to pay someone for their time, regardless of whether they find something or not," Ellis said. "When you look at the bad guys, there is a lot more of them, there is a lot more diversity in the skill set, but the economics are that they don't get paid until they find something and exploit it."
Numerous companies are now competing in the bug bounty market, including Melbourne-based Bugwolf. Founder Ash Conway said he also expected to announce several large client wins imminently.
Business security specialist Nick Ellsmore, who has worked as an advisor to Bugcrowd, estimated that the Australian market for penetration testing was worth about $300 million a year, and sees strong opportunities for new services.
"If you look at the size of the market and how it's being serviced, there is currently no company in that would have more than 10 per cent market share," Ellsmore said. "A lot of the work is being done by people who aren't specialists, and it's really an industry that calls out for a better solution."
Frequently Asked Questions about this Article…
Coles has launched a bug bounty program inviting independent security testers to find weaknesses in its websites and apps. The retailer signed up quickly with Australian start-up Bugcrowd and launched its first organised bug hunt to augment regular software security testing and add an extra layer of protection to customer‑facing applications.
Coles manages its bug bounty through Bugcrowd, which recruits freelance security testers and runs organised hunts. According to Coles' IT manager Conrad Harvey, Bugcrowd gives access to specialist skills (for example Android testing) that Coles might not reach otherwise, and acts as an additional layer alongside the retailer's existing security protocols.
Bugcrowd is an Australian start‑up that manages bug bounty programs and connects companies with security testers. The article notes rapid take‑up since its launch, the founders Casey Ellis and Serg Belokamen raising capital in the US, and a growing customer list that includes Rabobank, Bigcommerce and Google.
Bug bounty programs are a form of penetration testing where freelance security professionals join organised hunts to uncover vulnerabilities. Testers discreetly report discovered weaknesses to the company and receive financial rewards if their finding is valid. Bugcrowd manages the process to ensure testers and companies are treated fairly.
For investors, widespread use of bug bounty programs signals that a company is actively strengthening its cybersecurity and using modern testing approaches. Better security can reduce the risk of costly data breaches and protect customer trust—factors that matter for long‑term business resilience, though this is only one of many elements to consider when assessing an investment.
Business security specialist Nick Ellsmore estimates the Australian penetration testing market at about $300 million a year, with no single company holding more than roughly 10% market share. That fragmented market suggests room for growth and opportunity for specialised services, which may interest investors following cybersecurity businesses.
Besides Bugcrowd and its customers Rabobank, Bigcommerce and Google, the article mentions Melbourne‑based competitor Bugwolf. It also references advisors and founders active in the space, such as Casey Ellis, Serg Belokamen and Ash Conway, indicating a growing and competitive domestic market.
The article suggests bug bounty models can change the economics of security testing: companies typically pay for traditional testing regardless of whether issues are found, while bug bounty programs incentivise a diverse pool of testers who are rewarded when they find valid vulnerabilities. Bugcrowd also provides access to skills that might otherwise be hard to reach, making the approach a potentially efficient complement to existing security measures.
Call 1300 880 160
Start a chat
Schedule a call
