Summary

Astra displays Bounty Loss or Potential Loss estimates alongside vulnerabilities in your dashboard to provide a real-world reference for the potential monetary impact of a security flaw. These metrics help organizations understand the market perception and severity of a vulnerability class by comparing them to rewards typically paid out in public bug bounty programs.

The primary purpose of these metrics is to translate technical security risks into a financial frame of reference. By estimating what a security researcher would be paid to disclose a specific bug, Astra helps teams prioritize remediation based on the relative "market value" of the exploit.

Who Should Read This

• Security Leads: To prioritize the most high-impact vulnerabilities that would be attractive to external researchers.

• Management & Stakeholders: To understand the potential financial liability and risk associated with unsolved security issues.

• Engineering Teams: To gain context on the relative criticality of a vulnerability compared to industry standards.

Key Functions

Key Definitions

• Bounty Loss: An estimated reward (in USD) that would typically be paid to a researcher if the vulnerability were discovered and responsibly disclosed through platforms like HackerOne or Bugcrowd.

• Potential Loss: An estimate used when direct public bounty data is unavailable. It reflects a broader valuation based on severity, exploitability, and historical averages from similar vulnerability categories.

Key Functions: How These Estimates Are Calculated

Astra's system derives these values through a multi-step analysis:

1. Public Referencing: The system monitors publicly disclosed reports from trusted bug bounty archives.

2. Contextual Mapping: For each detected vulnerability, the system identifies similar reports based on type, context, and impact.

3. Indicative Range: An indicative payout range is derived from these similar cases. If available, a reference link to the specific public report is provided in the vulnerability details sheet.

4. Fallback Estimation: When no public data exists, Astra calculates Potential Loss by evaluating the impact surface, such as potential data exposure, authentication bypasses, or service disruptions.

Best Practices: Important Disclaimers

• Indicative Only: These values are for informational purposes and should not be treated as definitive or absolute financial loss estimates.

• Variable Factors: Actual payouts in the real world vary based on an organization's specific policies, the uniqueness of the discovery, and the timing of the report.

• No Payout Participation: Astra does not participate in, facilitate, or guarantee bounty payouts to researchers; these metrics are purely educational.