Bug Bounty

What Bug Bounty does

Bug Bounty LLC (شركة Bug Bounty ذ.م.م) is an Omani limited liability company founded in 2022 and headquartered in Muscat (Seeb), Sultanate of Oman, that operates a hosted cybersecurity platform at bugbounty.om connecting governmental and private-sector organizations in Oman with a community of independent, Oman-based security researchers. The platform runs Security Build Programs including Private and Public Bug Bounty Programs, a Vulnerability Discovery Program, and a Next-Generation Penetration Testing Program, and is supported by a 24/7 hosted-service architecture with a vulnerability scanning and reporting engine and a five-business-day customer approval cycle for bounty recommendations. Researchers self-register as independent contractors under a General Conditions of Use, while enterprise clients sign Customer Master Agreements that auto-renew annually with 30-day payment terms.

The company monetizes through quote-based annual subscriptions, on-demand professional-service fees, transaction-based bounty disbursements to researchers, and Hacking Lab training fees. The service catalog extends beyond crowdsourced testing into a full Offensive Services module (Internal/External Penetration Testing, Wireless Network Testing, Phishing Simulation, Physical Hacking & Force Entry) and a Defensive Services module (Configuration Security Review, Application Security Design and Architecture Review, Network Architecture Security Review, integrated SAST/DAST Source Code Review, Vulnerability Fixing, CIS Benchmark Compliance, and a Vulnerability Disclosure Program). A companion sub-platform, Hacking Lab (hackinglab.bugbounty.om), shares researcher account credentials and offers a WireGuard-VPN-isolated Playground, organized competitions, and educational courses awarding certificates from accredited institutes, functioning as a learning-to-earning funnel into the main platform.

Operationally, Bug Bounty is a privately held, founder-led company led by CEO and co-founder Iman Al-Balushi and Co-founder/Innovation Executive Khaild Alkhamisi, with 11–50 employees, no disclosed external funding or investors, and a single-country footprint governed by Omani law with domestic data hosting (e.g., via D2C). The company does not publish a public API or SDK, has no registered trademark, and is not disclosed to hold any third-party security certifications; its GDPR posture is self-attested in its Privacy Policy, alongside claimed alignment with Omani data-protection and cybersecurity regulations. The combination of regulatory-localized hosting, a domestic-only researcher pool, and a learning-to-earning pipeline defines a regionally focused, multi-product cybersecurity services business rather than a globally scaled bug-bounty marketplace.

Name

Bug Bounty

Legal name

Bug Bounty LLC (شركة Bug Bounty ذ.م.م)

Website

https://bugbounty.om

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

Bug Bounty LLC is an Omani cybersecurity company operating a hosted bug bounty platform that connects governmental and private organizations in Oman with a community of independent security researchers, alongside offensive and defensive security services and a Hacking Lab training sub-platform.

Ownership category

akta.pro rank

Product category

Bug Bounty Platform

NAICS

Security Guards and Patrol Services (561612), Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162), Investigation and Personal Background Check Services (561611)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Bug Bounty, Vulnerability Disclosure & Security Services (FSAPAJAL)

akta.pro secondary industries

Vulnerability Intelligence & Exploit Prediction (HDADAHAI), Vulnerability Management & Penetration Testing Services (BPAEADAD), Deception & Honeypot-Based Network Defense (HDADABAN)

Keywords

• Bug bounty platform
• Penetration testing services
• Vulnerability management
• Ethical hacking training
• Cybersecurity services

Headquarters

HQ city

Muscat

HQ country

Oman

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Bug Bounty Program Fees (Annual Subscription): Annual recurring fees per Security Program ordered by enterprise clients; orders auto-renew annually at then-current prices unless terminated with 60-day notice.
2. On-Demand / Non-Annual Service Fees: One-time fees for on-demand or non-annual vulnerability scanning / penetration testing orders that expire upon completion of the program.
3. Offensive Services (Penetration Testing): Professional-service revenue from Internal Vulnerability Assessment, Internal/External Penetration Testing, Wireless Network Testing, Phishing Simulation, and Physical Hacking & Force Entry engagements.
4. Defensive Services (Security Reviews): Professional-service revenue from Configuration Security Review, Application Security Design and Architecture Review, Network Architecture Security Review, SAST/DAST Source Code Review, Vulnerability Fixing, and CIS Benchmark Compliance.
5. Bounty Payments to Researchers: Platform takes customer-funded bounty payments and disburses approved rewards to security researchers for validated vulnerabilities; late customer payments subject to 1.5%/month interest penalty.
6. Hacking Lab Training & Competitions: Revenue from educational courses, organized competitions, and access to the Playground training environment for individuals and companies (subscriptions available to companies).

Pricing tiers

Go-to-market motion4 records

Distribution channels4 records

Marketing channels6 records

Core offering

Bug Bounty LLC operates a hosted bug bounty and vulnerability management platform (bugbounty.om) that connects governmental and private organizations in the Sultanate of Oman with a community of independent cybersecurity researchers for crowdsourced vulnerability discovery. The platform runs Security Build Programs (Bug Bounty Program in private and public modes, Vulnerability Discovery Program, and Next-Generation Penetration Testing Program) and bundles them with offensive penetration testing and defensive security review services. A companion sub-platform, the Hacking Lab, delivers isolated ethical-hacking training environments, competitions, and certified educational courses.

Product overview

Bug Bounty LLC operates a unified cybersecurity platform hosted at bugbounty.om that is structured as a core platform-plus-modules architecture. The core product is the Bug Bounty Platform (Hosted Service), a SaaS environment that connects client organizations with independent security researchers and orchestrates multiple Security Build Programs: the Bug Bounty Program (offered in both Private and Public modes), the Vulnerability Discovery Program, and the Next-Generation Penetration Testing Program. Built around this core are two service module lines: Offensive Services (Internal Vulnerability Assessment, Internal Penetration Testing, Wireless Network Testing, Phishing Simulation, Physical Hacking & Force Entry) and Defensive Services (Configuration Security Review, Application Security Design and Architecture Review, Network Architecture Security Review, Source Code Review with SAST and DAST, Vulnerability Fixing, CIS Benchmark Compliance, and the Vulnerability Disclosure Program). A separate but account-linked sub-platform, the Hacking Lab (hackinglab.bugbounty.om), extends the offering into training and competitions through three sub-modules: the Play Ground practice environment, organized Hacking Lab Competitions, and Hacking Lab Educational Courses with recognized certification upon completion.

Differentiator

Problem solved

Functional benefit

Brands

• Hacking Lab: Educational and competitions sub-platform associated with Bug Bounty Oman, offering a play ground (isolated simulated environments), cybersecurity educational courses, and competitions for ethical hacking learners and professionals.

Products and services

• Bug Bounty Platform (Hosted Service) Central SaaS platform connecting client organizations in Oman with a community of independent cybersecurity researchers; hosts Security Build Programs (Bug Bounty Program, Vulnerability Discovery Program, Next-Generation Penetration Testing Program) and orchestrates vulnerability reporting, triage, customer review, and bounty disbursement via a unified web portal.
• Bug Bounty Program (Private and Public) Crowdsourced vulnerability discovery program offered in two modes: Private Bug Bounty (invitation-only, restricted to vetted researchers for sensitive systems) and Public Bug Bounty (open to any registered researcher on the platform). Customers select one or both modes to evaluate their assets.
• Defensive Services Suite of proactive security assessment services for organizations, including Configuration Security Review, Application Security Design and Architecture Review, Network Architecture Security Review, Source Code Review (SAST and DAST), Vulnerability Fixing, and CIS Benchmark Compliance. Includes the Vulnerability Disclosure Program.
• Offensive Services Offensive cybersecurity services including Internal Vulnerability Assessment, Internal Penetration Testing, Wireless Network Testing, Phishing Simulation, and Physical Hacking & Force Entry testing, designed to identify weaknesses before they are exploited by attackers.
• Hacking Lab Educational and competitions sub-platform under Bug Bounty Oman offering a Playground simulation environment with isolated dedicated servers, organized cybersecurity competitions, and educational courses covering penetration testing, vulnerability analysis, malware detection, and incident response.
• Vulnerability Disclosure Program (VDP) Defensive service within the Defensive Services suite that allows organizations to receive responsible vulnerability disclosures from external researchers through a structured process, supporting the platform's overall cybersecurity defense mission.
• Hacking Lab Educational Courses Structured cybersecurity training courses covering fundamentals, penetration testing, web application attacks, vulnerability analysis, malware detection and analysis, and incident response. Delivered with hands-on practical exercises and recognized certifications upon completion.
• Hacking Lab Competitions Organized cybersecurity competitions held in isolated safe environments covering network penetration testing, web application attacks, vulnerability solving, and malware discovery. Open to individuals and reserved company/organization-only events with awards and prizes.
• Hacking Lab Play Ground Isolated virtual practice environment within Hacking Lab that simulates real-world networks and vulnerable systems. Users can practice network attacks, malware-based exploits, and system vulnerability exploitation via WireGuard VPN connection without risking real systems.

Quantifiable outcome

• 24/7 continuous monitoring of client digital assets via global ethical hacker community
• +2 more outcomes

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature9 records

Partnerships

Two partnerships are on record, tiered core infrastructure partner for domestic data residency compliance. and core technical integration enabling secure access to the hacking lab isolated environment..

• D2C (Data Hosting Provider)core infrastructure partner for domestic data residency compliance.Technology or IntegrationD2C is referenced as an example of a domestic data hosting provider used by Bug Bounty to comply with Omani data residency requirements. The privacy policy notes that, under current Omani law, data is hosted internally (e.g., with D2C) and not disclosed externally unless necessary for IP theft or unauthorized network access cases.
• WireGuard (VPN technology)core technical integration enabling secure access to the hacking lab isolated environment.Technology or IntegrationWireGuard is used as the VPN technology for connecting users securely to the Hacking Lab challenge environment. The Hacking Lab provides VPN configuration files that users import into the WireGuard client application downloaded from wireguard.com.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• HackerOne: Global leader in bug bounty and vulnerability disclosure platforms connecting organizations with a crowdsourced researcher community. Directly comparable on product category (hosted bug bounty marketplace), researcher-supply model, and enterprise/government customer motion.
• Synack: Crowdsourced security testing platform leveraging a vetted researcher community for continuous penetration testing. Comparable supply-side model (curated independent hackers) and enterprise/government sales motion.
• Intigriti: Europe-headquartered bug bounty and continuous security testing platform with a community of ethical hackers. Comparable crowdsourced bug bounty model and enterprise customer base.
• Bugcrowd: Crowdsourced cybersecurity platform offering bug bounty, vulnerability disclosure, and pentest-as-a-service programs with a global researcher network. Directly competes with Bug Bounty in the same crowdsourced security-testing category.
• YesWeHack: Global bug bounty platform combining crowdsourced vulnerability disclosure with pentest management. Comparable hosted marketplace model serving enterprise and government clients.
• Open Bug Bounty: Free, community-driven vulnerability disclosure and bug bounty platform. Comparable on responsible-disclosure model and researcher-supplied vulnerability reporting, though without the same enterprise service depth.
• Cobalt: Pentest-as-a-service platform connecting organizations to a global community of vetted security testers. Directly comparable on managed offensive testing workflow and enterprise customer profile.

Broad incumbents

• Detectify: Application security platform offering crowdsourced vulnerability research alongside automated surface monitoring. Overlaps on crowdsourced security testing but operates as a broader appsec portfolio rather than a pure bug-bounty marketplace.

Emerging players

• Hack The Box: Cybersecurity upskilling platform with isolated challenge environments, competitions, and enterprise training. Comparable to the Hacking Lab sub-product on hands-on training, CTF-style challenges, and the learning-to-practitioner pipeline.

Regional players

• SafeHats: India-based bug bounty and crowdsourced security testing platform with a managed researcher community. Comparable product category but primarily serves a different geography from Bug Bounty's Omani market.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/bugbounty_om
• LinkedInlinkedin.com/company/bugbountyoman

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Bug Bounty