Offensive security · Managed service
Bug bounty program management.
Your program. Our operation. Their best hackers.
Zentara provides the platform, brings vetted hunters, triages every submission and administers the rewards — on infrastructure that stays yours.
Aligned to
14 days
Kick-off to a live program
24/7
Continuous coverage & triage
Unlimited
Retesting, at no extra cost
Open findings
7
In triage
3
Closed this month
24
Zentara handling
SLA achievement
98.4%
Budget used
41%
Runs on Raksa · in your infrastructure · zero data egress
Why managed
Buying the platform is two weeks. Running the program is a year.
Crowdsourced testing works — it finds what scheduled testing misses, continuously, from many perspectives. What defeats most in-house attempts isn't the technology. It's everything the technology doesn't do.
The platform is the easy part
Standing up software takes a fortnight. Running the program is the other fifty weeks — and it needs analysts who can reproduce an exploit at 2am, not another dashboard licence.
The firehose lands on your team
Open a program and you get duplicates, out-of-scope noise, inflated severities, and reports written to maximise a payout. Unfiltered, that queue costs your engineers more time than it saves.
Rewards are a finance problem
Every payout needs a validated severity, an approval, a budget check, a disbursement, and Indonesian withholding tax handled correctly — with evidence, every month.
Someone has to arbitrate
Researchers dispute severity. Engineers dispute validity. Without an independent, CVSS-based adjudicator, the program becomes an argument instead of a control.
Who does the work
Self-run
- You staff triage
- You chase researchers
- You arbitrate severity
- You administer payouts & tax
- You build the reporting
Managed
- We staff triage
- We hold the relationships
- We adjudicate on CVSS
- We handle rewards & PPh
- We deliver the evidence
Already have the bench and want to run it yourself? Buy the platform — Raksa. This page is for the organizations that want the outcome, not the operation.
What we run
Everything between your assets and a closed finding.
Eight moving parts of a working program. You own the decisions and the data; we do the operating.
Platform & licence
Raksa deployed and licensed for the term, activated within 14 days of kick-off, with API and connector integration to your applications.
Program design & launch
Scope, rules of engagement, disclosure policy, reward table, and budget ceiling — agreed with your Work Supervisor before a single hunter is invited.
The hunter community
KYC-verified, NDA-bound researchers under a zero-disclosure policy, with continuous real-time re-verification. Bring your own as well, through the same gate.
Triage & validation
Our analysts reproduce, deduplicate, and score every submission on CVSS against your business risk — before it ever reaches your engineers.
Reward administration
Recommendation, approval, disbursement, and PPh withholding, tracked gross/tax/net per hunter with monthly evidence for finance.
Remediation & retest
Fix guidance to your team, then unlimited re-verification for the life of the contract — until the finding is genuinely closed.
Hunter communication
We sit between your team and the researchers, so your engineers never manage a relationship or a dispute directly.
Reporting & knowledge transfer
Monthly documentation, periodic executive reporting, and a structured handover that lifts your own assessment practice.
Operating model
From scope to closed, every month.
A governed cycle rather than a testing window — the program keeps running as you ship, and every stage produces a record.
Scope & policy
Assets in scope, rules of engagement, disclosure policy, reward bands, and budget ceiling agreed and documented.
Activate & launch
Platform and licence live within 14 days of kick-off. Program published private or public, with a welcome letter and onboarded hunters.
Hunt
Continuous testing across web, mobile, and API assets — 24/7, unbounded by a testing window, adapting as you ship.
Triage & validate
Reproduce, deduplicate, and score on CVSS. Out-of-scope and invalid submissions are refused before they reach you.
Reward & disburse
Reward set against the validated tier, approved, paid, and tax-administered — with evidence submitted monthly.
Remediate & retest
Remediation guidance to your engineers, then re-verification as many times as it takes to close the finding.
Report
Monthly documentation and periodic executive reporting on volume, severity mix, SLA achievement, and reward spend against budget.
Retest loop
Remediate ⇄ retest repeats until the fix holds — unlimited, at no additional cost, for the life of the contract.
Governance & SLA
Commitments, not best efforts.
A program is a control. Controls have to be measurable, enforceable, and defensible to whoever audits you.
SLA on response & resolution
Clocks run on every finding, tiered by severity, with breach monitoring against your maintenance-guarantee thresholds.
CVSS with business context
Severity classified on CVSS v3.1 and weighted against your business risk — validated by an analyst, not accepted from the submitter.
KYC + NDA, zero-disclosure
Identity verified against official documents with continuous real-time checks; every researcher bound by NDA before a report is accepted.
Accountability for what's found
We are answerable for findings surfaced during the program, including disputes over validity — during the contract and after it ends.
What lands on your desk
Deliverables, every term.
Reporting
Evidence your regulator can read.
Two tracks, every period. A technical record per finding for the security team, and an executive recap for leadership, procurement, and audit — volumes, severity mix, SLA achievement, and exactly what the program cost.
- Report volumes and severity distribution
- SLA achievement — response & resolution, with breach drill-down
- Reward spend: gross, PPh withheld, net — per researcher
- Budget consumed against the approved ceiling
- Findings register with remediation status
Program report
· e-Service Bug Bounty
Submitted
48
Valid
24
Duplicate
11
Out-of-scope
13
Valid findings by severity
Reward gross
Rp 124 jt
PPh withheld
Rp 12 jt
Net paid
Rp 112 jt
Response SLA met on 47/48 · resolution SLA met on 24/24 · one breach documented with root cause. Budget consumed: 41% of approved ceiling.
Managed, not offshored
A managed program that still runs inside your walls.
The service is delivered on Raksa, deployed on-premise or in your own cloud. You get an operated program without your unpatched-vulnerability data ever leaving your jurisdiction — and you remain the data controller throughout.
Program types
Private, public, or disclosure-only.
Scope and exposure are your call — the vetting, triage, and governance gate stays the same in all three.
Private program
Invite-only, run against a selected group of vetted researchers. The default for banks, SOEs, and government — coverage without publishing your attack surface.
Public program
Open to the wider verified community for maximum eyes on a public-facing service, with the same KYC, NDA, and triage gate in front of your team.
VDP
A coordinated disclosure channel aligned to ISO 29147 / 30111 — a lawful route for anyone who finds something, whether or not a reward applies.
Proven at national scale
A managed bug bounty program for national social-security e-services — web and mobile applications relied on by millions, under continuous coverage.
Pairs with
Continuous coverage is one layer.
Build the program
Pairs well with
VAPT — Vulnerability Assessment & Penetration Testing
Scheduled, in-depth testing — the baseline a bounty program runs on top of.
Mobile Application Security
Mobile assets in scope? Test, shield and defend the app itself.
Red Team Operations
Prove the whole chain end to end, not just the findings in a queue.
Managed SOC
The team that watches production while the researchers probe it.
FAQ
Straight answers on managed programs
What security, procurement, and finance leads ask before running a bounty program.
Raksa is the platform — you deploy it, you staff the triage, you run the program. This is the outcome: Zentara provides the platform and licence and then operates the whole program for you. Our analysts triage, our vetted community hunts, we administer the rewards and the withholding tax, and we produce the monthly evidence. Most organizations that try to self-run discover the software was the cheap part; the operation needs a bench of people who can reproduce an exploit and defend a severity rating. If you have that bench, buy the platform. If you don't, buy the program.
Inside your infrastructure. The managed service runs on Raksa, deployed on-premise or in your own cloud tenancy, so a managed program never means shipping your unpatched-vulnerability data to an offshore platform. That's the structural difference from the global crowdsourcing services and it's what makes the model workable for regulated Indonesian institutions under UU PDP and PP 71/2019. You remain the data controller throughout; we operate under your governance, and all data, documents, and results of the program belong to you.
Everything passes a gate before it reaches you. Unverified researchers cannot submit at all. Reports must carry a valid CVSS vector and hit an in-scope, eligible asset, or the platform refuses them automatically. On-prem AI flags likely duplicates, and then a human analyst reproduces the finding and validates the severity. What lands in your queue is a small number of confirmed, deduplicated, correctly-scored issues with remediation guidance attached — not raw traffic.
You set the reward table and the budget ceiling before the program opens; your Work Supervisor approves the bands per campaign. We recommend the reward against the server-validated CVSS tier, so payouts follow evidence rather than negotiation. That separation matters: the researcher proposes, an independent analyst validates, and you approve. It keeps spend predictable and stops severity inflation from becoming a commercial argument.
Completely, by us. Payout accounts are held against verified KYC, and every disbursement is tracked gross, tax, and net per researcher, including Indonesian withholding tax (PPh). Evidence is submitted to you monthly, so your finance team receives a clean, auditable trail rather than a spreadsheet of ad-hoc transfers. The accumulated reward spend is capped by the budget ceiling you set at the start.
We arbitrate, and that continues after the contract ends. Disputes over whether a finding is valid, or how severe it really is, are the most common friction point in any program. Zentara acts as the independent adjudicator on a CVSS basis with the evidence recorded on the platform, and we remain available to support you on differences of opinion about findings even once the term is over. Everything is written to a tamper-evident audit trail so the record is verifiable rather than remembered.
Platform and licence activation is 14 calendar days from the kick-off meeting, with the program running for the full contract term from the date the licence goes active. Scope, rules of engagement, and the reward table are agreed during that window, so hunters begin work the moment the program opens rather than waiting on paperwork.
Crowdsource the hunt. Hand us the operation.
Scope, launch, triage, rewards, and the reporting — run by the team that built the platform, on infrastructure that stays yours. Live in fourteen days.