Your program. Our operation. Their best hackers.
A bug bounty program isn't software you switch on. It's an operation someone has to run.
Zentara provides the platform and the licence, brings the vetted hunters, triages every submission, administers the rewards and the tax, and produces the monthly evidence — on infrastructure that stays yours.
14 days
Kick-off to a live program
24/7
Continuous coverage & triage
Unlimited
Retesting, at no extra cost
Open findings
7
In triage
3
Closed this month
24
Zentara handling
SLA achievement
98.4%
Budget used
41%
Runs on Raksa · in your infrastructure · zero data egress
Aligned to
Why managed
Buying the platform is two weeks. Running the program is a year.
Crowdsourced testing works — it finds what scheduled testing misses, continuously, from many perspectives. What defeats most in-house attempts isn't the technology. It's everything the technology doesn't do.
The platform is the easy part
Standing up software takes a fortnight. Running the program is the other fifty weeks — and it needs analysts who can reproduce an exploit at 2am, not another dashboard licence.
The firehose lands on your team
Open a program and you get duplicates, out-of-scope noise, inflated severities, and reports written to maximise a payout. Unfiltered, that queue costs your engineers more time than it saves.
Rewards are a finance problem
Every payout needs a validated severity, an approval, a budget check, a disbursement, and Indonesian withholding tax handled correctly — with evidence, every month.
Someone has to arbitrate
Researchers dispute severity. Engineers dispute validity. Without an independent, CVSS-based adjudicator, the program becomes an argument instead of a control.
Who does the work
Self-run
- You staff triage
- You chase researchers
- You arbitrate severity
- You administer payouts & tax
- You build the reporting
Managed
- We staff triage
- We hold the relationships
- We adjudicate on CVSS
- We handle rewards & PPh
- We deliver the evidence
Already have the bench and want to run it yourself? Buy the platform — Raksa. This page is for the organizations that want the outcome, not the operation.
What we run
Everything between your assets and a closed finding.
Eight moving parts of a working program. You own the decisions and the data; we do the operating.
Platform & licence
Raksa deployed and licensed for the term, activated within 14 days of kick-off, with API and connector integration to your applications.
Program design & launch
Scope, rules of engagement, disclosure policy, reward table, and budget ceiling — agreed with your Work Supervisor before a single hunter is invited.
The hunter community
KYC-verified, NDA-bound researchers under a zero-disclosure policy, with continuous real-time re-verification. Bring your own as well, through the same gate.
Triage & validation
Our analysts reproduce, deduplicate, and score every submission on CVSS against your business risk — before it ever reaches your engineers.
Reward administration
Recommendation, approval, disbursement, and PPh withholding, tracked gross/tax/net per hunter with monthly evidence for finance.
Remediation & retest
Fix guidance to your team, then unlimited re-verification for the life of the contract — until the finding is genuinely closed.
Hunter communication
We sit between your team and the researchers, so your engineers never manage a relationship or a dispute directly.
Reporting & knowledge transfer
Monthly documentation, periodic executive reporting, and a structured handover that lifts your own assessment practice.
Operating model
From scope to closed, every month.
A governed cycle rather than a testing window — the program keeps running as you ship, and every stage produces a record.
Scope & policy
Assets in scope, rules of engagement, disclosure policy, reward bands, and budget ceiling agreed and documented.
Activate & launch
Platform and licence live within 14 days of kick-off. Program published private or public, with a welcome letter and onboarded hunters.
Hunt
Continuous testing across web, mobile, and API assets — 24/7, unbounded by a testing window, adapting as you ship.
Triage & validate
Reproduce, deduplicate, and score on CVSS. Out-of-scope and invalid submissions are refused before they reach you.
Reward & disburse
Reward set against the validated tier, approved, paid, and tax-administered — with evidence submitted monthly.
Remediate & retest
Remediation guidance to your engineers, then re-verification as many times as it takes to close the finding.
Report
Monthly documentation and periodic executive reporting on volume, severity mix, SLA achievement, and reward spend against budget.
Retest loop
Remediate ⇄ retest repeats until the fix holds — unlimited, at no additional cost, for the life of the contract.
Governance & SLA
Commitments, not best efforts.
A program is a control. Controls have to be measurable, enforceable, and defensible to whoever audits you.
SLA on response & resolution
Clocks run on every finding, tiered by severity, with breach monitoring against your maintenance-guarantee thresholds.
CVSS with business context
Severity classified on CVSS v3.1 and weighted against your business risk — validated by an analyst, not accepted from the submitter.
KYC + NDA, zero-disclosure
Identity verified against official documents with continuous real-time checks; every researcher bound by NDA before a report is accepted.
Accountability for what's found
We are answerable for findings surfaced during the program, including disputes over validity — during the contract and after it ends.
What lands on your desk
Deliverables, every term.
Reporting
Evidence your regulator can read.
Two tracks, every period. A technical record per finding for the security team, and an executive recap for leadership, procurement, and audit — volumes, severity mix, SLA achievement, and exactly what the program cost.
- Report volumes and severity distribution
- SLA achievement — response & resolution, with breach drill-down
- Reward spend: gross, PPh withheld, net — per researcher
- Budget consumed against the approved ceiling
- Findings register with remediation status
Program report
· e-Service Bug Bounty
Submitted
48
Valid
24
Duplicate
11
Out-of-scope
13
Valid findings by severity
Reward gross
Rp 124 jt
PPh withheld
Rp 12 jt
Net paid
Rp 112 jt
Response SLA met on 47/48 · resolution SLA met on 24/24 · one breach documented with root cause. Budget consumed: 41% of approved ceiling.
Managed, not offshored
A managed program that still runs inside your walls.
The service is delivered on Raksa, deployed on-premise or in your own cloud. You get an operated program without your unpatched-vulnerability data ever leaving your jurisdiction — and you remain the data controller throughout.
Program types
Private, public, or disclosure-only.
Scope and exposure are your call — the vetting, triage, and governance gate stays the same in all three.
Private program
Invite-only, run against a selected group of vetted researchers. The default for banks, SOEs, and government — coverage without publishing your attack surface.
Public program
Open to the wider verified community for maximum eyes on a public-facing service, with the same KYC, NDA, and triage gate in front of your team.
VDP
A coordinated disclosure channel aligned to ISO 29147 / 30111 — a lawful route for anyone who finds something, whether or not a reward applies.
Proven at national scale
A managed bug bounty program for national social-security e-services — web and mobile applications relied on by millions, under continuous coverage.
Pairs with
Continuous coverage is one layer.
Build the program
Pairs well with
VAPT — Vulnerability Assessment & Penetration Testing
Scheduled, in-depth testing — the baseline a bounty program runs on top of.
Mobile Application Security
Mobile assets in scope? Test, shield and defend the app itself.
Red Team Operations
Prove the whole chain end to end, not just the findings in a queue.
Managed SOC
The team that watches production while the researchers probe it.
FAQ
Straight answers on managed programs
What security, procurement, and finance leads ask before running a bounty program.
Raksa is the platform — you deploy it, you staff the triage, you run the program. This is the outcome: Zentara provides the platform and licence and then operates the whole program for you. Our analysts triage, our vetted community hunts, we administer the rewards and the withholding tax, and we produce the monthly evidence. Most organizations that try to self-run discover the software was the cheap part; the operation needs a bench of people who can reproduce an exploit and defend a severity rating. If you have that bench, buy the platform. If you don't, buy the program.
Crowdsource the hunt. Hand us the operation.
Scope, launch, triage, rewards, and the reporting — run by the team that built the platform, on infrastructure that stays yours. Live in fourteen days.