1Password recently raised its top bug bounty reward from $25,000 to $100,000. They increased the amount to further incentivize researchers, according to its blog. Separately Google paid out $3 million last year for its vulnerability reward program.

But how are these figures determined?

David Baker, vice president of operations at Bugcrowd, believes these big bounties demonstrate that organizations are really starting to think about the market and where the market is pricing vulnerabilities.

"What's a bug worth?" is a common question among organizations looking at crowdsourced security testing, he said.

“The answer will continue to evolve as the market for bug bounties matures, but the key to success remains the same -- attracting the right researchers with the appropriate incentives. However, what most companies don’t realize are the various complexities that go into determining bounty payout ranges,” Baker said.

From defining scope to establishing attractive payout ranges and attracting a solid crowd of researchers to actively participate, starting a program can be complicated and become more complicated as the program matures. Here are some best practices Baker shares for scoping bug bounty programs, including how and when to raise the payouts, as well as how companies can get the most out of their programs. 

This story, "How much is a bug worth?" was originally published by CSO.