Casey Ellis

Casey Ellis is an Australian cybersecurity entrepreneur and security researcher best known as the founder of Bugcrowd, one of the first companies to commercialize crowdsourced vulnerability disclosure and 'bug bounty' programs at scale. Before founding Bugcrowd, Ellis worked in the security industry as a penetration tester and security researcher.

Founding Bugcrowd

In 2012, Ellis founded Bugcrowd in Sydney, Australia, together with co-founders Chris Raethke and Sergei Belokamen. The company pioneered what Ellis termed "Crowdsourced Security-as-a-Service," building a platform that let organizations run structured bug bounty and vulnerability disclosure programs by tapping a global community of independent security researchers. Bugcrowd relocated its headquarters to San Francisco in 2018 while retaining offices in Sydney and London, growing into one of the largest bug bounty and penetration-testing-as-a-service companies, with a researcher community reported at more than 500,000 hackers by 2024.

Mainstreaming Bug Bounty Programs

Alongside rival platform HackerOne, Bugcrowd played a central role in normalizing bug bounty programs as standard corporate security practice during the 2010s, helping shift the once-controversial idea of paying outside hackers to find flaws into a budgeted line item for governments and large enterprises alike.

Policy Advocacy and disclose.io

Beyond running Bugcrowd, Ellis has been an outspoken advocate for legal protections for good-faith security researchers. In 2018, Bugcrowd joined the #LegalBugBounty project to launch disclose.io, an open-source project providing standardized legal 'safe harbor' language and vulnerability disclosure policy templates intended to shield researchers from prosecution when reporting bugs in good faith. Ellis has also advised U.S. government bodies, including the Department of Defense and CISA, and has weighed in on reform of the Computer Fraud and Abuse Act.

Legacy

Ellis's title at Bugcrowd shifted as the company matured, from founder and CTO to Chief Strategy Officer, and later to Founder and Advisor as professional management took over day-to-day operations. Regardless of title, Ellis is widely credited within the security industry as one of the founding figures of the modern, professionalized bug bounty industry.

Timeline

• 2012Founds Bugcrowd in Sydney, Australia, with co-founders Chris Raethke and Sergei Belokamen.
• 2018Bugcrowd relocates its headquarters to San Francisco; co-launches disclose.io, an open-source vulnerability disclosure and legal safe-harbor framework.
• 2024-02-12Bugcrowd raises $102 million in funding, reporting a community of more than 500,000 security researchers.