Kymberlee Price

Kymberlee Price is an American product security executive whose two-decade career spans Microsoft, BlackBerry, Synack, Bugcrowd, and New Relic, with a throughline of building vulnerability coordination programs and bug bounty operations at some of the industry's largest software vendors and crowdsourced security platforms. She currently serves as Chief Operating Officer, instructor, and principal consultant at Shostack + Associates, the application-security consultancy founded by Adam Shostack.

Early Career and Microsoft's First Security Researcher Outreach Program

Price's security career took shape inside Microsoft's Trustworthy Computing group in the mid-2000s, where she founded what her Black Hat speaker biographies describe as "the first security researcher outreach program in the software industry," building one-to-one and one-to-few programs meant to engage the external research community and lower Microsoft's operational cost of vulnerability response. In 2005 she also co-started the BlueHat security conference at Microsoft together with Window Snyder; in a LinkedIn post reflecting on a return to a BlueHat event, Price wrote that the conference was "started by Window Snyder and myself in 2005 -- it was her idea and strategy, I did execution work." During this period she also served as a principal investigator in the criminal investigation into the Zotob worm and analyzed advanced persistent threats for Microsoft, work for which she has said she received an FBI service award for law-enforcement collaboration.

BlackBerry, Synack, and Bugcrowd

Price next spent four years on BlackBerry's Security (Incident) Response Team, where, per her Black Hat speaker biographies, she handled Webkit- and certificate-related vulnerability cases across BlackBerry products. She then became Director of Ecosystem Strategy at Synack, leading Synack Red Team community management, security response, and vulnerability-metrics-analysis programs, according to her 2014 Black Hat bio. By 2015 she had moved to Bugcrowd as Senior Director of Researcher Operations, where her 2016 and 2017 Black Hat biographies credit her with directing the penetration-testing efforts of a crowdsourced researcher base that grew from roughly 28,000 to more than 50,000 participants across web, mobile, IoT, and infrastructure testing. During this period she also co-chaired the U.S. Department of Commerce NTIA's Working Group on Multi-Party Vulnerability Disclosure, a multistakeholder effort to establish norms for coordinating disclosure across software supply chains.

Return to Microsoft and Later Roles

Price returned to Microsoft in 2017, and by January 2019, as Principal Security PM Manager, she and then-Senior Program Manager Jarek Stanley revamped Microsoft's bug bounty programs starting with Windows, Azure, and Microsoft 365 — raising award amounts, publishing clearer public guidelines, and cutting the time from submission to payout — according to Microsoft's own 2023 retrospective marking ten years of its bug bounty program. She later became Senior Director of Product Security at New Relic (by December 2021), leading the team responsible for the security and integrity of New Relic's products, services, and development infrastructure, and publicly guided customers through the Apache Log4j vulnerabilities that month. Price subsequently co-founded Zatik Security, an advisory practice aimed at helping mid-market and smaller organizations build security strategy and programs, before moving into her current role at Shostack + Associates. She remains a frequent conference speaker and podcast guest on vulnerability coordination, bug bounty program design, and product security incident response.

Timeline

• 2005Co-started the BlueHat security conference at Microsoft with Window Snyder while founding Microsoft's first security researcher outreach program in the Trustworthy Computing group; served as principal investigator in the Zotob worm criminal investigation and analyzed APTs for Microsoft.
• 2014Director of Ecosystem Strategy at Synack, leading Synack Red Team community management, security response, and vulnerability metrics analysis.
• 2015Joined Bugcrowd as Senior Director of Researcher Operations, directing penetration-testing efforts across web, mobile, IoT, and infrastructure for a crowd that grew past 50,000 researchers; co-chaired the NTIA Working Group on Multi-Party Vulnerability Disclosure.
• 2017Returned to Microsoft to focus on application security and third-party/open-source library security.
• 2019As Principal Security PM Manager, revamped Microsoft's bug bounty programs for Windows, Azure, and Microsoft 365 alongside Senior Program Manager Jarek Stanley.
• 2021-12Serving as Senior Director, Product Security at New Relic; published customer guidance on the Apache Log4j vulnerabilities.
• 2023-07-12Appeared as a guest on the Security Conversations (Three Buddy Problem) podcast discussing her career at the Microsoft Security Response Center.