QA Rating

Bugcrowd

Bugcrowd is an independent testing company founded in 2012, headquartered in San Francisco, the USA, with 201-500 people. It offers Penetration testing, Red teaming, Attack surface management. Certificates confirmed by a register entry: CREST, FedRAMP, CSA STAR. It publishes no rate card. Data checked on September 2, 2026.
Profile checkedSeptember 2, 202620 sourceswww.bugcrowd.com

Best suited for

Facts

Comparable facts about Bugcrowd. Every field is shown, including the ones the company has not published.
HeadquartersSan Francisco, the USA
Delivery locationsthe USA
Team size201-500 people
Founded2012
OwnershipIndependent
ServicesPenetration testing, Red teaming, Attack surface management
IndustriesBanking, Healthcare, Ecommerce, Automotive, Public sector
FrameworksNot published
Engagement modelsCrowdtesting, Managed testing service
Client stagesEnterprises
CertificatesCRESTregister entryFedRAMPregister entryCSA STARregister entry
Signs a BAA / GDPR DPANot confirmed / Yes
Published ratesNot published
Minimum projectNot published
OnboardingNot published
Crowd tester poolNot published
Device labNot published

Certificates the company claims

SOC 2claimedcompany pageISO/IEC 27001claimedcompany pageCyber Essentialsclaimedcompany page

These certificates are not confirmed by a registry entry, a certificate document or an auditor report. Each one is what the company says about itself on the page linked beside it, read on the date shown there. They are listed apart from confirmed certificates and are not counted anywhere the catalog counts certificates: not in the rankings tables, not in the applicability tags, not in comparisons.

Reviews on external platforms

No external review profile found.

This catalog collects no reviews of its own. Review counts and scores are aggregates from external platforms, shown with the date they were read.

Named clients

Editorial note

This profile carries no applicability tags. The security-focus tag requires the security-testing service alongside penetration testing or a verified ISO/IEC 27001 certificate. Bugcrowd's profile lists penetration-testing, red-teaming and attack-surface-management as services, with no security-testing entry, even though CREST, FedRAMP and CSA STAR are verified certifications on this profile.

Rankings this company appears in

Sources

  1. About BugcrowdChecked on September 2, 2026
  2. Bugcrowd company page - LinkedInChecked on September 2, 2026. Shows 201-500 employees company-size band (LinkedIn range), HQ address 300 California St, Suite 220, San Francisco, CA 94104, US, founded 2012.
  3. Bugcrowd LeadershipChecked on September 2, 2026. Confirms founder Casey Ellis launched Bugcrowd and its first bug bounty programs in 2012.
  4. Contact Us - BugcrowdChecked on September 2, 2026. Lists two office locations, both in the US: San Francisco, CA (HQ) and Bedford, NH. No non-US delivery locations found on the vendor's own site, despite third-party mentions of historical Sydney/London offices.
  5. Bugcrowd Products and Services overviewChecked on September 2, 2026
  6. Bugcrowd Solutions (industries and engagement models)Checked on September 2, 2026
  7. Managed Bug Bounty - BugcrowdChecked on September 2, 2026
  8. CREST Accreditation Profile - Bugcrowd (CREST Marketplace registry)Checked on September 2, 2026. Third-party CREST registry listing confirming penetration testing accreditation for Europe and North America. Page also mentions Bugcrowd holds ISO27001, but this is CREST's own listing text, not the ISO certification registry, so ISO 27001 is not published as verified from this source.
  9. Bugcrowd for Government (BCGOV) - FedRAMP MarketplaceChecked on September 2, 2026. Official FedRAMP government registry listing, Moderate impact level, authorized February 19, 2026.
  10. CSA STAR Registry Listing for Bugcrowd IncChecked on September 2, 2026. Public CSA STAR registry entry, Level 1 Self-Assessment (CAIQ v4.0.2), listed since 2023-06-20.
  11. Bugcrowd Trust CenterChecked on September 2, 2026. Vendor's own trust page. Lists SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, ISO/IEC 27018:2019, CSA STAR Level 1, Cyber Essentials, Cyber Essentials Plus, NIST 800-53 Rev.5, FedRAMP Moderate and CREST. Per collection rules, a vendor's own claim is not sufficient to publish a certification; only FedRAMP, CREST and CSA STAR were independently verified via s8/s9/s10 registries. Also lists a Data Processing Addendum under Legal documents (used for gdprDPA); no explicit statement about signing a HIPAA BAA was found.
  12. Bugcrowd homepageChecked on September 2, 2026. Contains customer-impact quotes for Motorola Mobility ($60M saved) and a named Rubrik reviewer quote, plus platform rating and stats.
  13. Motorola | Bugcrowd customer case studyChecked on September 2, 2026
  14. Rapyd | Bugcrowd customer case studyChecked on September 2, 2026
  15. Case Study: The ROI of Okta's Bug Bounty ProgramChecked on September 2, 2026
  16. Case Study: Twilio's Bug Bounty Program Over the YearsChecked on September 2, 2026
  17. Case Study: Barracuda's Fully Managed Bug Bounty ProgramChecked on September 2, 2026
  18. Managed Bug Bounty product page (TaxSlayer, Atlassian, Code.org customer quotes)Checked on September 2, 2026. Same URL as s7; cited separately for the named, quoted customer testimonials (TaxSlayer CISO, Atlassian CISO, Code.org CTO).
  19. Bugcrowd Announces Rapid Growth of Customer Base Year Over YearChecked on September 2, 2026. Press release mentioning ExpressVPN, Rapyd and T-Mobile among customers; used only as a secondary reference, not as the sourceId for named clients already confirmed elsewhere.
  20. Bugcrowd Secures $102 Million in Strategic Growth Funding to Scale AI-Powered Crowdsourced Security PlatformChecked on September 2, 2026. Confirms Bugcrowd remains a privately held, independently operating company (VC/growth-equity funded, not acquired, not public).

Every field on this profile records which of these sources it came from. The profile was last rebuilt from them on September 2, 2026. A field no source confirms is left empty rather than estimated.

Published by QA Rating

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source. Last checked on September 2, 2026.

Badge for your site

If you work at Bugcrowd, you can put a badge linking to this profile on your own site. It is free, it is not tied to any tier, and the badges page explains what each badge claims and when it should come down.

Bugcrowd

  • Bugcrowd Listed in QA Rating 
    <a href="https://qa-rating.com/companies/bugcrowd/">
  <svg xmlns="http://www.w3.org/2000/svg" width="240" height="64" viewBox="0 0 240 64" role="img" aria-label="Bugcrowd listed in QA Rating">
    <rect x="0.5" y="0.5" width="239" height="63" rx="6" fill="#ffffff" stroke="#cbd2d9"/>
    <text x="16" y="27" font-family="system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="15" font-weight="600" fill="#1f2933">Bugcrowd</text>
    <text x="16" y="47" font-family="system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="12" fill="#52606d">Listed in QA Rating</text>
  </svg>
</a>
  • Bugcrowd Profile checked 2026 
    <a href="https://qa-rating.com/companies/bugcrowd/">
  <svg xmlns="http://www.w3.org/2000/svg" width="240" height="64" viewBox="0 0 240 64" role="img" aria-label="Bugcrowd: profile checked 2026 in QA Rating">
    <rect x="0.5" y="0.5" width="239" height="63" rx="6" fill="#ffffff" stroke="#cbd2d9"/>
    <text x="16" y="27" font-family="system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="15" font-weight="600" fill="#1f2933">Bugcrowd</text>
    <text x="16" y="47" font-family="system-ui, -apple-system, Segoe UI, Roboto, sans-serif" font-size="12" fill="#52606d">Profile checked 2026</text>
  </svg>
</a>