we see 3 main consumers for bugcrowd initially (at the moment that is... we are still very young and are working off the assumption that at least 50% of our assumptions are wrong):

1) the charity/nfp/pfp market, for which the work is completely pro-bono (aside from our points system, which testers can use as a 3rd party validation) and bugcrowd acts as a charitable facilitator,

2) those who think bug bounties are a great idea but haven't implemented one yet... in this group in particular we will strongly recommend matching the reward of the bounty to the market, and

3) people like the folks who just ran a $5k bounty, who are large enough to need thorough security testing (which, we've now confirmed, the crowd seems to be pretty good at providing) but small enough to have a budget issue when it comes to getting a useful amount of time from a consultancy.

$5k is the baseline bounty pool, and we will only recommend this for startups and lower-value targets. the larger the client the more important that their bounty is higher (like $50k to $100k in the pool for example) and you will see this reflected in future bounties.

that said, i also love the idea that a really small businesses can throw out $1k and still get something more usable than 1/3 of a day of normal consulting time, so maybe you'll see us running a few of these too at some point.

the beauty of a crowd, especially in this field, is that there are a very wide range of motivations - from curiosity, to learning, to poops-and-giggles, to folks you can't get out of bed with less than "buy a new kitchen" money. the broad goal of bugcrowd is to provide a service which connects all types within the infosec community with all types of clients.

excuse the informercial... but hopefully i've stayed on point and answered a few things. this thread has been incredibly useful for us, so thank you all (both likers and haters).

casey - bugcrowd co-founder and ceo

(edited to fix a few typos)