Geographic Money Flow – Visualization of the Bounties by Geography showing on the left where the companies paying bounties are located and on the right where hackers receiving bounties are located.

A report from one of the largest documented surveys conducted on the ethical hacking community reveals some hackers are earning over 16 times that of full-time software engineers in their home country. The study had 1,698 respondents and conducted by HackerOne, a global hacker community platform, which has seen a 10-fold increase in its registered users in the past two years.

Additional key findings:

— Nearly 1 in 4 hackers have not reported a vulnerability that they found because the company didn’t have a channel to disclose it.

— Money remains a top reason for why bug bounty hackers hack, but it’s fallen from first to fourth place compared to 2016. Above all, hackers are motivated by the opportunity to learn tips and techniques, with “to be challenged” and “to have fun” tied for second.

— India (23%) and the United States (20%) are the top two countries represented by the HackerOne hacker community, followed by Russia (6%), Pakistan (4%) and United Kingdom (4%).

— Nearly 58% of them are self-taught hackers. Despite 50% of hackers having studied computer science at an undergraduate or graduate level, and 26.4% studied computer science in high school or before, less than 5% have learned hacking skills in a classroom.

— While 37% of hackers say they hack as a hobby in their spare time, about 12% of hackers on HackerOne make $20,000 or more annually from bug bounties, over 3% of which are making more than $100,000 per year, 1.1% are making over $350,000 annually. A quarter of hackers rely on bounties for at least 50% of their annual income, and 13.7% say their bounties earned represents 90-100% of their annual income.