Crowdsourced Vulnerability Discovery and Disclosure (CVDD)

The Department of Defense Washington Headquarters Service established this Master IDIQ for crowdsourced vulnerability discovery and disclosure services on September 30, 2018, with a shared ceiling of $34 million, but ordering closed on September 28, 2021 and the vehicle is no longer available for new task orders.

The vehicle supports DoD cyber security operations by contracting with commercial firms to host and administer crowdsourced hacking competitions and vulnerability bounty programs. Awarded task orders procure platform technology, services administration, and bounty payouts for initiatives including Hack the Pentagon and Air Force vulnerability discovery programs. Work is firm fixed price with typical order values ranging from roughly $200,000 to $550,000.

Three prime contractors dominate the vehicle: HackerOne Inc. holds six orders worth $2.3 million combined potential value, Synack Inc. holds five orders totaling $1.3 million, and Bugcrowd Inc. holds four orders totaling $1.3 million. These three firms captured 100 percent of awarded task orders and the entire combined potential value. The Office of the Secretary of Defense placed all 15 task orders under the vehicle.

Competition was nearly unrestricted. Fourteen of 15 orders (93 percent) carried no set-aside designation; one order in 2019 was designated Total Small Business. Task orders were awarded continuously from September 2018 through June 2022, with highest activity in 2019 (five orders) and declining momentum thereafter (two orders in 2021, one in 2022). Combined task-order potential value totaled $4.9 million, fully obligated.

Because the last-order date has passed and no new task orders may be placed against this vehicle, pursuit is not viable unless subcontracting under an existing prime's award is possible.

Assisted by the private sector, the Government intends to use existing commercial crowdsourcing expertise and best practices, tailored for the Government's use, to support the DoD in applying the crowdsourcing methodology to enhance its information security. To support this objective, the DoD has contracted with commercial firms with extensive experience with administering crowdsourced vulnerability discovery and disclosure activities as a service. Under the resulting task order(s), the firm will host crowdsourced security activities on behalf of the DoD.