Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.
Three completely different assurance models with overlapping names. Bug bounties are continuous, public, paid per finding, and skewed toward what's profitable to find. Pentests are time-boxed, scope-limited, paid per engagement, and skewed toward what's expected to be in scope. Internal reviews see the source and the design but lack the adversary's creative pressure. Knowing which assurance you actually need is half the security strategy.
A new SaaS startup with a public API and no security team: an external pentest costs $20k-$50k, finds the obvious. A bug bounty program (HackerOne, BugCrowd) is ongoing and pays only for valid findings — typically $1k-$10k each. Internal SAST + DAST catches a different class of bugs and is cheap to run. You probably want all three eventually.