As a company, why would I want to pay the hourly rate at all? Why not contract with a reputable bounty hunter, give them the level of access I'd give the hourly consultant, and pay the hunter bounties for what they find?
Seems like that captures the "higher bugs per hour" advantage of the consultant while retaining the "you only get paid for directly producing value" advantage of bounties.
Seems like that captures the "higher bugs per hour" advantage of the consultant while retaining the "you only get paid for directly producing value" advantage of bounties.