Case Study: Maryland Department of Information Technology builds a researcher-first VDP with Bugcrowd

Maryland Department of Information Technology surfaces 554 vulnerabilities with Bugcrowd

The Maryland Department of Information Technology (DoIT) faced the challenge of gaining visibility into vulnerabilities across its vast and constantly evolving IT infrastructure. With tighter budgets and leaner teams than federal counterparts, DoIT needed a practical way to implement continuous offensive security testing. The state turned to Bugcrowd to build a lasting Vulnerability Disclosure Program (VDP) that would overcome internal fears about resource allocation and establish a legally sound framework.

Bugcrowd provided the platform and expertise to launch Maryland's VDP in 2025. The solution involved close collaboration with the state's legal team to create clear safe harbor language and a researcher-first experience. The Bugcrowd solution yielded significant results, surfacing 554 vulnerabilities with 100% actionable findings. The program's success enabled Maryland to host a successful live bug bounty event and has served as a gateway to engage the next generation of security talent.

Maryland Department of Information Technology