“The main thing is that some incident response, security response program, the core pieces of it need to be in place.”

Transcript evidence from Devin McMasters -- Bug Bounty with a Side of Empathy.