Simon hacks companies – and gets paid for it

In a dark room, a hoodie pulled low over his face, fingers flying over the keyboard to steal data, sabotage systems or extort personal information – that’s how many people picture hackers. But Simon is different. The 36-year-old family man from Zurich spends a lot of time in front of the screen – but not to cause harm.

Simon is an ethical hacker – he deliberately looks for vulnerabilities in IT systems, reports them to the responsible organizations, and helps secure them. “The word ‘hacker’ still sounds negative to many because it’s associated with criminal activity,” he explains. “That’s why I prefer the term security researcher.”

Bug bounty program: “I want to be part of that!”

Simon’s entry into the cyber security scene took a detour: after studying computer science, he worked as a penetration tester – someone who tries to break into IT systems in order to reveal weaknesses. When he heard in 2022 that the Swiss government was launching its own bug bounty program, his reaction was immediate: “I want to join!” He signed up – and quickly made his first discovery.

Bug bounties are rewards for finding and reporting security vulnerabilities in software or websites. They’re offered by companies and governments and are an important part of modern cyber defense strategies.

In principle, anyone can register on a bug bounty platform and take part in public programs. Many programs, however, are private – meaning that only invited security researchers with verified experience can participate. Previous findings and a proven skill set are often the key to being invited.

“Private programs are for experienced security researchers with a track record,” explains Nadine Anderson from GObugfree, a Swiss platform for bug bounty programs.

Hacking for fun – and for a better world

For Simon, bug bounty hunting started as a hobby, but now it’s his main job – and he still enjoys it: “Each program and its level of difficulty is different, and the bounty can range from a few hundred to several thousand francs.” In 2023, he even signed a contract with a Swiss company to test their security continuously. Today, most of his income comes from participating in bug bounty programs.

But bug hunting is not always glamorous: “Sometimes I work late into the evening or spend weekends on it,” Simon admits. “The biggest challenge is perseverance – programs often run for months, and systems are tested again and again.” For Simon, who describes himself as a tinkerer, that’s exactly what makes it fun: “I enjoy trying out things no one else has thought of. When I manage to uncover a serious vulnerability, it’s a great sense of achievement.”

How does he actually work? “First, I analyze the attack surface – say, an app or a web system – and then I test specific parts in detail. If I discover a weakness, I send targeted requests to the system – sometimes even manipulating data packets to provoke reactions. Finally, I document everything in a proof of concept for the company, showing exactly how the vulnerability can be exploited.”

Simon has learned one thing over the years: “It’s not just companies that get targeted. Private individuals are also at risk of being hacked. But with common sense – and a few simple rules – many attacks can be avoided.”

Life between bugs, community and family

What Simon values most is the community around ethical hacking, because the sense of working together is motivating: “Once a year, the GObugfree platform hosts GOhack. It’s a fantastic event where I get to meet peers in person and test my skills in a live hacking challenge,” he says.

“GOhack gives organizations the chance to meet ethical hackers face-to-face and see firsthand how they think and work,” adds Nadine Anderson from GObugfree.

Simon also breaks the cliché of the lone hacker who spends all day in front of a screen: he enjoys family time with his kids and the dog – and for balance, you’ll often find him at the gym.

This article was first published in German on 20min.ch – Author: Verena Edinger