The Bug Bounty Policy is a program incentive that hires individuals or companies to hack them for a price or even exposure to let the company be investigated for their vulnerabilities.  Very few individuals did not care for a high monetary compensation. They wanted more exposure to help build their reputation and get more jobs at each job they succeeded at. Now, the more experienced hacker would ask for a hefty price to do the job. It also varied on the type of company and only received a few number reports than usual. Because this is a fairly new type of system out there there is not a lot of research that proves what is right or wrong. More research definitely has to be done. Lastly, it all depends on the size of the company either large or small to make that decision to spend money and outsource these individuals to help seek what vulnerabilities they have.