. @CurrentJen tops the list of people who have enabled me to grow as a person & professional. She’s the best person to strategically work towards company goals while effortlessly handling the gnarliest security crisis comms. Hire Jen Wood if you “take security very seriously.”

When I testified before US Congress about the Uber data breach when they misused their bug bounty program to pay off data thieves, I didn’t think I would have to update my core guidance to include this: Don’t let extortionists set your bounty reward price. Coinbase was *right* not to pay extortion, but putting up a “reward pool” for the same $20M amount is ultimately going to lead future criminals to groom more minors to commit crimes & turn them in to reap the rewards. Defense cannot pay the same as offense or you create perverse incentives. In this case, it’s just adding steps to exploit a company for huge sums, not an effective deterrent. It’s tempting to flex with huge rewards, but the disruption to criminals is negligible & ultimately increases the cost to protect customers. Cryptocurrency exchanges & others should consult with us on complex situations like this. You know where to find us: @LutaSecurity