A company is expanding its threat surface program and allowing individuals to security test the company’s internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

A bug bounty program is a crowdsourcing initiative where organizations invite independent security researchers to discover and report vulnerabilities in their systems in exchange for monetary rewards or recognition. This aligns perfectly with the scenario described: compensating individuals for finding vulnerabilities in internet-facing applications. Open-source intelligence (OSINT) involves collecting information from publicly available sources, not actively testing systems for vulnerabilities. A red team is an authorized, simulated attack conducted by an internal or external team to test an organization's defenses, typically more comprehensive than individual vulnerability discovery. Penetration testing is a broader term for authorized simulated attacks to evaluate security, but a bug bounty specifically refers to the reward-based, crowdsourced model.