Casey Ellis sold his time by the day. That was the whole business he worked in, and it bothered him.
Ellis grew up hacking stuff as a kid, as he has said in a podcast interview. He turned that into a career as a penetration tester and security researcher, then into solutions architecture, sales and security leadership. Along the way he worked with Serg Belokamen at a small consulting firm that sold security testing, one day at a time, at around A$2,000 a day.
Testers could build a public reputation through the bugs they fixed, which helped them win more work.
The discomfort was the model. A client paid for a day whether or not anything serious was found. Meanwhile Facebook and Google had shown a different approach: pay outsiders only when they report real vulnerabilities. Ellis has described the company's original idea as a napkin sketch on a flight.
He and Belokamen joined the Sydney accelerator Startmate and launched Bugcrowd in 2012. The core idea was to pay for results, not hours. There was a second one. Testers could build a public reputation through the bugs they fixed, which helped them win more work.
Then came the move. In 2013 Ellis went to Silicon Valley, because the buyers were there, and he has said the company would not have grown as quickly had it stayed in Sydney. Belokamen stayed in Australia and left. Chris Raethke, whose own Startmate company had failed, joined as a co-founder.
The money followed: a seed round of US$1.6 million led by Rally Ventures in 2013, then US$6 million, US$15 million, US$26 million and US$30 million rounds through 2020, about US$78.7 million in all. Western Union signed on in 2015, and in 2020 National Australia Bank launched a bug bounty with Bugcrowd's help. In 2024 the company bought Informer and in 2025 Mayhem Security.
What Ellis built was less a tool than a marketplace of people. For a founder, the lesson is to look at the invoice you hate sending. If your customers pay you for hours but really want results, the business model itself may be the product.