What ROI can a bug bounty program deliver?

“A bug bounty program maximizes ROI by directing spending toward valid, high-impact vulnerabilities that actually reduce risk. You can measure this through Return on Mitigation (RoM), a metric that shows how every dollar invested leads to meaningful risk reduction and security improvements, making it easy to justify and track your investment over time.”