Think of Maryland’s new cybersecurity program as a neighborhood watch for the state’s digital front doors.
Instead of patrolling the streets, volunteer security researchers scour government websites to find and report bugs or other infosec gaps. Since the vulnerability disclosure program (VDP) launched in October 2025, contributors have uncovered more than 200 cybersecurity vulnerabilities to fix.
“We’re embracing the security researcher community to really do the heavy lifting and it’s a huge benefit to taxpayers.”
Steven Kain, the maryland Department of Information Technology
More than 190 unique testers have submitted reports to Maryland’s VDP, according to Steven Kain, the Department of Information Technology’s (DoIT) VDP lead. And if you’re looking for bragging rights, the program maintains a “Hall of Fame” recognizing researchers who consistently report vulnerabilities.
So what motivates people to comb through government websites for free? For some, it’s a sense of civic duty, Kain said, while others are looking to build practical cybersecurity skills.
“What we offer is a very wide scope of real systems,” Kain told Technical.ly. “As long as you keep your research within the rules of engagement, we offer a safe harbor to report to.”
That hands-on experience is especially appealing to college students, Kain said. He’s written recommendation letters for participants across the country who have contributed through the program.
Maryland partnered with cybersecurity platform Bugcrowd to run the VDP. Researchers can submit reports on a range of issues, including algorithmic bias, insecure data storage and cloud security. Each submission must include the affected URL and evidence of the vulnerability.
Bugcrowd validates each report, tracks confirmed vulnerabilities and assigns a severity ranking from one to four. Priority one vulnerabilities — the most critical — require immediate attention.
For example, a priority one risk could allow an attacker to remotely take control of a system.
“There’s been more than a handful that I’m very happy that programs like this were in place,” Kain said, “to find something before a malicious cyber actor does.”
Volunteers help beat the talent shortage
VDPs are already common in the federal government and private sector. Now, more state governments are adopting the approach and asking concerned citizen researchers to thwart bad actors, according to Kain.
“We’re embracing the security researcher community to really do the heavy lifting,” Kain said, “and it’s a huge benefit to taxpayers.”
The state’s VDP also comes as Maryland — and the country — continue to grapple with a cybersecurity talent shortage. In 2023, the state had more than 30,000 cybersecurity job openings.
Moving forward, Kain plans to find new ways to address AI use in the program’s rules. While AI can be a starting point, researchers still need to understand the basic concepts behind what they’re reporting.
Kain said he receives a fair share of “AI slop” submitted to the program.
“Don’t just set your AI off and walk away,” Kain said. “It’s a phenomenal force multiplier and an amazing tool, but the human expertise still needs to be there to understand context and business logic and how applications are supposed to work.”
A catch ‘em all event
The state is also leaning into other crowdsourced models.
In May, Maryland held its second live “bug bounty,” another popular format in the cybersecurity world.
DoIT flew 12 security researchers to Maryland for a 48-hour race to find vulnerabilities across the state’s digital portfolio. Participants were paid for each unique vulnerability they identified.
The Department of War helped popularize bug bounties in the public sector, but big tech companies also offer rewards to ethical hackers. Apple, for example, pays up to $2 million for finding certain flaws.
The state plans to host its next bug bounty in September, according to Kain.
“We found that researchers tended to work together and help each other,” Kain said. “At the end of the day, we got by far the best value out of it.”
