Bug Bounty Programs, Hacking Contests Power China's Cyber Offense

This report analyzes how China has built a pipeline from universities, CTFs, and bug bounty programs into state-aligned offensive cyber capabilities, amplified by the RMSV vulnerability disclosure mandate and a strategic shift from Western to domestic exploit contests. It underscores the outsized role of a few top researchers, declining vulnerability submissions to major U.S. vendors following sanctions, and the resulting defensive blind spots (e.g., fewer high-end mobile exploits at Pwn2Own), while outlining China’s dual-track strategy of maintaining offensive focus on international products and strengthening defenses around domestic technologies.