Unverified50% confidenceOpinionExact time
经过完整的自动化漏洞挖掘流水线后，真正能通过SRC审核的有效漏洞可能不到初始告警数量的5%-10%
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
8/20/2026
First Seen
Valid until: 11/18/2026
Sources
AI自动挖漏洞真能躺赚？理性看待SRC白帽挖洞的真相
Related Claims
UnverifiedLegitimate vulnerability discovery must be conducted within company-authorized SRC platforms or explicitly permitted scopes; any penetration testing against unauthorized systems constitutes illegal activity.66% similarUnverifiedMost domestic SRC platforms classify vulnerabilities into four levels—critical, high, medium, and low—and at certain leading internet companies, a single critical vulnerability can yield rewards of tens of thousands of yuan, while low-severity vulnerabilities may only receive point rewards of a few dozen to a few hundred yuan.62% similarUnverifiedAccording to statistics from security firms including Mandiant, the average time from public vulnerability disclosure to exploitation in the wild has shrunk from weeks to days, with some high-severity vulnerabilities being exploited on the day of disclosure.62% similarVerifiedIn the field of cybersecurity, analysts in Security Operations Centers (SOCs) face thousands of alerts every day, and fewer than 10% are typically investigated.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/777167API
curl https://kongchang.com/api/v1/knowledge/claims/777167MCP
get_claim(id=777167)