I wonder if it would be possible to counter this with policy, something like:
> If you receive a credible bribe and report it immediately to X we will report to relevant authorities and provide a bonus equal to the value of the bribe (capped at Y).
> If you receive a credible bribe and report it immediately to X we will report to relevant authorities and provide a bonus equal to the value of the bribe (capped at Y).
If you reported a fraudulent bribe, which was reported to the police there is a risk the briber and you both are arrested.
I see only trouble with this approach.
Just hire good people, treat them right, have sensible audit and monitoring procedures.
It's very difficult.
edit: By which I mean 1) audit your processes and 2) get to know your people.
Processes require good engineering to thrive; people require good management. When you confuse the two, you get problems.
Some will take it as a sign they should poke further your system, or shop around for others paying better.
You wouldn't know how insulting that is before going through a good of paperwork that legally tames your desires.
That's kind of a weird moral take on things. If you don't like the bounties offered then simply don't invest time in the platform looking for things to exploit.
Industries ex software know that since time immemorial.
Prob the software way of solving that is with least privileged access, automatic auditing and approvals.
I wonder why not even security companies are doing that correctly though.
Why should a business care if it gets hacked? It's the users that suffer and they don't have an alternative.
Most people worldwide will take the moral equivalent of a bribe. It may require a sum so large as to be implausible for it to ever happen, but anybody that tells you they wouldn't at least consider illegal activities for life-altering amounts of money is statistically a liar. Millions of people have done and will continue to do it for seemingly trivial amounts of money.
The prisons of your country are full of such people.
Only if you assert that it is only useful if it solves 100% of the cases.
There are other motivations, but money is a big one. If you could block X% for a large value of X (I'd say easily > 50) then you're better off than before, even if some insiders driven by other motivations still remain.
Still your point stands that money is a common factor. However you still have the problem that bribes usually aren't a one time payment but an ongoing thing, so a purely financially motivated adversary would take the total value into account.
Similar to how IT in many large companies nowadays runs internal phishing tests.
That changes the risk/reward, so while every reported bribe is a nice cash bonus, accepting any received bribe becomes significantly riskier, and by 'practicing' bribe reporting it becomes the default reaction.