Enough companies hand out bounties to people who catch security vulnerabilities, some just categorize per seriousness but some go far enough to have assessed existing problems and put out a list of them with specific dollar mounts they’re willing to hand out.
I think this is the way to go honestly - creates a community, remain transparent which buys immense trust, and have a pretty neat way to attract talent.
I think at this point it’s a no-brainer that lot of big tech companies are going through a cultural decline, which explains the layoffs. AI is just an excuse for layoffs :)