What are the downsides to using bug bounties?

Costs spiral out of control quickly and you can end up overpaying for insight that doesn’t match your risk profile. Bounty seekers are usually looking for the quickest payday rather than your most critical issues. They are operating with the same fog of war as an attacker but won’t be as ruthless in applying techniques outside of the rules of engagement that an attacker would not hesitate to use, like social engineering to gain access to internal assets.