Companies that lack the resources to run their own bug bounty programs may want to consider a bug bounty as a service program.