The Crowdsourced Advantage
The Crowdsourced Advantage
By Julian Brownlow Davies | Meaning In the Signal, Week 10 | 22 June 2026
Consider two findings that land on a security team’s desk in the same week. The first comes from an automated scanner: an instance of a known vulnerability class, correctly identified, accurately categorised, and reported with a severity score derived from a standardised framework. The second comes from a human researcher: a chained sequence of individually unremarkable weaknesses that, taken together and in this particular environment, lead to the one system the organisation most needs to protect. The scanner has told you that a door is unlocked. The researcher has told you that this specific unlocked door, combined with a misconfigured corridor and an assumption nobody thought to question, leads directly to the vault.
Both findings are true. Only one of them carries meaning, and the difference between them is the subject of this essay.
I have argued across this series that the constraint in modern security is no longer detection but comprehension, and that the industry has systematically misread a meaning problem as a volume problem. The crowdsourced model of security testing is, I believe, one of the clearest illustrations of what it looks like to invest in the constraint that actually matters. But the argument is routinely made badly, and made badly it collapses into vendor rhetoric, so I want to make it carefully, because the case for crowdsourcing rests on something considerably more interesting than the claim that humans are cleverer than machines.
A Thousand Scanners Is Not a Crowd
The instinctive way to describe crowdsourced security is quantitative. More testers, more coverage, more eyes on the problem, and therefore more findings. This framing is not wrong, exactly, but it misses the thing that makes the model work, and in missing it invites the obvious rebuttal: if the value is scale, then automation scales more cheaply, and the human crowd is simply an expensive way to buy volume that a scanner delivers for the marginal cost of compute.
The rebuttal is correct on its own terms, and it is why the quantitative framing loses the argument. The value of a crowd is not volume. It is variance.
A scanner, however many instances of it you deploy, runs the same logic against every target. Ten thousand copies of a scanner are not ten thousand perspectives; they are one perspective executed ten thousand times, and the ten-thousandth execution surfaces nothing the first did not. What a scanner cannot do is bring a genuinely different way of seeing the problem to bear, because its way of seeing is fixed at the point it was written. It encodes the assumptions, the heuristics, and the blind spots of its authors, and it reproduces them faithfully at scale.
A crowd of human researchers is the opposite kind of object. Its value lies in the fact that no two members approach the target the same way. One researcher thinks in terms of authentication flows because that is where they have spent their career; another has an instinct for race conditions; a third has an almost pathological interest in the assumptions that developers make about trusted input. The scientific literature on this is more developed than the security industry tends to acknowledge. Scott Page’s work on cognitive diversity makes the case, and formalises it in a way that surprises people when they first encounter it, that under the right conditions a diverse group of moderately capable problem-solvers will outperform a more uniform group of individually superior ones - a result whose full generality is disputed, though the direction of it survives the dispute. James Surowiecki’s account of collective intelligence identifies the conditions under which crowds produce good judgement - diversity of perspective, independence of individual contribution, and a mechanism for aggregating what the crowd surfaces - and the crowdsourced security model, at its best, satisfies all three. Anita Woolley and Thomas Malone’s research at MIT found that the measurable collective intelligence of a group correlates not with the average intelligence of its members but with the diversity and social dynamics of the group itself.
None of this is an argument about headcount. It is an argument about the shape of the intelligence you apply to an adversarial problem, and it explains why a model built on human variance can find what a model built on automated volume structurally cannot.
But variance only settles the question of who in the population is capable of seeing a given flaw. It says nothing about whether they will do the patient, frustrating, largely unrewarded work required to find it, and that is the second half of the argument, and in some respects the more powerful half.
Motivation Is the Other Engine
The economics of the crowdsourced model are adversarial by design. Researchers are rewarded for what they find rather than for the hours they spend, and the reward accrues, for the most part, to whoever gets there first. A flaw someone else has already reported is worth little or nothing, which means the incentive is not simply to find vulnerabilities but to find the ones nobody else has found yet. That single feature does something no salaried testing arrangement and no automated pipeline reproduces: it pushes the whole population away from the obvious and toward the frontier, because the obvious has already been claimed by the time most people reach it. Competition turns what would otherwise be wasteful duplication of effort into a collective search that strains, continuously and without any central instruction, toward the novel.
This is why the competitive crowd is, in a sense I consider badly underappreciated, a market that prices meaning. A scanner surfaces every instance of a vulnerability class with equal enthusiasm, because it has no gradient pulling it toward the finding that matters more. A competitive crowd has that gradient built directly into its incentive structure. The high-impact, non-obvious, chained finding is worth more, and confers more standing, than the commodity one, and so the effort of the population flows toward the findings that carry the most meaning without anyone having to direct it there. Some of the motivation is intrinsic, the curiosity and the satisfaction of the hunt that draw people to this work before any reward is on the table; some of it is the sharper, more competitive pull of money and reputation and the sting of being second. Both matter, and it is the combination that sustains a depth and persistence of adversarial attention that neither a scanner nor a fixed team of paid testers reliably produces.
Meaning Lives Where the Knowledge Is Dispersed
There is a deeper reason the crowd carries meaning, and it takes us back to an idea from well outside security. In 1945, Friedrich Hayek wrote an essay on the use of knowledge in society, arguing that the knowledge a system needs to function well is never held centrally in complete form but exists as dispersed, local, often tacit understanding held by the individuals closest to each particular circumstance. His subject was economic planning, but the observation travels, and it travels directly to the question of where meaning in security comes from.
The meaning in a security finding is contextual. It is the knowledge that this asset carries disproportionate strategic value, that this authentication pattern is used in an unusual way in this environment, that this class of assumption tends to break in organisations of this shape. That knowledge is dispersed across a population of researchers who have, between them, spent an enormous number of hours living inside particular technologies, particular products, and particular problem domains. A researcher who has poked at a specific category of application for years carries a working model of how that category tends to fail that no central scanner encodes, because the scanner’s authors did not know it either. The crowd is a mechanism for bringing dispersed, local, hard-to-codify knowledge to bear on a specific target, and that is a different and more valuable thing than coverage.
This is what people mean, or should mean, when they say human researchers bring intent and creativity to the work. Intent is not a mystical property. It is the application of a mental model - of the target, of the adversary, of what would matter if it broke - to the interpretation of what is found. A scanner has no model of what matters to your organisation. It cannot, because meaning of that kind is not a property of the vulnerability; it is a property of the relationship between the vulnerability and the environment, and only something that understands the environment can supply it.
The Old Idea, Stated Honestly
The security world has a folk version of this argument already, in Eric Raymond’s much-quoted line that given enough eyeballs, all bugs are shallow. The line has been repeated so often that its actual content has worn smooth, and it is worth recovering, because the emphasis usually falls on the wrong word. The operative term is not “enough”. It is “eyeballs” - and, implicitly, whose eyeballs, attached to what kind of mind, motivated in what way.
Enough undifferentiated attention does not make bugs shallow. Enough diverse and motivated attention does - the two properties this essay has been describing - because diversity ensures the population contains someone whose way of seeing matches the shape of the flaw, and motivation ensures that someone keeps looking after the obvious findings are exhausted. The history of open-source security offers an uncomfortable counter-example to the naive reading: Heartbleed sat in OpenSSL, some of the most widely deployed and in principle most widely inspected code in the world, for roughly two years before anyone surfaced it, which is what the law in its lazy form says should not happen. Eyes in principle are not eyes in practice, and undifferentiated attention is not the diverse, motivated attention the aphorism quietly assumes.
What the Model Is Not
I said I would make this argument carefully, and making it carefully means naming what the crowdsourced model does badly, because an argument that only lists advantages is advocacy rather than analysis, and it deserves to be disbelieved.
The model generates its own version of the meaning problem this series has been describing. A crowd produces volume as well as variance, and much of that volume is duplicate, low-value, or noise, which means the crowdsourced model imports precisely the signal-management burden it is supposed to relieve. The work of separating the meaningful finding from the flood of the mundane does not disappear when the finders are human; it moves, and if it is not deliberately resourced it recreates the alert fatigue of the SOC in a new location. An open crowd is uneven in quality, variable in rigour, and requires real investment in triage, validation, and the management of the human relationships that keep good researchers engaged. None of this is fatal to the argument. All of it is fatal to the lazy version of the argument, which treats the crowd as a free source of meaning rather than as a model whose advantage in cognitive diversity comes with real and specific costs.
The honest claim is narrower and stronger than the promotional one. It is that the unit which carries meaning in security is the diverse, motivated, context-rich human mind, and that any model which industrialises the application of that kind of mind to an adversarial problem holds a structural advantage over a model which industrialises the production of signal. The advantage is real. It is also not automatic, and it is not free.
The Shape of the Advantage
The reason this matters for the argument of the series is that it clarifies what we are choosing between. The dominant investment pattern in security treats the problem as one of coverage: find more, scan more, detect more, on the assumption that the gap is in what we can see. The crowdsourced model, understood properly, is a bet on the opposite proposition - that the gap is in comprehension, and that the scarcest and most valuable input is not another source of signal but a genuinely different intelligence capable of extracting meaning from it.
That bet does not resolve into a product or a purchase. It resolves into a question about where an organisation believes its constraint lies, and it is the same question this series has been circling from the beginning. If you believe the problem is that you are not finding enough, you will invest in volume, and volume is exactly what automation supplies most cheaply. If you believe the problem is that you cannot make sense of what you already find, you will invest in diversity of intelligence, and a crowd of human researchers is one of the few mechanisms we have that supplies it at scale. The advantage is not that the crowd is larger. It is that the crowd is different, and difference, in a comprehension-constrained world, is the thing worth paying for.
The next time a finding lands on your desk that made you see your own environment differently - that reframed what you thought you understood about where your risk actually lives - ask yourself what kind of intelligence produced it, and whether any amount of the intelligence you are currently buying at scale could have produced the same thing.