Espilon Hunt
Break real products. Patch them. Get paid for both.
A closed-door hardware bug hunt: two days on site, up to ten selected teams, real embedded products offered by partner manufacturers (agreements in progress).
Find the vulnerability. Then fix it.
Connected devices and industrial equipment are full of vulnerabilities, and the Cyber Resilience Act already requires reporting of actively exploited vulnerabilities, and fully applies in December 2027. Several bug bounty programs are paused, flooded with invalid reports. Espilon Hunt does something else: real products, broken and fixed, in a closed room where the manufacturer stays in control.
Four steps, one final
Pre-register
Your team of 2 to 4 fills out the form. You are under no obligation.
Selection
Espilon's board picks up to ten teams on application, against published criteria. Every rejection comes with a one-line reason.
Closed-door final
Two days on real hardware. Your first working PoC reserves the vulnerability; your patch is due before the end.
Publication
Each finding goes to the manufacturer after triage. Nothing goes public before its advisory or, failing that, 90 days after the finding is sent, extendable up to a cap set for each target. Then your write-up follows, with your name on it.
Built for people who break hardware
The patch pays
A validated patch earns as much as the discovery. Without a patch, a fixable vulnerability counts for half.
Physical is fair game
Glitching, fault injection, flash dumps: when the manufacturer allows it, physical access is never grounds for a downgrade.
One shared pool
A single pool, funded by at least 70% of manufacturers' fees and by donations, shared in proportion to points. Its floor is to be collected before registration opens, planned for March 2027. No earmarking.
An independent jury
Three jurors, two of them from outside Espilon, named in February 2027.
Your work, your name
Credit in advisories and CVEs. Your tooling and your PoCs stay yours.
Nothing for sale
Vulnerabilities are never sold or transferred. They go to the manufacturer and, for a third-party component, to its vendor.
Two ways in
Researchers and students
Hardware, firmware, RF, fault injection: if you like breaking real devices, pre-register your team. Selection on application. You accept the rules, including a confidentiality undertaking, and nothing more. Free to enter; travel at your own expense (partial support possible for teams from outside the Paris region), lunches provided.
Manufacturers, open source projects, sponsors
Put a product in scope and get a closed-door test, a report and proposed patches, published on your date. Manufacturer fee from €3,500 excl. VAT, at least 70% of which is paid out to researchers through the shared pool; sponsorship from €1,500 excl. VAT, or a donation to the researchers' pool. Full refund if the pilot is canceled or the floor is not reached by March 31, 2027.
Espilon Hunt in one page
The idea, the format, the timeline and how to take part. Send us an email for the full partnership deck.
From now to May 2027
- Nov. 2026 to Feb. 2027Partners and targets
- February 2027Final rules and jury published
- March 2027Applications confirmed
- April 2027Team selection
- May 2027The two-day final
- From late August 2027Publications, after each manufacturer's advisory
Short answers
Who can take part?
Teams of 2 to 4 people, 18 or over: researchers, pentesters, students. Selection is on application only.
What do I win?
Points, turned into money from a single pool funded by at least 70% of manufacturers' fees and by donations, shared in proportion to points. Its floor is to be collected before registration opens, planned for March 2027. A validated patch earns as much as the discovery. In-kind prizes are possible, and you get credit in advisories and CVEs.
What do I sign?
The rules, which include a confidentiality undertaking: until publication, nothing about a vulnerability, the names of the targets or the results per target goes public, and firmware and dumps stay on the bench machines. Your tooling and your PoCs stay yours; the manufacturer gets a non-exclusive license to the patch and the PoC. What you read here is a provisional summary; the final rules come out in February 2027.
Is attacking these products legal?
Yes. Each manufacturer signs a written authorization that sets the scope, including the physical attacks it allows. Open source projects agree to their scope in writing.
When and where?
May 2027, in the Paris region. The exact weekend and the venue will be announced on our Discord. Taking part is free; travel is at your own expense, and lunches are provided during the two days. Partial travel support may be offered to teams from outside the Paris region if the budget allows (announced in April), reimbursed at cost on receipts.
What can I publish afterwards?
After the manufacturer's advisory, your write-up is yours: you can name the product as the advisory does, with your credit in the CVE. Publishing a PoC, or a patch to proprietary code, needs the manufacturer's written agreement.
I'm a beginner. Is this for me?
Yes, if your team is motivated: student teams are selected too, and no CVE is required. Prepare with the hardware courses on Espilon Learn. Even without a finding, you leave with the jury's feedback and a certificate of participation. Finding nothing is not a failure.
Want in?
Pre-registration puts you under no obligation. Partners: one email is enough to start.