DOD expands vulnerability disclosure program, giving hackers more approved targets - CyberScoop

Better to pay for the bug ourselves and learn how the exploit occurred.

SSG Robert Mark Odom Excellent Real World Testing Tool and Recruiting Tool.

This is a common-sense approach. Have to admit I am a little surprised to see it implemented for just that reason, but... yep. Larger private tech companies used to do this regularly; I assume they still do. These plus the classic "honeypots" would be powerful tools for finding our what your weaknesses are before they can be exploited.