Study: Bug bounty programs provide strong value for vendors