Bug Bounty security related services in the area of Information and Communication Technologies

Provision of security audits via bug bounty activities or vulnerability disclosure programs to the Contracting authority in order to properly screen for potential vulnerabilities in systems with code not accessible to the security researchers (mostly in-house for the Contracting authority) and for open source systems Provision of security audits via …

CPV: 72222300 Information technology services
Place of execution:
Bug Bounty security related services in the area of Information and Communication Technologies
Awarding body:
European Commission, Directorate-General for Digital Services
Award number:
DIGIT/2022/OP/0018

1. Buyer

1.1 Buyer

Official name : European Commission, Directorate-General for Digital Services
Legal type of the buyer : EU institution, body or agency
Activity of the contracting authority : General public services

2. Procedure

2.1 Procedure

Title : Bug Bounty security related services in the area of Information and Communication Technologies
Description : Provision of security audits via bug bounty activities or vulnerability disclosure programs to the Contracting authority in order to properly screen for potential vulnerabilities in systems with code not accessible to the security researchers (mostly in-house for the Contracting authority) and for open source systems
Procedure identifier : a1431494-2e23-48ba-a90f-d2a9e6675d08
Previous notice : 161971-2024
Internal identifier : DIGIT/2022/OP/0018
Type of procedure : Open
Justification for the accelerated procedure :
Main features of the procedure :

2.1.1 Purpose

Main nature of the contract : Services
Main classification ( cpv ): 72222300 Information technology services

2.1.2 Place of performance

Town : Brussels
Country subdivision (NUTS) : Arr. de Bruxelles-Capitale/Arr. Brussel-Hoofdstad ( BE100 )
Country : Belgium

2.1.4 General information

Legal basis :
Regulation (EU, Euratom) 2018/1046
“Note on the Legal Basis: Financial Regulation (EU, Euratom) 2024/2509 will govern the awarded contract. The procedure was launched under Financial Regulation (EU, Euratom) 2018/1046 as legal basis.

5. Lot

5.1 Lot technical ID : LOT-0001

Title : Bug Bounty security related services in the area of Information and Communication Technologies
Description : Provision of security audits via bug bounty activities or vulnerability disclosure programs to the Contracting authority in order to properly screen for potential vulnerabilities in systems with code not accessible to the security researchers (mostly in-house for the Contracting authority) and for open source systems.
Internal identifier : DIGIT/2022/OP/0018

5.1.1 Purpose

Main nature of the contract : Services
Main classification ( cpv ): 72222300 Information technology services

5.1.2 Place of performance

Town : Brussels
Country subdivision (NUTS) : Arr. de Bruxelles-Capitale/Arr. Brussel-Hoofdstad ( BE100 )
Country : Belgium
Additional information :

5.1.2 Place of performance

Town : Luxembourg
Country subdivision (NUTS) : Luxembourg ( LU000 )
Country : Luxembourg
Additional information :

5.1.6 General information

Procurement Project fully or partially financed with EU Funds.
The procurement is covered by the Government Procurement Agreement (GPA) : yes
Information about previous notices :
Identifier of the previous notice : 161971-2024

5.1.10 Award criteria

Criterion :
Type : Quality
Name :
Description : According to the technical evaluation questionnaire published with the procurement documents.
Category of award threshold criterion : Weight (percentage, exact)
Award criterion number : 60
Criterion :
Type : Price
Name :
Description : According to the technical evaluation questionnaire published with the procurement documents.
Category of award threshold criterion : Weight (percentage, exact)
Award criterion number : 40
Category of award weight criterion : Fixed value (total)
Award criterion number : 100
Description of the method to be used if weighting cannot be expressed by criteria :
Justification for not indicating the weighting of the award criteria :

5.1.15 Techniques

Framework agreement :
Framework agreement, without reopening of competition
Information about the dynamic purchasing system :
No dynamic purchase system

5.1.16 Further information, mediation and review

Review organisation : Court of Justice of the European Union -
Information about review deadlines : Within two months of the notification to the plaintiff or, in absence thereof, of the day on which it came to the knowledge of the plaintiff, an action for annulment could be launched. Any request made and any reply from the contracting authority or any complaint for maladministration will have neither the purpose nor the effect of suspending the time-limit for launching an action for annulment or to open a new period for launching an action for annulment.

6. Results

Maximum value of the framework agreements in this notice : 7 679 875 Euro

6.1 Result lot ldentifier : LOT-0001

At least one winner was chosen.
Framework agreement :
Maximum value of the framework agreement : 7 679 875 Euro

6.1.2 Information about winners

Winner :
Official name : Yes We Hack
Tender :
Tender identifier : Tender submitted by single tenderer Yes We Hack (Submission ID 300099333)
Identifier of lot or group of lots : LOT-0001
The tender was ranked : yes
Rank in the list of winners : 1
The tender is a variant : no
Subcontracting : No
Contract information :
Identifier of the contract : DI-08250
The contract is awarded within a framework agreement : no

6.1.4 Statistical information

Received tenders or requests to participate :
Type of received submissions : Tenders
Number of tenders or requests to participate received : 3

6.1 Result lot ldentifier : LOT-0001

At least one winner was chosen.
Framework agreement :
Maximum value of the framework agreement : 7 679 875 Euro

6.1.2 Information about winners

Winner :
Official name : Intigriti SA
Tender :
Tender identifier : Tender submitted by single tenderer Intigriti (Submission ID 300099363)
Identifier of lot or group of lots : LOT-0001
The tender was ranked : yes
Rank in the list of winners : 2
The tender is a variant : no
Subcontracting : No
Contract information :
Identifier of the contract : DI-08251
The contract is awarded within a framework agreement : no

6.1.4 Statistical information

Received tenders or requests to participate :
Type of received submissions : Tenders
Number of tenders or requests to participate received : 3

8. Organisations

8.1 ORG-0001

Official name : Intigriti SA
Size of the economic operator : Large
Registration number : 0660623646
Postal address : Klokstraat 16
Town : Antwerpen
Postcode : 2600
Country subdivision (NUTS) : Arr. Antwerpen ( BE211 )
Country : Belgium
Roles of this organisation :
Procurement service provider
Tenderer
Winner of these lots : LOT-0001

8.1 ORG-0002

Official name : Yes We Hack
Size of the economic operator : Micro, small, or medium
Registration number : 814037214
Postal address : 14 rue Charles V
Town : Paris
Postcode : 75004
Country subdivision (NUTS) : Paris ( FR101 )
Country : France
Roles of this organisation :
Procurement service provider
Tenderer
Winner of these lots : LOT-0001

8.1 ORG-0003

Official name : European Commission, Directorate-General for Digital Services
Registration number : EUCOM
Department : DIGIT.R ­ Change Management and Resources
Postal address : Rue de la Loi 107
Town : Brussels
Postcode : 1040
Country subdivision (NUTS) : Arr. de Bruxelles-Capitale/Arr. Brussel-Hoofdstad ( BE100 )
Country : Belgium
Contact point : Unit DIGIT.R.3 - Procurement and Legal Compliance
Telephone : +32 2 299 11 11
Roles of this organisation :
Buyer

8.1 ORG-0004

Official name : Court of Justice of the European Union
Registration number : CURIA
Postal address : Rue du Fort Niedergrünewald
Town : Luxembourg
Postcode : L­-2925
Country subdivision (NUTS) : Luxembourg ( LU000 )
Country : Luxembourg
Telephone : +352 4303-1
Roles of this organisation :
Review organisation

8.1 ORG-0000

Official name : Publications Office of the European Union
Registration number : PUBL
Town : Luxembourg
Postcode : 2417
Country subdivision (NUTS) : Luxembourg ( LU000 )
Country : Luxembourg
Telephone : +352 29291
Internet address : https://op.europa.eu
Roles of this organisation :
TED eSender
Notice information
Notice identifier/version : 494728bf-5108-49c8-9e73-243220479a57 - 01
Form type : Result
Notice type : Contract or concession award notice – standard regime
Notice dispatch date : 17/06/2025 13:45 +00:00
Languages in which this notice is officially available : English
Notice publication number : 00397463-2025
OJ S issue number : 116/2025
Publication date : 19/06/2025