The results from a year-long bug bounty program aimed at the U.S. defense industrial base highlighted more than 400 critical and high-severity vulnerabilities that require patches and/or mitigations. The pilot research project, called the Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP), had almost 300 participants from cybersecurity research firm HackerOne, who piloted the exercise alongside the Department of Defense Cyber Crime Center’s (DC3’s) DoD Defense Industrial Base Collaborative Information Sharing Environment (DCISE), DoD Vulnerability Disclosure Program (DoD VDP), and the Defense Counterintelligence and Security Agency (DCSA). The program examined forty-one (41) networks of participating defense contractors and 348 different systems over the course of the year. This pilot program only investigated a fraction of the DIB sector, and further iterations of the DIB-VDP will be much more expansive. The results of this program give these defense contractors perspective and guidance by which they can mitigate risk and defend against specific attacks. They also offer advice on technical controls that the companies are not compliant with and point them to the industry best practices. Threats to supply-chains and other critical infrastructure have grown exponentially with the onset of the COVID-19 pandemic, and now the Russia-Ukraine conflict. With the Cybersecurity and Infrastructure Security Agency (CISA) now mandating that government agencies and federal contractors disclose vulnerabilities and breaches in a narrow window of time, the DIB-VDP proves that having a long-term coordinated army of ethical hackers is the most efficient method to date.