James Johnson, chief information security officer at Deere & Co., says the 188-year-old agriculture-equipment maker has paid ethical hackers over $1.5 million for spotting vulnerabilities.