Hackerone

HackerOne Inc. is a San Francisco-headquartered cybersecurity company that operates a platform pairing a global community of security researchers with software and AI tooling to find, validate and remediate vulnerabilities. It was among the first companies to build a business model around crowd-sourced security, pioneering bug bounty programs and coordinated vulnerability disclosure. Organizations run public or private programs on the platform; researchers submit vulnerability reports, which are triaged and, where valid, rewarded with bounties.

The current product set is marketed as the H1 Platform, positioned around Continuous Threat Exposure Management (CTEM) spanning discovery, validation, prioritization and remediation. Components include H1 Bounty, H1 Agentic Pentest, H1 Continuous Testing, H1 Remediation, H1 Validation and H1 AI Red Teaming (adversarial testing of AI systems mapped to the OWASP LLM Top 10, MITRE ATLAS and the NIST AI RMF), all coordinated by an agentic AI orchestrator called Hai. The company also maintains free and community-facing offerings: a Community Edition giving eligible open source projects free access to the platform for vulnerability submission, and founding membership in the Internet Bug Bounty, a bug bounty program for core internet infrastructure and open source projects funded early on by Microsoft and Facebook. Educational and competitive resources for researchers include the Hacker101 CTF, a program directory, Hacktivity disclosure feeds, reputation and leaderboard systems, and the vetted HackerOne Clear community.

Cited customers over time include the U.S. Department of Defense, U.S. Department of State, General Motors, GitHub, Goldman Sachs, Google, Hyatt, Lufthansa, Microsoft, MINDEF Singapore, Nintendo, PayPal, Slack, Starbucks, Twitter, Yahoo, Dropbox, Shopify and Snap. HackerOne maintains a trust center listing certifications and compliance frameworks including SOC 2 Type 2, ISO 27001, PCI DSS, FedRAMP, GDPR, CCPA, UK Cyber Essentials Plus, and the ISO 29147 and ISO 30111 vulnerability handling standards.

Founding story

In 2011, Dutch hackers Jobert Abma and Michiel Prins set out to find security vulnerabilities in 100 prominent high-tech companies, an effort they called the "Hack 100"; they found flaws in all of them, including Facebook, Google, Apple, Microsoft and Twitter. Many firms ignored their disclosures, but Facebook COO Sheryl Sandberg passed the warning to head of product security Alex Rice. Rice, Abma and Prins connected and, together with Merijn Terheggen, founded HackerOne in 2012. According to co-founder Jobert Abma, the founders moved the business to San Francisco because ambitious funding was easier to secure there; Amsterdam investors were prepared to put in only $2.5 million, whereas the company raised $9 million in its first round in the US.

Business model

HackerOne sells access to its platform and to a vetted researcher community to enterprise and government customers, which fund bug bounty programs, pentests, continuous testing, AI red teaming and remediation workflows. Researchers are paid bounties by customer organizations for valid vulnerability reports, and can also earn stipends for pentest engagements (advertised at up to $5,000 per engagement). Eligible open source projects can use a free Community Edition.

Revenue derives from customer-side subscriptions and services for the H1 Platform's bounty, pentesting, continuous testing, validation, remediation and AI red teaming offerings, with bounty payments flowing from customers to researchers through the platform.

Traction

Public figures include more than $380 million rewarded to researchers and over 1,000 active bug bounty programs on the community site; more than $230 million in bounties paid as of December 2022; over 600,000 bugs found; 1,300+ companies using the platform; and 90% of customers with the Hai AI agent enabled. In the 12 months preceding January 2022 the company said it identified over 17,000 high or critical vulnerabilities for customers, and in the first month after Log4j 612 hackers submitted 2,175 potential vulnerabilities to HackerOne customers. The company reports a 210% increase in AI vulnerability reports in 2025 and states that 25% of findings are actionable.

Latest developments

Current positioning centers on Continuous Threat Exposure Management and AI security, with the Hai agentic orchestrator, H1 Agentic Pentest, H1 Continuous Testing and H1 AI Red Teaming, plus customer deployments such as Snap's use of AI red teaming and Shopify's reported 62% acceleration in validation and triage. Recent publications include the 9th annual Hacker-Powered Security Report and a "Closing the AI Security Gap" research report. Naveen Bhateja has been appointed Chief People Officer.