Who is HackerOne?
HackerOne is a security platform and services provider that enables organizations to manage vulnerability disclosure and bug bounty programs by connecting with a global community of ethical hackers.
- Managed bug bounty and vulnerability disclosure programs (application and infrastructure security)
- Crowdsourced security testing engagements such as penetration tests and attack surface assessments (offensive security)
- Workflow platform for intake, triage, and coordination of security vulnerability reports (vulnerability management)
- Compliance-aligned disclosure and reporting programs for regulatory, trust, and security assurance use cases (governance, risk, and compliance)
- Analytics, integrations, and APIs that connect vulnerability findings into enterprise security and development toolchains (DevSecOps)
Show more
More About HackerOne
HackerOne operates a security platform that enterprises, technology vendors, and public sector entities use to identify and manage software and infrastructure vulnerabilities through coordinated disclosure programs and incentive-based testing. The core model connects customers with vetted security researchers who probe web applications, APIs, mobile apps, cloud environments, and other assets, report findings through the platform, and receive monetary rewards or public recognition based on validated vulnerabilities.
Within enterprise environments, HackerOne is typically implemented as part of a broader vulnerability management and application security strategy. Organizations define in-scope assets, program rules, and disclosure policies, then route researcher submissions into a structured workflow for validation, triage, and remediation. The platform supports integration with development and security tooling (DevSecOps), so validated findings can feed directly into issue trackers, Continuous Integration and Continuous Deployment (CI/CD) pipelines, or Security Information and Event Management (SIEM) systems. This positions HackerOne alongside scanning tools and traditional penetration testing, with a crowdsourced testing layer that targets real-world attack surfaces.
HackerOne’s offerings align with several enterprise security categories, including bug bounty management (offensive security), vulnerability disclosure programs (product and platform security), and managed penetration testing (consulting and services). The company provides program design, triage operations, and customer support services that System Integration Testing (SIT) on top of the platform, enabling security and product teams to outsource or augment internal capabilities for handling incoming reports and coordinating with external researchers. This is used by organizations that must publish disclosure processes for compliance, regulatory expectations, or customer trust commitments.
From a technical perspective, HackerOne’s workflows are built around standardized vulnerability reporting formats, CVSS-based severity scoring, and references to industry taxonomies such as common vulnerability and exposure identifiers where applicable. The platform supports authenticated and unauthenticated testing scopes and can be configured for private, invite-only programs or public programs visible to the wider hacker community. Enterprises can define service-level targets for triage and resolution, align reward structures with severity, and use platform analytics to monitor vulnerability types, remediation times, and coverage across digital assets.
In a directory or marketplace context, HackerOne fits into security testing and assurance, specifically under bug bounty platforms, coordinated vulnerability disclosure services, and crowdsourced penetration testing. It complements, rather than replaces, static and dynamic analysis tools, infrastructure scanners, and internal security engineering teams, providing an additional discovery channel for vulnerabilities that automated tools or scheduled assessments may not detect.
Our description of HackerOne. Updated December 2025.
