HackerOne is the world's leading bug bounty and vulnerability disclosure platform, connecting organizations with a global community of 1 million+ ethical hackers. Companies launch bug bounty or vulnerability disclosure programs (VDPs) on HackerOne to crowdsource security testing across their attack surface. HackerOne manages hacker payouts, triage, and reporting — making it the enterprise standard for companies including Microsoft, Google, GitHub, and the US Department of Defense.
Hackerone
Bug bounty and vulnerability disclosure platform.
Best for: Security teams who want to supplement internal testing with external ethical hackers finding vulnerabilities before attackers.
- Custom pricing
4.7/5 ratingEditorial score 93/100hackerone.com
Entry plan
Custom pricing
Visit Hackerone
Opens the official website in a new tab.
Editorial score93/100
The editorial note
What to know about Hackerone
Is it right for you?
Who Hackerone suits
Choose it if
- Security teams who want to supplement internal testing with external ethical hackers finding vulnerabilities before attackers.
Look elsewhere if
- Early-stage companies without a security team to triage reports — start with a vulnerability disclosure policy and dedicated security email before launching a bounty program
What you get
Key features
- Bug bounty program management
- Vulnerability disclosure programs (VDP)
- Managed triage and deduplication
- Hacker reputation system
- Customizable program scopes and rewards
- CNA (CVE numbering authority) services
- Pentest-as-a-Service
- Attack surface management
Works with
Integrations8
What it costs
Pricing
| Plan | Price | What it includes |
|---|---|---|
| Response | Custom pricingBilled monthly | Vulnerability disclosure program (VDP), manage and triage reports |
| Bounty | Custom pricing + rewardsBilled monthly | Bug bounty program with researcher rewards, triage, and management |
| Pentest | Custom pricingBilled monthly | On-demand penetration testing by vetted researchers |
Prices are recorded from the vendor's public pricing page and can change. Check before you buy.
The trade-off
Pros and cons
Pros
- Access to 1 million+ vetted security researchers across all skill domains
- Managed triage service handles duplicate filtering and initial vulnerability validation
- Customizable program scopes and reward tables for controlled security testing
- Public and private program options with reputation-based hacker invitations
- US Department of Defense and major tech companies use HackerOne — proven at scale
Cons
- Bug bounty program costs include both platform fees and hacker payouts — expensive for small companies
- Triage and response overhead is significant without dedicated security staff
- False positive reports require security team time to evaluate
- Results depend on program attractiveness — low rewards attract lower-quality researchers
Quick read
At a glance
- Category
- Cybersecurity & Privacy
- Pricing model
- Subscription
- Entry plan
- Custom pricing
- Free plan
- Not listed
- Free trial
- Not listed
- Website
- hackerone.com
The verdict
Our take on Hackerone
The most trusted bug bounty platform — 1M ethical hackers continuously finding vulnerabilities that internal teams miss.
Keep exploring
More from Cybersecurity & Privacy
Burp Suite
Cybersecurity & Privacy
The industry standard web security testing tool.
Best for: Security professionals and penetration testers who need the most…
- Free plan
4.8/5 ratingRead review
Nmap
Cybersecurity & Privacy
Open-source network scanner and security auditing tool.
Best for: Security professionals and system administrators who need to audit…
- Free plan
4.8/5 ratingRead review
Wiz
Cybersecurity & Privacy
Cloud security platform for visibility and risk reduction.
Best for: Cloud-native companies who need comprehensive cloud security…
- Free trial
4.8/5 ratingRead review