HackerOne

Ten years of HackerOne Security Research Reports. This one has the biggest number yet.

Researchers earned $89 million through HackerOne bug bounty programs last year, an 18% increase from the year before.

The attack surface is growing. So is the opportunity.

Read on for the details: bit.ly/3TEbpum

You spoke, we listened.

The researcher community asked for more transparency about what’s happening at HackerOne, so we’ll share quarterly updates on what we’ve been working on.

Find out what we’ve been up to in Q2 in the 🧵or read the full blog: bit.ly/4hsrOLv

The numbers are in.

Organizations are sitting on more unresolved vulnerabilities than they realize, and AI discovery is making the backlog grow faster than security teams can close it.

Our 10th annual Security Research Report drops next week, and there’s no denying the demand for ethical security researchers isn't slowing down..

You asked for it, so we built it.

The HackerOne researcher community now has a home on Discord.
Here’s what is waiting for you inside:

🏆 Celebrate your wins (first report, biggest bounty — we want to hear all about it!)
📣 Platform updates and HackerOne news, straight from the source
💬 Real conversation with the wider researcher community

This started with your feedback, and where it goes is up to all of us.

We'd love for you to be part of it. Join us here: discord.gg/F2xUbUnkuQ

And now Anthropic’s Claude Mythos will soon be available in select H1 Platform products.

We’re making frontier cyber AI models and the creativity and adversarial expertise of our security researcher community available to defenders.

Because staying ahead takes both.

To reiterate: HackerOne does not use or permit use of confidential researcher submissions or customer vulnerability data to train, fine-tune, or otherwise improve generative AI models.

Check out the latest announcement: bit.ly/4hnvJYL

@PayPal CISO Shaun Khalfan and HackerOne CEO Kara Sprague discuss why the future of security is continuous, combining AI with the ingenuity of the global security researcher community.

A few thoughts from our co-founder Alex Rice on today’s @OpenAI announcement 👇

🎉 Congratulations to Shrimant More!

Today we're recognizing Shrimant More from the HackerOne India West Club as our Brand Ambassador of the Quarter.

Through impactful community events, mentorship, and a commitment to strengthening connections across the global security researcher community, Shrimant continues to make a lasting impact both locally and around the world.

HackerOne's Brand Ambassador of the Quarter recipients are recognized for their ability to:

🌍 Represent their region while fostering global collaboration
🗓️ Organize events, workshops, and meetups that educate and inspire the community
🚀 Create meaningful impact by growing and strengthening local and global security researcher communities

Thank you, Shrimant, for your leadership, dedication, and passion for bringing the community together. We're proud to celebrate the people helping make the internet safer, one connection at a time.

#TogetherWeHitHarder

Learn more about the Brand Ambassador Program: bit.ly/48KjYYN

That's a wrap on H1-030 in Berlin.

When the world's best security researchers come together, great things happen for everyone.

Thank you, @PayPal, for the partnership. One mission. Keep the internet safe.

You don’t have to be at the event to be part of the program. Check out how to get involved in PayPal's public program here: bit.ly/3SroeHE

An incredible week of creativity, collaboration, and impact from the global security researcher community. Alongside @PayPal, you showed up and delivered.

The work at this event helps keep customer data safe. Congrats to our winners:

MVHs: alexbirsan, 82af5ddffbb795
Exterminator: ahacker1
Eradicator: oag
Eliminators: alexbirsan, 82af5ddffbb795

#H1030 #TogetherWeHitHarder

That’s a wrap on #DEFCON!

Huge thanks to @BugBountyDEFCON and everyone who stopped to meet, chat, and spend time with us this week.

And seeing the H1 logo light up on this year’s badge? Yeah, we loved that. 💖

Until next time, Vegas!

Yesterday at #DEFCON, Shrimant More and Martzen Haagsma shared what happens when you run a bug bounty program on your own bug bounty platform.

Every report from the security researcher community puts our product, workflows, and assumptions to the test.

Sometimes a small bug teaches a platform-wide lesson. That’s exactly the point. 🔥

Day 1 of #DEFCON is down! 🔥

HackerOne’s Dane Sherrets joined “The Future of Bug Bounty: Program Managers’ Perspective,” while Tony Lee took the stage for “Navigating AI-Assisted Submissions.”

Great conversations, sharp perspectives, and plenty more ahead. Bring on Day 2.

HackerOne is proud to be a sponsor of the Bug Bounty Village at DEFCON.

Some of our awesome SMEs will be speaking during the event:

- Dane Sherrets, Security Architect, Emerging Technology, will be moderating The Future of Bug Bounty Program Manager Perspective
- Martzen Haagsma, Security Engineer IV and Shrimant More, Senior Security Analyst will present Eating Our Own Dogfood: Running a Bug Bounty Program on a Bug Bounty Platform
- Tony Lee will be a panelist on Navigating AI-Assisted Submissions

Check out what else is going on at the Bug Bounty Village bit.ly/450ivLH

A bug bounty program is only as good as the researchers who choose to stay in it. @shoptemu built theirs around that principle. 🧵

⏰ One week to go.

If you're heading to DEF CON, make plans to join us at the Hacker Hangout with @tiktok_us and @BugBountyDEFCON.

Meet fellow security researchers, grab exclusive swag, and celebrate the community.

📍 Flight Club, Venetian Grand Canal Shoppes
🗓️ Thurs. Aug. 6 | 6–9 PM

RSVP 👇
bit.ly/4aJhhrt

If you're heading to DEF CON, don't miss this one.

Join HackerOne, @tiktok_us, and @BugBountyDEFCON for an evening of connecting with fellow security researchers, grabbing some exclusive swag, and celebrating the community.

📍 Flight Club, Venetian Grand Canal Shoppes
🗓️ Thurs. Aug. 6 | 6–9 PM

RSVP 👇
bit.ly/4aJhhrt

Congrats @sagitz_ on an incredible find 🎉

Calling all researchers!

@Trip is launching a limited-time campaign that will pay out 2x the usual reward for any High or Critical severity vulnerabilities in scope.

Severity will be confirmed by our triage team based on our published severity rubric and our standard bounty program rules apply.

Lasts from July 13 to July 29.

Visit the program page for more information and to see how to get started: bit.ly/4yBb8YT

Thanks for all the awesome work you do and happy hacking!

Today, HackerOne joins Project Glasswing, Anthropic's controlled-access program for Claude Mythos 5. We'll use it to harden our own security and evaluate it across the full CTEM workflow, including discovery, validation, prioritization, and remediation.

Two things up front, because researchers will ask.

Your reports are not training data. Vulnerability submissions stay where they belong: with the customer and the researcher who found them.

And AI is not replacing the bounty model. In the first 6 months of this year, researchers earned approximately $47M in bounties through HackerOne, up 25% year-on-year. More AI on offense and defense means more code shipped, more attack surface created, more reports filed, and more bounty work.

What we learn from applying Mythos to HackerOne’s internal scope will be shared with the wider community.

Read the announcement. bit.ly/3SW96lx