HackerOne Bug Bounty
Managed bug bounty and vulnerability disclosure programmes.
Vulnerability Management
Penetration testing and bug bounty
Someone friendly finds the holes before someone hostile does.
Addresses 15 stories in our coverage in the last 90 days 8 products that provide it
What it is
Authorised experts test your systems the way an attacker would, either as scheduled penetration tests or continuously through a bug bounty or vulnerability disclosure programme.
How to value it
Scanners find known flaws. People find the logic errors and chained weaknesses that attackers exploit. A disclosure programme also gives outside researchers a legal way to report what they find, instead of it surfacing in the news.
Questions to ask a vendor
- 1Are testers vetted, and are scope and legal authorisation documented?
- 2Is retesting after fixes included?
- 3For bug bounty: how are researchers vetted and how are payouts handled?
- 4Can the results serve as evidence for regulators, for example for DORA threat-led testing?
For your risk register
- Risk
- Exploitable weaknesses in internet-facing applications stay unknown until attacked.
- Control
- Annual penetration tests plus a vulnerability disclosure or bug bounty programme.
- Owner
- Application security lead.
- Measure
- Critical findings open past their deadline.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
HackerOne Pentest
Penetration testing delivered by vetted researchers.
NodeZero
Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.
Intigriti Bug Bounty
Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.
Pentera Platform
Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.
Picus Autonomous Penetration Testing
Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.
SafeBreach Propagate
Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.
YesWeHack Bug Bounty
Bug bounty, vulnerability disclosure and pentest management.
Recent stories it addresses
27 stories in total- 13 Nov 2026OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes
OpenAI introduces Daybreak, an AI agent suite for security testing and vulnerability remediation.
- 13 Nov 2026OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools
OpenAI launches AI-powered tools to test web app security and help develop patches.
- 13 Nov 2026OpenAI Launches Two AI Cybersecurity Tools to Automate Penetration Testing and Vulnerability Remediation
OpenAI launches Daybreak Red Team and Daybreak Defense Factory for automated penetration testing and vulnerability
- 12 Nov 2026Picus puts AI agents on the offensive with autonomous pentesting
Picus Security launches autonomous pentesting with AI agents.
- 5 Nov 2026Tobacco company got smoked by leaving secret recipes on a file share
Tobacco company's secret recipes exposed on an unsecured file share during a penetration test.
- 4 Nov 2026Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
Meta paid $1.2M in bug bounties for its Muse AI agent, including $300K for a pre-launch data exposure flaw.
- 3 Nov 2026Novee puts forgotten internet-facing assets through penetration testing
Novee's AI platform adds External Surface Testing to find forgotten internet assets and validate vulnerabilities.
- 3 Nov 2026OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses
OpenAI launches security sprint with Cathedral Systems and increased bug bounties.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.