[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:penetration-testing":3},{"control":4,"products":25,"stories":87,"lessons":131,"related":156,"compare":168},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.","Authorised experts test your systems the way an attacker would, either as scheduled penetration tests or continuously through a bug bounty or vulnerability disclosure programme.","Scanners find known flaws. People find the logic errors and chained weaknesses that attackers exploit. A disclosure programme also gives outside researchers a legal way to report what they find, instead of it surfacing in the news.",[11,12,13,14],"Are testers vetted, and are scope and legal authorisation documented?","Is retesting after fixes included?","For bug bounty: how are researchers vetted and how are payouts handled?","Can the results serve as evidence for regulators, for example for DORA threat-led testing?","Risk: exploitable weaknesses in internet-facing applications stay unknown until attacked. Control: annual penetration tests plus a vulnerability disclosure or bug bounty programme. Owner: application security lead. Measure: critical findings open past their deadline.",[17,18,19,20],"NIS2 Art. 21(2)(f): assessing the effectiveness of measures","DORA Art. 24 to 26: resilience testing and threat-led penetration testing","CIS Control 18: penetration testing","ISO\u002FIEC 27001:2022 A.8.29: security testing",{"name":22,"slug":23},"Vulnerability Management","vulnerability-management","2026-10-16T12:48:08.297065+00:00",[26,34,39,47,55,63,71,79],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png","bug-bounty","HackerOne Bug Bounty","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fbug-bounty-platform","Managed bug bounty and vulnerability disclosure programmes.",{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":35,"product_name":36,"url":37,"description":38},"pentest","HackerOne Pentest","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fpentest","Penetration testing delivered by vetted researchers.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":43,"product_name":44,"url":45,"description":46},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png","nodezero","NodeZero","https:\u002F\u002Fhorizon3.ai\u002Fnodezero\u002F","Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"intigriti","Intigriti","\u002Fvendor-logos\u002Fintigriti.png","intigriti-bug-bounty","Intigriti Bug Bounty","https:\u002F\u002Fwww.intigriti.com\u002F","Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"yeswehack","YesWeHack","\u002Fvendor-logos\u002Fyeswehack.png","yeswehack-bug-bounty","YesWeHack Bug Bounty","https:\u002F\u002Fwww.yeswehack.com\u002F","Bug bounty, vulnerability disclosure and pentest management.",{"total":88,"last_days":89,"recent":90},27,15,[91,96,101,106,111,116,121,126],{"slug":92,"title":93,"published_at":94,"brief":95},"openai-s-daybreak-brings-ai-agents-to-security-testing-and-vulnerability-fixes-ab3f19","OpenAI’s Daybreak brings AI agents to security testing and vulnerability fixes","2026-11-13T09:31:07+00:00","OpenAI introduces Daybreak, an AI agent suite for security testing and vulnerability remediation.",{"slug":97,"title":98,"published_at":99,"brief":100},"openai-unveils-daybreak-red-team-defense-factory-security-tools-c8a0f9","OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools","2026-11-13T09:21:01+00:00","OpenAI launches AI-powered tools to test web app security and help develop patches.",{"slug":102,"title":103,"published_at":104,"brief":105},"openai-launches-two-ai-cybersecurity-tools-to-automate-penetration-testing-and-v-30efb4","OpenAI Launches Two AI Cybersecurity Tools to Automate Penetration Testing and Vulnerability Remediation","2026-11-13T07:16:36+00:00","OpenAI launches Daybreak Red Team and Daybreak Defense Factory for automated penetration testing and vulnerability",{"slug":107,"title":108,"published_at":109,"brief":110},"picus-puts-ai-agents-on-the-offensive-with-autonomous-pentesting-669430","Picus puts AI agents on the offensive with autonomous pentesting","2026-11-12T15:05:02+00:00","Picus Security launches autonomous pentesting with AI agents.",{"slug":112,"title":113,"published_at":114,"brief":115},"tobacco-company-got-smoked-by-leaving-secret-recipes-on-a-file-share-fce20f","Tobacco company got smoked by leaving secret recipes on a file share","2026-11-05T16:02:00+00:00","Tobacco company's secret recipes exposed on an unsecured file share during a penetration test.",{"slug":117,"title":118,"published_at":119,"brief":120},"meta-shares-top-muse-bug-bounty-findings-as-payouts-reach-1-2-million-107c99","Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million","2026-11-04T08:27:05+00:00","Meta paid $1.2M in bug bounties for its Muse AI agent, including $300K for a pre-launch data exposure flaw.",{"slug":122,"title":123,"published_at":124,"brief":125},"novee-puts-forgotten-internet-facing-assets-through-penetration-testing-317162","Novee puts forgotten internet-facing assets through penetration testing","2026-11-03T14:00:26+00:00","Novee's AI platform adds External Surface Testing to find forgotten internet assets and validate vulnerabilities.",{"slug":127,"title":128,"published_at":129,"brief":130},"openai-launches-new-security-sprint-to-hunt-vulnerabilities-and-strengthen-defen-810a33","OpenAI Launches New Security Sprint to Hunt Vulnerabilities and Strengthen Defenses","2026-11-03T05:17:26+00:00","OpenAI launches security sprint with Cathedral Systems and increased bug bounties.",[132,136,140,144,148,152],{"slug":133,"title":134,"published_at":135},"ai-powered-tools-aim-to-close-the-gap-between-vulnerability-discovery-and-remediation","AI-Powered Tools Aim to Close the Gap Between Vulnerability Discovery and Remediation","2026-11-13T10:21:46.443+00:00",{"slug":137,"title":138,"published_at":139},"ai-powered-security-testing-tools-raise-the-bar-for-automated-vulnerability-management","AI-Powered Security Testing Tools Raise the Bar for Automated Vulnerability Management","2026-11-13T10:21:28.79+00:00",{"slug":141,"title":142,"published_at":143},"ai-driven-autonomous-pentesting-enters-the-enterprise-security-toolkit","AI-Driven Autonomous Pentesting Enters the Enterprise Security Toolkit","2026-11-12T16:21:01.655+00:00",{"slug":145,"title":146,"published_at":147},"secret-recipes-exposed-on-unsecured-internal-file-share","Secret Recipes Exposed on Unsecured Internal File Share","2026-11-05T17:21:49.094+00:00",{"slug":149,"title":150,"published_at":151},"metas-12m-bug-bounty-highlights-pre-launch-ai-security-gaps","Meta's $1.2M Bug Bounty Highlights Pre-Launch AI Security Gaps","2026-11-04T09:20:44.709+00:00",{"slug":153,"title":154,"published_at":155},"forgotten-internet-facing-assets-create-exploitable-blind-spots","Forgotten Internet-Facing Assets Create Exploitable Blind Spots","2026-11-03T15:21:42.422+00:00",[157,160,164],{"slug":23,"name":158,"problem":159},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":161,"name":162,"problem":163},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":165,"name":166,"problem":167},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"hackerone\u002Fbug-bounty":169,"hackerone\u002Fpentest":181,"intigriti\u002Fintigriti-bug-bounty":186,"yeswehack\u002Fyeswehack-bug-bounty":193,"safebreach\u002Fsafebreach-propagate":200,"pentera\u002Fpentera-platform":210,"horizon3-ai\u002Fnodezero":220,"picus-security\u002Fpicus-autonomous-penetration-testing":231},{"hq_country":170,"also_provides":171,"reviews":172,"affected":179,"reported":180},"US",[],[173,176],{"label":174,"url":175},"PeerSpot: HackerOne user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fhackerone-reviews",{"label":177,"url":178},"Gartner Peer Insights: HackerOne user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fhackerone",0,1,{"hq_country":170,"also_provides":182,"reviews":183,"affected":179,"reported":180},[],[184,185],{"label":174,"url":175},{"label":177,"url":178},{"hq_country":187,"also_provides":188,"reviews":189,"affected":179,"reported":179},"BE",[],[190],{"label":191,"url":192},"Gartner Peer Insights: Intigriti user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fintigriti",{"hq_country":194,"also_provides":195,"reviews":196,"affected":179,"reported":179},"FR",[],[197],{"label":198,"url":199},"Gartner Peer Insights: YesWeHack user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fyeswehack",{"hq_country":170,"also_provides":201,"reviews":203,"affected":179,"reported":179},[202],{"slug":165,"name":166},[204,207],{"label":205,"url":206},"CSO Online: Buyer’s guide: Breach and attack simulation (BAS) tools (2024)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F2132289\u002Fbreach-and-attack-simulation-tools.html",{"label":208,"url":209},"Gartner Peer Insights: SafeBreach Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsafebreach-platform",{"hq_country":170,"also_provides":211,"reviews":213,"affected":179,"reported":179},[212],{"slug":165,"name":166},[214,217],{"label":215,"url":216},"Gartner Peer Insights: Pentera Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpentera-platform",{"label":218,"url":219},"PeerSpot: Pentera user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpentera-reviews",{"hq_country":170,"also_provides":221,"reviews":223,"affected":179,"reported":230},[222],{"slug":165,"name":166},[224,227],{"label":225,"url":226},"Gartner Peer Insights: NodeZero user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fnodezero",{"label":228,"url":229},"PeerSpot: The NodeZero Platform by Horizon3.ai user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fthe-nodezero-platform-by-horizon3-ai-reviews",12,{"hq_country":170,"also_provides":232,"reviews":234,"affected":179,"reported":242},[233],{"slug":165,"name":166},[235,238,241],{"label":236,"url":237},"Gartner Peer Insights: Picus Security Validation Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpicus-security-validation-platform",{"label":239,"url":240},"PeerSpot: Picus Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpicus-security-reviews",{"label":205,"url":206},4]