HackerOne
| Company type | Private |
|---|---|
| Industry | Cybersecurity |
| Founded | 2012 |
| Founder | Jobert Abma, Michiel Prins, Alex Rice, Merijn Terheggen |
| Headquarters | San Francisco , United States |
Area served | Global |
Key people | Mårten Mickos (CEO) |
| Products | Vulnerability coordination and bug bounty platform, penetration testing services |
| Website | www |
HackerOne Inc. operates as a cybersecurity firm that focuses on identifying vulnerabilities through assessments performed by accredited information security experts. It was a pioneer in the field of crowd-sourced security by engaging a global community of cybersecurity researchers through bug bounty initiatives and structured vulnerability disclosure programs. By December 2022, HackerOne’s platform had distributed more than $230 million in rewards. Its clientele features notable organizations such as the U.S. Department of State, U.S. Department of Defense, General Motors, GitHub, Goldman Sachs, Google, Microsoft, Nintendo, PayPal, Slack, Twitter, and Yahoo.
History
In 2011, Dutch security researchers Jobert Abma and Michiel Prins discovered weaknesses in the systems of 100 leading technology companies, including Facebook, Google, Apple, Microsoft, and Twitter. Although many companies disregarded their findings, Facebook’s COO Sheryl Sandberg directed them to Alex Rice, who led product security there. Rice then teamed up with Abma, Prins, and Merijn Terheggen to establish HackerOne in 2012. Terheggen resigned as CEO in November 2015 and was replaced by Mårten Mickos.
HackerOne launched the Internet Bug Bounty initiative in November 2013 with backing from Microsoft and Facebook to encourage ethical disclosure of software bugs. By mid-2015, the platform had identified approximately 10,000 security issues and disbursed over $1 million in rewards. In September 2015, the company introduced the Vulnerability Coordination Maturity Model to set baseline protocols for managing unsolicited vulnerability reports. By April 2017, HackerOne experienced a 240% annual increase in European customers and expanded its regional offices to accommodate growing demand.
In April 2022, HackerOne enhanced its vulnerability mitigation capabilities by acquiring PullRequest, a service specializing in code review.
Funding
HackerOne secured $9 million in Series A financing from venture capital firm Benchmark in May 2014. A subsequent Series B round raised $25 million under the leadership of New Enterprise Associates. Notable angel investors include Salesforce CEO Marc Benioff, Digital Sky Technologies founder Yuri Milner, Dropbox CEO Drew Houston, and Yelp CEO Jeremy Stoppelman. In February 2017, a $40 million Series C round led by Dragoneer Investment Group brought total funding to $74 million; European venture fund EQT Ventures also participated. The company raised an additional $36 million in Series D funding led by Valor Equity Partners in 2019, pushing total investments beyond $110 million.
U.S. Department of Defense Programs
The U.S. Department of Defense (DoD) initiated "Hack the Pentagon" on HackerOne’s platform in March 2016. This 24-day challenge revealed 138 security flaws across DoD websites and awarded more than $70,000 to participating researchers.
In October 2016, the DoD implemented its inaugural Vulnerability Disclosure Policy (VDP), which authorized cybersecurity professionals to lawfully identify vulnerabilities within government systems. The policy’s first application was through "Hack the Army," marking the Army’s debut bug bounty program. This effort yielded 118 valid vulnerability submissions from a pool of 371 participants—including government staff and military members—and distributed roughly $100,000 in bounties.
By May 2017, the DoD expanded its efforts with "Hack the Air Force," uncovering 207 vulnerabilities and awarding over $130,000 in bounties. Throughout 2017, these programs collectively identified and resolved thousands of security issues within DoD systems.
In August 2022, Defense Digital collaborated with the U.S. Air Force Research Laboratory, Lawrence Berkeley National Laboratory, and USAG Fort Hunter Liggett to conduct "Hack the Satellite," a live hacking exercise where participants attempted to compromise a satellite launched by NASA.
Events and live hacking
In February 2017, HackerOne organized an exclusive hackathon that brought together security experts from around the globe to uncover weaknesses in e-commerce platforms such as Airbnb and Shopify. This event followed a comparable gathering held during the 2016 Black Hat Security Conference in Las Vegas. Throughout 2018, HackerOne conducted Live Hacking sessions across the United States and Asia, distributing more than $1 million in rewards. Among the highlights, a team from India secured first place with a $1 million payout, while Oath Inc. disbursed upwards of $400,000 in bounties at an event hosted in San Francisco.
October 2017 marked HackerOne’s debut conference, Security@ San Francisco, which attracted 200 participants including keynote speakers from the Department of Defense, General Motors, and Uber, alongside leading figures from the hacker community.
Courses
HackerOne provides an online training program centered on vulnerability detection and cybersecurity methodologies. The company focuses on penetration testing services supported by certifications like ISO 27001 and FedRAMP compliance. This approach distinguishes HackerOne from competitors such as Bugcrowd, which emphasize attack surface management and a wider array of penetration testing across IoT devices, APIs, and network infrastructures.
Locations
The main headquarters of HackerOne is situated in San Francisco, complemented by a development center located in Groningen, Netherlands. In April 2017, the firm broadened its presence by inaugurating offices in both London, UK and Germany.