Is Bugcrowd profitable in 2026?

Bugcrowd has not disclosed profitability. CEO Dave Gerry said in February 2024 that 2023 revenue grew over 40% year over year but had not yet reached $100 million annually, and no profitability figures have been published since.

Who is Bugcrowd's biggest competitor?

HackerOne leads the crowdsourced security category with 10.9% mindshare versus Bugcrowd's 8.9% as of July 2026, per PeerSpot data. Synack is also a close rival, especially in FedRAMP and government-focused pentesting.

Could AI replace Bugcrowd's human bug hunters?

Bugcrowd's own ExploitBench benchmark, launched May 2026 with Carnegie Mellon, found Anthropic's Claude model outperforming OpenAI's GPT-5.5 on Chrome exploit tasks, suggesting frontier AI is already competitive with elite human researchers on some exploit work.

Bugcrowd is privately held and VC-backed, with no IPO filed as of 2026. Dave Gerry has been CEO since November 2022; founder Casey Ellis remains Chairperson and Chief Strategy Officer.

What is Bugcrowd's valuation?

Bugcrowd was valued at roughly $1 billion after its $102 million Series E in February 2024, led by General Catalyst. The company says its November 2025 Mayhem Security acquisition 'nearly doubled' that valuation, implying near $2 billion, though this is unconfirmed by any formal disclosure.

Is Bugcrowd losing market share to HackerOne?

Yes, according to PeerSpot data from June 2026, Bugcrowd's category mindshare fell sharply from 17.4% to 8.9% year over year, while HackerOne held 10.9%, indicating Bugcrowd lost ground in a fragmenting bug bounty market.

Cybersecurity companies · United States

Bugcrowd

bugcrowd.com ↗

Runs a crowdsourced bug bounty and pentesting platform connecting hackers to companies.

Losing its protection

Assessed 21 July 2026 · Evidence as of 21 July 2026

The structural protection is eroding.

On the recordSince 21 July 2026 · Checkable from mid-to-late 2026 · Every call on the record Checkpoint: Mayhem Security integration results and any disclosed RL Environments or ExploitBench revenue

The call

Bugcrowd has real government footholds and fresh AI-data bets, but it's losing mindshare to HackerOne while AI erodes the human-hunter model it built its name on.

Bugcrowd connects companies with security researchers who find software bugs for pay. The company has real advantages: government contracts (FedRAMP approval) and relationships with the Defense Department that are hard to replace. But its core work of finding bugs is becoming automatable, as shown by its own tests proving that AI models like Claude can do the job as well as top human researchers. The company is betting that selling AI training data and human-AI teamwork will grow faster than AI alone replaces human bug hunters, but this new business is brand new with no proven revenue yet.

Why

AI pressure: Frontier AI models (Anthropic Claude, OpenAI GPT-5.5) plus rival Synack's agentic AI pentester. Bugcrowd's own ExploitBench shows frontier models matching elite human hackers on exploit tasks, threatening the core paid-hunter model. Could AI do the core job? Only partly.

Bigger players: HackerOne. HackerOne outranks Bugcrowd in category mindshare, which fell from 17.4% to 8.9% year over year. Could a giant copy it? Probably.

What protects it. FedRAMP authorization and DOD relationships give it government and compliance work that AI tools cannot yet clear on their own.

What would change this call

Bugcrowd discloses RL Environments or ExploitBench revenue, or a frontier-lab partnership, within a funding round or earnings statement. Would show the AI-data pivot is converting into real revenue, not just strategy.
Synack or another AI-native rival announces a marquee federal or enterprise displacement of Bugcrowd. Would show the compliance/FedRAMP moat is being breached by an AI-native challenger.
PeerSpot or similar category-mindshare surveys show Bugcrowd's share stabilizing or continuing to fall next year. Would confirm whether the slide behind HackerOne is reversing or accelerating.

Key numbers

Category mindshare fell from 17.4% to 8.9% (2026)
$102M Series E at ~$1B valuation (Feb 2024)
Revenue estimated $63M to under $100M (2024-2026)

Named risks

Frontier AI models matching or beating elite human researchers on exploit tasks per ExploitBench, June 2026. Severity: high
Category mindshare collapsed from 17.4% to 8.9% year over year as of June 2026. Severity: high
Revenue and headcount figures across third-party trackers vary by 6x to 10x with no disclosed audited numbers. Severity: medium
Mayhem Security integration into core platform still unproven eight months after Nov 2025 deal. Severity: medium
Synack shipped agentic AI pentesting and secured FedRAMP moderate status before Bugcrowd. Severity: medium

Rivals, as read in July 2026

Rival	Direction	Evidence
HackerOne	gaining on	10.9% mindshare vs Bugcrowd's 8.9%, PeerSpot, June 2026
Synack	losing to	Shipped agentic AI pentester Sara in Aug 2025, also got FedRAMP first, Jan 2024
Cobalt	contesting	Reports ~$84M revenue in PTaaS space, comparable to Bugcrowd estimates
Intigriti and YesWeHack	contesting	GDPR-native European rivals often priced cheaper, per 2026 platform comparisons

Questions people ask

Is Bugcrowd profitable in 2026?: Bugcrowd has not disclosed profitability. CEO Dave Gerry said in February 2024 that 2023 revenue grew over 40% year over year but had not yet reached $100 million annually, and no profitability figures have been published since.
Who is Bugcrowd's biggest competitor?: HackerOne leads the crowdsourced security category with 10.9% mindshare versus Bugcrowd's 8.9% as of July 2026, per PeerSpot data. Synack is also a close rival, especially in FedRAMP and government-focused pentesting.
Could AI replace Bugcrowd's human bug hunters?: Bugcrowd's own ExploitBench benchmark, launched May 2026 with Carnegie Mellon, found Anthropic's Claude model outperforming OpenAI's GPT-5.5 on Chrome exploit tasks, suggesting frontier AI is already competitive with elite human researchers on some exploit work.
Who owns Bugcrowd?: Bugcrowd is privately held and VC-backed, with no IPO filed as of 2026. Dave Gerry has been CEO since November 2022; founder Casey Ellis remains Chairperson and Chief Strategy Officer.
What is Bugcrowd's valuation?: Bugcrowd was valued at roughly $1 billion after its $102 million Series E in February 2024, led by General Catalyst. The company says its November 2025 Mayhem Security acquisition 'nearly doubled' that valuation, implying near $2 billion, though this is unconfirmed by any formal disclosure.
Is Bugcrowd losing market share to HackerOne?: Yes, according to PeerSpot data from June 2026, Bugcrowd's category mindshare fell sharply from 17.4% to 8.9% year over year, while HackerOne held 10.9%, indicating Bugcrowd lost ground in a fragmenting bug bounty market.

Timeline

2026-06-02Launched EU Data Residency option on AWS Frankfurt for GDPR compliance
2026-05Launched ExploitBench AI exploit benchmark with Carnegie Mellon
2026-04Established Carahsoft partnership for public-sector distribution
2026-03Achieved FedRAMP Moderate Authorization
2026-01-27Released hacker report: 82% of researchers now use AI, up from 64% in 2023
2025-11-04Acquired Mayhem Security, AI offensive-testing firm, terms undisclosed
2024-10-01Secured $50M debt financing from Silicon Valley Bank
2024-05Acquired UK attack surface management firm Informer
2024-02-12Raised $102M Series E led by General Catalyst at ~$1B valuation
2022-11-08Dave Gerry named CEO, succeeding founder Casey Ellis

Revision history

21 July 2026

First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.

In the same band

Seqrite Meiya Pico NSFOCUS