HackerOne
Marketplace linking 2M security researchers to companies for bug bounty and disclosure.
On the record
Checkpoint: Annual Hacker-Powered Security Report, which will show whether AI-agent reports and payouts are growing or shrinking
The call
HackerOne still runs the biggest bug bounty marketplace, but its last funding round was in 2022 and OpenAI just entered the same territory.
HackerOne runs a marketplace where 2 million security researchers find bugs in software for 1,300 large companies, including one in five Fortune 500 firms. The company has built some staying power by connecting deeply into tools these companies already use, like Jira and ServiceNow, and by earning trust from government agencies like the Pentagon. However, the picture is getting harder. AI tools like OpenAI's new Patch the Planet can now find and fix many bugs automatically, which means fewer bugs need humans to discover them, and other AI companies are building their own security tools that could pull customers away from HackerOne. The one thing that matters most is whether HackerOne's new Platform product, launched in June 2026, can keep customers locked in by managing their entire security workflow, or whether customers will switch to newer AI-powered tools that do the same job faster and cheaper.
Why
01
AI pressure: OpenAI's Patch the Planet. OpenAI's autonomous find-and-patch tool, launching June 2026, could replace the human researchers HackerOne pays to find bugs. Could AI do the core job? Only partly.
02
Bigger players: Microsoft and Google native cloud security tools. Cloud giants building vulnerability scanning directly into Azure and GCP could shrink demand for third-party bounty programs over time. Could a giant copy it? Probably.
03
What protects it. Two million researchers, Jira/ServiceNow/GitHub workflow lock-in, and DoD and UK MoD trust relationships are hard to replicate fast.
What would change this call
HackerOne announces new funding round or valuation event within 12 months. Would show investors still back the marketplace model after 4.5 years without a round.
October 2026 Hacker-Powered Security Report shows flat or declining enterprise retention/payouts. Would indicate H1 Platform pivot is not offsetting AI-driven commoditization.
Named F500 customer publicly adopts OpenAI Patch the Planet in place of HackerOne bounty spend. Would show budget migrating from crowdsourced bounties to autonomous AI remediation.
October 2026 Hacker-Powered Security Report shows flat or declining enterprise retention/payouts. Would indicate H1 Platform pivot is not offsetting AI-driven commoditization.
Named F500 customer publicly adopts OpenAI Patch the Planet in place of HackerOne bounty spend. Would show budget migrating from crowdsourced bounties to autonomous AI remediation.
Key numbers
- 560+ valid bug reports came from AI agents
- $81M paid to researchers, up 13% year over year
- No funding round since $49M Series E
Named risks
- No disclosed funding round or valuation update since January 2022, over 4 years.
- OpenAI and frontier AI labs entering autonomous vulnerability discovery and patching.
- H1 Platform pivot to CTEM only weeks old at evaluation, retention unproven.
- Conflicting third-party headcount and revenue estimates make true scale unclear.
- History of workforce reduction (12% cut in August 2023) signals past financial pressure.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Bugcrowd | contesting | Holds ~32% practitioner mindshare vs HackerOne as of 2026-06-17 per cipherssecurity.com |
| Synack | contesting | Ships agentic AI pentester 'Sara' with strong DoD/FedRAMP presence, as of 2026-06-30 |
| OpenAI | gaining on | Launched autonomous 'Patch the Planet' vulnerability discovery and patching tool, June 2026 |
| Palo Alto Networks / CrowdStrike / Cisco | contesting | Named alongside HackerOne among 15 CTEM vendors as 'Outperformer', 2026-05-21 |
Questions people ask
- Is HackerOne profitable in 2026?
- HackerOne does not disclose profitability as a private company. It laid off 12% of staff (over 50 people) in August 2023 and has not announced a new funding round since its $49M Series E closed January 27, 2022, suggesting capital discipline rather than confirmed profitability.
- Could AI replace HackerOne's bug bounty platform?
- AI is already automating commodity bug-finding: HackerOne's 2025 report cited 560+ valid vulnerability reports from AI agents, and OpenAI launched an autonomous 'Patch the Planet' discovery-and-patching tool in June 2026, directly encroaching on HackerOne's core marketplace function.
- Who is HackerOne's biggest competitor?
- Bugcrowd is HackerOne's closest rival, holding roughly 32% practitioner mindshare as of June 2026 per cipherssecurity.com. Synack also competes directly with its agentic AI pentester 'Sara' and strong DoD/FedRAMP positioning.
- Who owns HackerOne?
- HackerOne is privately held and venture-backed, with no IPO or acquisition to date as of mid-2026. Its last disclosed round was a $49M Series E on January 27, 2022, led by Benchmark with Dragoneer participating.
- What is HackerOne's H1 Platform?
- H1 Platform launched June 2, 2026, unifying agentic AI across vulnerability discovery, validation, prioritization, and remediation, with integrations into Jira, GitHub, ServiceNow, Azure DevOps, and Linear, positioning HackerOne within Continuous Threat Exposure Management.
- Has HackerOne raised money recently?
- No. HackerOne's most recent disclosed funding is a $49M Series E from January 27, 2022, led by Benchmark. As of July 2026, no new round or valuation update has been reported, over four years since that raise.
Timeline
- 2026-06-02HackerOne launches H1 Platform unifying agentic AI for CTEM
- 2026-06OpenAI launches autonomous 'Patch the Planet' vulnerability tool
- 2026-04H1 Validation launches, claims 95% exploitability accuracy
- 2025-12-09Stephanie Furfaro (CRO) and Stacy Leidwinger (CMO) join HackerOne
- 2025-10-02HackerOne reports $81M in bounty payouts over trailing 12 months
- 2025-03-06HackerOne touts new logos: Fiserv, Prudential, Netflix, Anthropic
- 2024-11Kara Sprague becomes CEO, succeeding Marten Mickos
- 2023-08-03HackerOne lays off about 12% of workforce, over 50 people
- 2022-04HackerOne acquires PullRequest, a code-review-as-a-service platform
- 2022-01-27HackerOne closes $49M Series E led by Benchmark
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- HackerOne Launches H1 Platform for Continuous Threat Exposure Management (2026-06-01)
- HackerOne paid $81 million in bug bounties over the past year (2025-10-02)
- Hackers Surpass $300 Million in All-Time Earnings on the HackerOne Platform
- HackerOne lays off 12% workforce as 'one-time event' (2023-08-03)
- AI-driven vulnerability discovery for frontier cybersecurity (2026-05-13)
- HackerOne, Funding, Investors & Team (2026-07-09)
- HackerOne - Overview, News & Similar companies (2026-07-06)
- HackerOne Number of Employees 2026 (2026-06-29)
- HackerOne Appoints Kara Sprague as CEO (2025-02-20)
- HackerOne Expands Executive Team With New Go-To-Market Leaders (2025-12-09)
- H1 Platform Delivers CTEM at AI Scale (2026-06-02)
- Leader in Continuous Threat Exposure Management