HackerOne Bug Bounty
Managed bug bounty and vulnerability disclosure programmes.
Vulnerability Management
Penetration testing and bug bounty
Someone friendly finds the holes before someone hostile does.
Addresses 5 stories in our coverage in the last 90 days 8 products that provide it
What it is
Authorised experts test your systems the way an attacker would, either as scheduled penetration tests or continuously through a bug bounty or vulnerability disclosure programme.
How to value it
Scanners find known flaws. People find the logic errors and chained weaknesses that attackers exploit. A disclosure programme also gives outside researchers a legal way to report what they find, instead of it surfacing in the news.
Questions to ask a vendor
- 1Are testers vetted, and are scope and legal authorisation documented?
- 2Is retesting after fixes included?
- 3For bug bounty: how are researchers vetted and how are payouts handled?
- 4Can the results serve as evidence for regulators, for example for DORA threat-led testing?
For your risk register
- Risk
- Exploitable weaknesses in internet-facing applications stay unknown until attacked.
- Control
- Annual penetration tests plus a vulnerability disclosure or bug bounty programme.
- Owner
- Application security lead.
- Measure
- Critical findings open past their deadline.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
HackerOne Pentest
Penetration testing delivered by vetted researchers.
NodeZero
Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.
Intigriti Bug Bounty
Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.
Pentera Platform
Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.
Picus Autonomous Penetration Testing
Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.
SafeBreach Propagate
Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.
YesWeHack Bug Bounty
Bug bounty, vulnerability disclosure and pentest management.
Recent stories it addresses
16 stories in total- 14 Oct 2026An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
AI pentesting agent discovers critical OTP bypass vulnerability on an insurer's production website.
- 7 Oct 2026What Is Agentic Pentesting? What It Proves, and Where It Stops.
Agentic pentesting offers autonomous attack path discovery and exploitation.
- 17 Sept 2026CISO's Expert Guide to Agentic Pentesting for Websites
New guide explores how autonomous AI agents can improve website pentesting speed.
- 14 Sept 2026AI Changed the Exposure Problem. Validation Needs to Change With It.
AI accelerates vulnerability discovery, necessitating new validation methods for defenders.
- 22 Jul 2026Flaws in Passkey Implementation Show Old Attacks Still Work
Microsoft passkey implementation flaws allow old attacks to impersonate privileged users.
- 14 Jul 2026You Don't Have to Run an Exploit to Know If You're Vulnerable
Picus explains TTP chaining to validate exploitability without running live exploits.
- 1 Jul 2026Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival
AI tool Claude Opus 4.7 helped researcher find vulnerability in Front Gate Tickets website.
- 23 Jun 2026The Exploit Doesn't Exist. You Can Still Prove It Works Against You
AI accelerates vulnerability weaponization, outpacing patching and demanding new validation methods.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.