HackerOne

HackerOne is a vulnerability coordination and bug bounty platform that connects businesses with penetration testers and cybersecurity researchers.^[1] It was one of the first companies, along with Synack and Bugcrowd, to embrace and utilize crowd-sourced security and cybersecurity researchers as linchpins of its business model; it is the largest cybersecurity firm of its kind.^[1] As of May 2020, HackerOne's network had paid $100 million in bounties.^[2]

History[]

In 2011, Dutch hackers Jobert Abma and Michiel Prins attempted to find security vulnerabilities in 100 prominent high-tech companies. They discovered flaws in all of the companies, including Facebook, Google, Apple, Microsoft, and Twitter. Dubbing their efforts the "Hack 100", Abma and Prins contacted the at-risk firms. While many firms ignored their disclosure attempts, the COO of Facebook, Sheryl Sandberg, passed on the warning to their head of product security, Alex Rice. Rice, Abma and Prins connected, and together with Merijn Terheggen founded HackerOne in 2012.^[1] In November 2015, Terheggen stepped down from his role as CEO and was replaced by Marten Mickos.^[3] In November 2013, the company hosted a program encouraging the discovery and responsible disclosure of software bugs. Microsoft and Facebook funded the initiative, known as the Internet Bug Bounty project.^[4] By June 2015, HackerOne's bug bounty platform had identified approximately 10,000 vulnerabilities and paid researchers over $1 million in bounties.^[5] In September 2015, the company launched a Vulnerability Coordination Maturity Model, which then-policy chief Katie Moussouris described as “an important effort from HackerOne to codify some reasonable minimum standards on how organizations handle incoming, unsolicited vulnerability reports.”^[2] In April 2017, the company announced 240% year-over-year customer growth in Europe, and the subsequent opening of additional European offices to serve increasing customer demand.^[6]

Since the release of the 2019 Hacker Report^[7] two years ago, the HackerOne community has doubled in size to over one million registered hackers. While much of the community is still exploring and learning, there has been a 63% increase in the number of hackers submitting reports in 2020.^[8] That’s a 143% increase since 2018, demonstrating that hackers are growing their skills and expertise as organizations and industries across the globe invest in hacker-powered solutions. Hackers earned $40 million in 2020 alone, contributing to reaching the milestone of $100 million paid out to hackers on the HackerOne platform. Nine hackers have earned over $1 million dollars on the platform since 2019, and one hacker passed the $2 million mark in 2020.^[9]

Funding[]

In May 2014, HackerOne received $9 million (USD) in Series A funding from venture capital firm Benchmark.^[10][11] A $25 million Series B round was led by New Enterprise Associates.^[12] Angel investors include Salesforce CEO Marc Benioff, Digital Sky Technologies founder Yuri Milner, Dropbox chief executive Drew Houston and Yelp CEO Jeremy Stoppelman.^[5][13] A Series C round led by Dragoneer Investment Group netted $40 million in February 2017 for a total of $74 million in investments to date.^[14] In April 2017, European-based venture capital fund EQT Ventures invested in the $40 million Series C funding round.^[6] In 2019, the company raised $36 million in Series D funding led by Valor Equity Partners.^[15]

U.S. Department of Defense Programs[]

In March 2016, the U.S. Department of Defense (DoD) launched an initiative dubbed "Hack the Pentagon" using the HackerOne platform.^[16][17] The 24-day program resulted in the discovery and mitigation of 138 vulnerabilities in DoD websites, with over $70,000 (USD) in bounties paid to participating researchers.^[18]

In October of the same year, DoD developed a Vulnerability Disclosure Policy (VDP), the first of its kind created for the U.S. government. The policy outlines the conditions under which cybersecurity researchers may legally explore front-facing programs for security vulnerabilities. The first use of the VDP launched as part of the "Hack the Army" initiative, which was also the first time this branch of the U.S. military welcomed hackers to find and report security flaws in its systems.^[19][20]

The Hack the Army initiative resulted in 118 valid vulnerability reports; 371 participants, including 25 government workers and 17 military personnel, took part. Approximately $100,000 (USD) in total was awarded to participating researchers.^[21]

In May 2017, DoD extended the program to "Hack the Air Force". This program led to the discovery of 207 vulnerabilities, netting more than $130,000 (USD) in paid bounties. As of the end of 2017, DoD has learned of and fixed thousands of vulnerabilities through their vulnerability disclosure initiatives.^[22]

Events and Live Hacking[]

In February 2017, HackerOne sponsored an invitation-only hackathon, gathering security researchers from around the world to hack e-commerce sites Airbnb and Shopify for vulnerabilities.^[23] This was the second such hackathon, with the company hosting one in Las Vegas in August 2016 during the Black Hat Security Conference.^[24] In 2018, HackerOne hosted Live Hacking events in cities across the US, Asia. Asia (India) represents won the first place win $1 million bounty cash has been awarded to Mohana Rangam .^[25] And over $1 million in bounty cash has been awarded at next events, with Oath Inc. (now called Verizon Media) paying over $400,000 in bounties during a single event in San Francisco, CA in April 2018.^[26]

In October 2017, HackerOne hosted their first conference, called Security@ San Francisco. The 200-attendee event included speakers from DoD, General Motors and Uber and also featured talks from hackers.^[27]

Courses[]

HackerOne like Bugcrowd have an online course to help people find bugs in a security system and other cybersecurity techniques.^[28] Each crowd source security platform will have a different approach and a specific goal they focus on.^[29] HackerOne primarily focuses on penetration testing services with security certifications, including ISO 27001 and FedRAMP authorization. While others in the field, like Bugcrowd, focus on attack surface management and a broad spectrum of penetration testing services for IoT, API, and even network.^[29]

Locations[]

HackerOne is headquartered in San Francisco. The company maintains a development office in Groningen, Netherlands.^[30] In April 2017, the company announced the addition of offices in the UK and Germany.^[6]

See also[]

• Open Source Security Foundation

References[]

Further reading[]

• Hacking For Security and Getting Paid For It. New York Times. October 14, 2015.
• This Hacker Makes An Extra $100,000 A Year As A Bug Bounty Hunter. Business Insider. May 21, 2016.
• Views on Bug Bounty Programs and Ethical Hacking From HackerOne Inc. Chief Executive Officer Marten Mickos. Bloomberg BNA. May 25, 2016.
• Twitter Pays $322,420 to Bug Hunters Under ‘HackerOne’ Program. Indian Express Tech IE. May 28, 2016.
• How HackerOne’s Famous New CEO is Helping Teen Hackers Become Agents of Good, Not Evil. Business Insider. July 1, 2016.
• HackerOne CEO: Every Computer is Subject to Vulnerabilities. CNBC. October 20, 2016.
• The Technologist Convincing the Pentagon to Love Hackers. Christian Science Monitor. October 21, 2016.
• A Look At The Top HackerOne Bounties of 2016. ZDNet. December 6, 2016.
• Hacking The Army. TechCrunch. January 19, 2017.
• Ethical Hackers: A Question of Choice. SC Magazine. January 27, 2017.

External links[]

• Company Website
• Company Profile: Bloomberg
• BugSheet Bug Bounties & Disclosure Programs (Community Curated)