HackerOne

🤖 vs 👨💻 The future of hacking is not binary, it’s bionic Finally getting around to sharing this after all the #BlackHatUSA2025 & #defcon33 craziness! Published this Q&A piece last week about the HackerOne Leaderboard updates. We're now distinguishing between individual researchers and AI-driven collectives on our platform, giving everyone a clearer picture of how impact is achieved - whether through solo expertise or collective collaboration. What we're observing: - AI hackbots perform well with deterministic vulnerability classes (XSS, SQLi, Cache Poisoning) - Individual researchers still drive the majority of high-impact, business-critical findings that require creative insight - The most effective approach isn't choosing between AI and humans - it's combining them strategically This evolution reflects our core belief that diversity of approach - human creativity, AI scale, and everything in between - is what makes crowdsourced security so powerful. We're not replacing human hackers; we're amplifying what we can all accomplish. Come check out the rest of the Q&A here: https://lnkd.in/grzsHPbg

AI is making it cheaper to generate vulnerability reports than to validate them. That’s the real problem behind “AI slop”: discovery is accelerating faster than validation, prioritization, and remediation. And when that happens, security teams don’t just get “more findings”… they get less clarity. The question is no longer “will we receive more volume?” It’s “do we have a system that continuously tells us what actually matters?” A recent example: the volunteer-driven cURL project decided to end its bug bounty program after being overwhelmed by low-quality, AI-generated submissions. It’s a sharp reminder that workflow, program design, and agentic capabilities matter more than ever in an AI-driven world. Three practical patterns I’m seeing in programs that scale well right now: 📶 Design for signal: continuously refine scope, clarify expectations, and align incentives to the risks you actually want reported. 🤖 Don’t make humans the first filter: automate dedupe/eligibility/scope checks and route what’s credible. ⚖️ Pair AI scale with human judgment: speed is great, and human judgment gives you accountability. I wrote up a deeper take on this problem and how HackerOne’s enterprise customers leverage our agentic CTEM platform to cut out the slop and continuously surface just the exposures that really matter: https://lnkd.in/gFK8rN6V #BugBounty #CTEM #AppSec #AI

Cybersecurity isn’t suffering from blind spots — it’s suffering from distractions. Finding vulnerabilities is easy. Knowing which ones truly matter is not. Every CISO I meet with is facing the same challenge: How do I separate real exposures from the noise before they turn into incidents? That’s exactly what we’ve built the next evolution of Hai, HackerOne’s agentic system of intelligent agents, to solve. By extending Hai into HackerOne Code and Agentic Pentest as a Service, we’re helping security teams move from a reactive cycle of detection to a continuous rhythm of validation, prioritization, and action. Because progress in security isn’t about finding more risks — it’s about knowing which ones matter. Over the next few weeks, our new series — Intelligence That Strengthens Every Layer of Defense — will explore how AI-driven exposure management is transforming how organizations prove what’s real, faster. Starting here: https://lnkd.in/dMTn83S8 When defenders can trust their intelligence, they can act with confidence. And that’s how security gets stronger — one validated signal at a time. #Cybersecurity #ExposureManagement #SecurityLeadership #HumanIngenuity #TrustByDesign #OffensiveSecurity

Many security teams are about to hit a massive wall, and I am not sure they are realizing it. Finding vulnerabilities isn't the hard part anymore. For the past decade, the security industry optimized for a world where "more findings = winning": more scanners, more dashboards—an era defined by "single panes of glass." And then we wondered why exposure levels didn't go down. It just moved the bottleneck and created a slightly better-lit backlog. Meanwhile, software delivery is heading toward escape velocity (hello, AI-driven development)… while security headcount stays flat and many security teams unequipped to handle what's about to hit them. In that world, a monster backlog is not just inconvenient—it's fatal. The new game isn't about finding; it is about orchestrating security action with confidence on the few exposures that actually matter to the business, and driving them to verified closure. 24/7. That’s what CTEM is really about: a disciplined, continuous loop that turns chaotic signals into measurable exposure reduction. HackerOne's answer, our CTEM platform, is purpose-built for enterprises to quickly deploy and operationalize CTEM while rising far above the wall that the unprepared will smash into. It is a single system for continuous exposure reduction, combining agentic AI and human expert judgment to continuously discover, validate, prioritize, and remediate the real-world exposures that matter. (I’ll drop a link in the comments.) #CTEM #BugBounty #VulnerabilityManagement

More security teams are reevaluating how they validate vulnerabilities as attack surfaces expand and traditional testing methods can miss critical gaps. The Beginners’ Guide to Bug Bounty Programs is here—a practical breakdown of how modern organizations use bug bounties to strengthen security testing, increase coverage, and uncover issues that tools and scheduled assessments often overlook. The guide walks through the fundamentals, key decisions, and what to expect when launching your first program. If you’re exploring new ways to reduce risk and move faster, this is a strong place to start. 📘 Download the guide: https://bit.ly/3KSUuQd

Co-developing products with strategic design partners has always enabled the product team at HackerOne to quickly visualize what a Minimum Lovable Product (MLP) will look like and rapidly refine it to become even more lovable. One particularly special design partner is our own security team. Of course, we drink our own champagne. We affectionately refer to them as Customer Zero. Today, Customer Zero shares a significant milestone achieved through the features and technologies we co-developed. The highlight: 91% accurate automated routing in exposure management, utilizing recent agentic AI capabilities in Hai, Automations, and the newly upgraded Slack integration. Even more remarkable: 64% of all exposures are routed entirely autonomously to the correct remediation owners. This has resulted in substantial time savings for the team, which will be reinvested in strategic product security initiatives. This exemplifies the future of Continuous Threat Exposure Management (CTEM): agentic AI handles routine tasks and the so-called "busy work" that engineers and analysts often describe. Learn more about how we achieved this high-accuracy automation in the new blog by Martzen H.: https://lnkd.in/gmBWmTQx