Sold by: HackerOne
Deployed on AWS
HackerOne is the global leader in human-powered security, harnessing the creativity of the world's largest community of security researchers with cutting-edge AI to protect your digital assets. The H1 Platform combines the expertise of our elite community and the most up-to-date vulnerability database to pinpoint critical security flaws across your attack surface. Our integrated solutions, including H1 Bug Bounty, H1 Pentesting, code security audits, spot checks, and AI red teaming, ensure continuous vulnerability discovery and management throughout the software development lifecycle. Trusted by industry leaders such as Coinbase, General Motors, GitHub, Goldman Sachs, Hyatt, PayPal, Snap Inc, and the U.S. Department of Defense, HackerOne was named a Best Workplace for Innovators by Fast Company in 2023 and a Most Loved Workplace for Young Professionals in 2024.
4.5
Overview
The H1 Platform is the leading solution for combining human-powered security testing with advanced AI to safeguard your digital assets. Our platform provides an integrated suite of security solutions that ensure continuous vulnerability discovery and management throughout the software development life cycle. By harnessing the strengths of the world's largest community of security researchers and the latest AI technologies, HackerOne helps organizations reduce their threat exposure and transform their businesses with confidence.
For custom pricing, EULA, or a private contract, please contact AWS-Marketplace@hackerone.com , for a private offer.
H1 Response
- Leading Vulnerability Disclosure Program (VDP) platform
- Streamlines third-party vulnerability reporting
- Integrates with 20+ SDLC systems
- Ensures compliance and collaboration
H1 Pentest
- Methodology-driven security testing
- SaaS-based delivery model
- Curated elite pentester teams
- End-to-end testing process
H1 Code Security Audit
- Premium code review service
- 600+ vetted senior software engineers
- Deep source code analysis
- Early-stage vulnerability detection
H1 Bounty
- Continuous security testing
- The global ethical hacker community
- Performance-based rewards
- Scales with business needs
H1 AI Red Teaming
- Specialized AI system testing
- Expert security advisory support
- Identifies AI-specific vulnerabilities
- Mitigates model risks and biases
H1 Challenge
- Time-bound security testing sprints
- Targeted vulnerability discovery
- Ideal for new releases
- Flexible engagement model
Streamlined integrations and automation: HackerOne offers robust APIs and built-in integrations and automation, simplifying vulnerability management and streamlining workflows.
Managing different programs within our AI-powered platform provides unprecedented insights into your security program's effectiveness while offering the efficiency and ease of a single interface.
Together, these integrated solutions provide indispensable capabilities for organizations. They ensure that vulnerabilities are continuously identified, prioritized, and remediated, providing unmatched protection from code to the cloud.
Learn more about each one of our offerings designed to address specific security challenges with our Defense-in-Depth strategy at https://www.hackerone.com/product/overview
Highlights
- The H1 Platform continuously discovers, validates, prioritizes, and remediates to reduce exposure debt before attackers act. Hai scores and validates at machine speed while a community of elite security researchers surfaces business logic flaws and novel attack chains no automated tool reaches. Confirmed findings route directly into Jira, GitHub, ServiceNow, Azure DevOps, Slack, and Teams through 30+ integrations.
- Hai, HackerOne's agentic AI orchestrator, handles thousands of reports per week at 95% accuracy, improving signal by 40%, and reduces prioritization decisions from hours to seconds. H1 Remediation delivers source code-informed, developer-ready fix plans into your issue tracking tools in one click, or directly to an AI coding agent via MCP. Retests confirm fixes hold. Regression monitoring ensures they stay closed.
- Managing all programs within the H1 Platform gives security leaders a unified view of exposure across the full attack surface. Cross-program dashboards track exposure velocity, remediation speed, and signal quality. Self-serve Return on Mitigation quantifies program value as avoided financial loss, with $32B+ in risk exposure mitigated for customers to date.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
HackerOne Platform | Proven human-powered security testing, enhanced by AI | $500,000.00 |
Dimension | Cost/unit |
|---|---|
Rewards overage fee | $0.01 |
Dimensions summary
This contract listing has two pricing dimensions that work together. You commit to the HackerOne Platform, which delivers human-powered security testing supported by AI. This is the core subscription you buy for a fixed term. The Rewards overage fee is a usage-based add-on. It applies when the rewards you pay to security researchers exceed your committed amount. So one dimension covers your base platform access, while the other charges only if reward payouts run past your commitment. Your total cost scales with how much you pay out in researcher rewards.
Top-of-mind questions for buyers
Rewards are the payments you make to security researchers for valid vulnerabilities they find. Your committed amount covers a set pool of these payouts. The overage fee applies only once your actual reward payments pass that committed pool. It charges the amount that runs beyond your commitment.
The Platform dimension covers your subscription to the security testing service. This includes access to a community of security researchers, AI-assisted triage and validation, vulnerability report management, dashboards, and integrations with your existing tools. Researcher reward payouts are billed separately through the Rewards overage fee, not within this dimension.
Both dimensions bill together on the same contract. The HackerOne Platform is a fixed subscription for your term. The Rewards overage fee grows only when researcher payouts pass your committed pool. Programs that surface many valid vulnerabilities see the overage fee become the variable part of the bill.
www.hackerone.com+1
Helpful?
Vendor refund policy
There are no refund options available.
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
To ensure that you receive timely assistance, it's important to be aware of our Support & Mediation team's business hours. This documentation details when our Support Team is available, how to reach them, and additional resources for self-help outside of these hours.
Support Team Operating Hours Our dedicated Support team is available to assist you during the following hours:
Monday to Friday: Mediation (Customers)
8:00am - 5:00pm PT
Support
12:00am-4:30pm PT
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By HackerOne
By NetSPI
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Vulnerability Discovery and Validation
Continuous discovery, validation, prioritization, and remediation of vulnerabilities across the full attack surface using human-powered security researchers combined with AI-powered analysis
AI-Powered Triage and Prioritization
Hai agentic AI orchestrator processes thousands of reports weekly at 95% accuracy, improves signal by 40%, and reduces prioritization decisions from hours to seconds
Automated Remediation and Fix Generation
Source code-informed, developer-ready fix plans generated automatically into issue tracking tools or directly to AI coding agents via MCP, with automated retests and regression monitoring
Unified Security Program Management
Centralized platform providing cross-program dashboards that track exposure velocity, remediation speed, signal quality, and quantify program value through Return on Mitigation metrics
Penetration Testing Service
Penetration Testing as a Service (PTaaS) platform combining security professionals with AI and automation, delivering 50+ pentest types with streamlined workflows and accelerated remediation.
Attack Surface Management
Continuous visibility into internal and external attack surfaces with capabilities to discover unknown assets, identify exposure gaps, and prioritize remediation based on real-world risk contextualization.
Red Team and Adversary Simulation
Red team engagements simulating real-world adversaries that chain vulnerabilities across identity, application, cloud, and infrastructure layers to demonstrate breach scenarios and measure detection effectiveness.
Specialized Security Teams
Dedicated teams specializing in application, cloud, infrastructure, identity, and mainframe security assessments with proprietary testing frameworks and tooling.
AI-Accelerated Security Workflows
AI-accelerated platform enabling critical security workflows with use case-driven experience to move from findings to fixes faster through automated processes.
AI-Powered Researcher Sourcing
Platform uses data and AI to source and activate security researchers and pentesters across multiple dimensions for continuous vulnerability discovery.
Penetration Testing as a Service
Modern PTaaS suite enabling rapid pen test launches against any target within days with prioritized findings dashboard and DevSec workflow integration.
Automated Triage and Noise Reduction
Core triage competency that rapidly removes false positives and adds context for prioritization, handling critical vulnerabilities within a single day.
Vulnerability Disclosure Program Management
Managed VDP solution providing intake channels, validation, triage, researcher relations, SDLC integration, and reporting for public vulnerability submissions.
Security Knowledge Graph Analytics
Deep analytics engine built on millions of data points about vulnerabilities, assets, and hacker skill sets to drive insights, recommendations, and AI models.
Standard contract
No
No
No
Customer reviews
Zhen Hao L.
Great AI and Support, but Slow Triage Often Misses SLAs
Reviewed on Oct 12, 2026
Review provided by G2
What do you like best about the product?
Hackerone AI and customer support are the best compared to other platform
What do you dislike about the product?
Slow triage.! very slow and many time passed the SLA by months.
What problems is the product solving and how is that benefiting you?
HAI and MCP has been helping us reducing overall time spent managing the program and handling the triage.
Val C.
Incredible for Offensive Security Management
Reviewed on Oct 08, 2026
Review provided by G2
What do you like best about the product?
I really like how H1 Platform eliminates noise thanks to its "suit" system. I also greatly value access to elite talent without having to pay too much. The shielding speed is impressive. Additionally, connecting H1 Platform in native ways was super easy for me.
What do you dislike about the product?
At the moment, I have nothing negative to say; on the contrary, it is a pleasure to work with H1 Platform.
What problems is the product solving and how is that benefiting you?
I use H1 Platform to manage offensive security and detect hard-to-identify threats through automated scans, while eliminating noise and providing access to elite talent without high costs.
Anastasia M.
H1 Quickly Uncovered Critical Vulnerabilities and Streamlined Report Management
Reviewed on Oct 08, 2026
Review provided by G2
What do you like best about the product?
The biggest impact of running a program through H1 is that in the first month it already uncovered critical vulnerabilities that weren’t found in the designated audit.
Also, managing incoming reports and remediations for an open source project can get overwhelming. H1 makes it much easier to keep track of things and make sure nothing slips through the cracks. Specifically, filtering out duplicate reports saves a lot of time for the team.
Also, managing incoming reports and remediations for an open source project can get overwhelming. H1 makes it much easier to keep track of things and make sure nothing slips through the cracks. Specifically, filtering out duplicate reports saves a lot of time for the team.
What do you dislike about the product?
UI can be hard to navigate.
We'd love to see more flexibility around hacker management not only based on performance metric on H1 platform as a whole but also specific to particular program.
We'd love to see more flexibility around hacker management not only based on performance metric on H1 platform as a whole but also specific to particular program.
What problems is the product solving and how is that benefiting you?
1. Getting extra eyes from security researchers to audit the code, and attracting new talent from outside our existing community into the bounty program.
2. Managing reports: making sure they’re reviewed and remediated on time, that nothing gets lost, and handling payments and pricing.
3. Managing communication with hackers and resolving potential conflicts.
Recently, many bounty programs have seen an influx of low-quality, AI-generated reports. When this is paired with agents arguing for the validity of those reports and not taking no for an answer, it can consume a lot of reviewers’ time.
Keeping all communication in one place, strictly within the program guidelines, along with hackers’ reputation and signal metrics and identity verification, makes the process much easier and reduces the noise. The ability to get the H1 team involved to independently remediate any disagreement is helpful as well.
2. Managing reports: making sure they’re reviewed and remediated on time, that nothing gets lost, and handling payments and pricing.
3. Managing communication with hackers and resolving potential conflicts.
Recently, many bounty programs have seen an influx of low-quality, AI-generated reports. When this is paired with agents arguing for the validity of those reports and not taking no for an answer, it can consume a lot of reviewers’ time.
Keeping all communication in one place, strictly within the program guidelines, along with hackers’ reputation and signal metrics and identity verification, makes the process much easier and reduces the noise. The ability to get the H1 team involved to independently remediate any disagreement is helpful as well.
Win G.
Easy-to-Run Pen Tests and High-Value Bug Bounties with H1
Reviewed on Sep 29, 2026
Review provided by G2
What do you like best about the product?
Over the last year, we’ve run a few different programs with H1. One of those was a penetration test to validate new security controls for our login interface. The pen test program was easy to set up, straightforward to pay for, and it was simple to communicate with the researchers assigned to the engagement.
We also get a lot of value from our bug bounty program, which helps us surface some of our most critical, previously overlooked vulnerabilities.
We also get a lot of value from our bug bounty program, which helps us surface some of our most critical, previously overlooked vulnerabilities.
What do you dislike about the product?
The interface can be confusing at times, depending on which program you’re viewing. Until recently, my biggest frustration with the H1 platform was the billing structure around system tiers and committed spend for paying out vulnerabilities. Even if we went just one dollar over, we would have been forced to upgrade to the next tier. On top of that, we couldn’t integrate our SIEM with hackerone because we didn’t have the enterprise tier. This has since been addressed with the new billing plan.
What problems is the product solving and how is that benefiting you?
H1 is an extension of the subject-matter expertise within our organization. We can only protect ourselves from what we already know, and HackerOne helps us identify and better understand the unknowns. The initial triage that HackerOne performs before we validate an issue has been extremely helpful for determining whether a report is legitimate.
Nicola F.
Intuitive Day-to-Day Use with Strong Triage Tools and a Well-Documented API
Reviewed on Sep 29, 2026
Review provided by G2
What do you like best about the product?
My day-to-day experience using it is good and intuitive. They offer a lot of tools that help with triage, and the API is very good and very well documented.
What do you dislike about the product?
In some cases, the way the organization and the program are presented can be quite confusing, but overall it’s all good.
What problems is the product solving and how is that benefiting you?
Well, obviously it detects things that our internal team didn’t see, and it helps our H1 triage team review issues as an extra pair of eyes.