HackerOne

What do you like best about the product?

HackerOne’s UI, its integration with their proprietary artificial intelligence agent (HAI) to help analyze incoming reports, and—most importantly—its customer success team all contribute to a strong overall experience on the platform. Another thing that makes the platform stand out is the community of hackers and researchers that HackerOne has grown over the years. Every hacker we’ve interacted with so far has been helpful, open to communication, and willing to retest issues we’ve found, which makes the community genuinely easy to work with. The ability to connect our workflow to external platforms via APIs also helps us strengthen validation and stay on top of new reports as they come in. Overall, it has been a great experience.

What do you dislike about the product?

The recent rise in AI-assisted pentesting has led to a large increase in the number of new reports being submitted to the platform overall, which in turn has increased triage times. This isn’t an issue with the platform itself, but it has resulted in longer SLA times. Over the past few months, the HackerOne team has been addressing this by adding more automated validations using their AI agents, with the goal of getting triage times back to being faster.

What problems is the product solving and how is that benefiting you?

Having more people looking at our company’s overall environment and actively testing it helps us uncover vulnerabilities faster. That means we can address issues sooner and protect the environment before real attackers have a chance to find and exploit those weaknesses. To me, that’s the biggest thing HackerOne offers, and the greatest benefit of using the platform.

What do you like best about the product?

Hackerone AI and customer support are the best compared to other platform

What do you dislike about the product?

Slow triage.! very slow and many time passed the SLA by months.

What problems is the product solving and how is that benefiting you?

HAI and MCP has been helping us reducing overall time spent managing the program and handling the triage.

What do you like best about the product?

I really like how H1 Platform eliminates noise thanks to its "suit" system. I also greatly value access to elite talent without having to pay too much. The shielding speed is impressive. Additionally, connecting H1 Platform in native ways was super easy for me.

What do you dislike about the product?

At the moment, I have nothing negative to say; on the contrary, it is a pleasure to work with H1 Platform.

What problems is the product solving and how is that benefiting you?

I use H1 Platform to manage offensive security and detect hard-to-identify threats through automated scans, while eliminating noise and providing access to elite talent without high costs.

What do you like best about the product?

The biggest impact of running a program through H1 is that in the first month it already uncovered critical vulnerabilities that weren’t found in the designated audit.

Also, managing incoming reports and remediations for an open source project can get overwhelming. H1 makes it much easier to keep track of things and make sure nothing slips through the cracks. Specifically, filtering out duplicate reports saves a lot of time for the team.

What do you dislike about the product?

UI can be hard to navigate.

We'd love to see more flexibility around hacker management not only based on performance metric on H1 platform as a whole but also specific to particular program.

What problems is the product solving and how is that benefiting you?

1. Getting extra eyes from security researchers to audit the code, and attracting new talent from outside our existing community into the bounty program.

2. Managing reports: making sure they’re reviewed and remediated on time, that nothing gets lost, and handling payments and pricing.

3. Managing communication with hackers and resolving potential conflicts.

Recently, many bounty programs have seen an influx of low-quality, AI-generated reports. When this is paired with agents arguing for the validity of those reports and not taking no for an answer, it can consume a lot of reviewers’ time.

Keeping all communication in one place, strictly within the program guidelines, along with hackers’ reputation and signal metrics and identity verification, makes the process much easier and reduces the noise. The ability to get the H1 team involved to independently remediate any disagreement is helpful as well.

What do you like best about the product?

Over the last year, we’ve run a few different programs with H1. One of those was a penetration test to validate new security controls for our login interface. The pen test program was easy to set up, straightforward to pay for, and it was simple to communicate with the researchers assigned to the engagement.

We also get a lot of value from our bug bounty program, which helps us surface some of our most critical, previously overlooked vulnerabilities.

What do you dislike about the product?

The interface can be confusing at times, depending on which program you’re viewing. Until recently, my biggest frustration with the H1 platform was the billing structure around system tiers and committed spend for paying out vulnerabilities. Even if we went just one dollar over, we would have been forced to upgrade to the next tier. On top of that, we couldn’t integrate our SIEM with hackerone because we didn’t have the enterprise tier. This has since been addressed with the new billing plan.

What problems is the product solving and how is that benefiting you?

H1 is an extension of the subject-matter expertise within our organization. We can only protect ourselves from what we already know, and HackerOne helps us identify and better understand the unknowns. The initial triage that HackerOne performs before we validate an issue has been extremely helpful for determining whether a report is legitimate.

What do you like best about the product?

My day-to-day experience using it is good and intuitive. They offer a lot of tools that help with triage, and the API is very good and very well documented.

What do you dislike about the product?

In some cases, the way the organization and the program are presented can be quite confusing, but overall it’s all good.

What problems is the product solving and how is that benefiting you?

Well, obviously it detects things that our internal team didn’t see, and it helps our H1 triage team review issues as an extra pair of eyes.

What do you like best about the product?

The UI workflow for receiving, reviewing, triaging, and awarding reports is great and runs smoothly.

What do you dislike about the product?

The multi-program management workflow feels weak. It lacks bulk actions and program-scoped automation, which makes managing multiple programs more difficult than it should be.

What problems is the product solving and how is that benefiting you?

A vulnerability inbox for external researchers who want to securely report sensitive information.

What do you like best about the product?

The best part for me is how much operational effort the platform takes off our plate. Having access to a large and skilled pool of researchers, combined with reliable triage, means we receive findings that are relevant and actionable. The relationship with the HackerOne team also stands out, especially Andrea Griffin, who consistently goes above and beyond to support us and make sure the program keeps evolving.

What do you dislike about the product?

If I had to point out one thing, it would be the occasional delays in triage. Still, it's fair to say this reflects a broader trend across bug bounty platforms, with the surge of AI-assisted submissions putting pressure on every triage team. I'm confident HackerOne is aware of it, and any improvements in how these reports are filtered and prioritized would make a real difference for us.

What problems is the product solving and how is that benefiting you?

The platform addresses a key challenge for us: keeping our applications under constant, real-world security testing without having to scale the internal team at the same pace. By connecting us with skilled researchers and handling triage and program management, HackerOne lets us find and fix vulnerabilities faster and with less friction. This has strengthened our overall security posture, improved collaboration with our development teams around remediation, and given leadership greater visibility into the risks we are actually facing.

What do you like best about the product?

As an engineer, I really appreciate the API availability. It lets me pull findings via the API and feed them into triage agents, which helps me develop fixes for those findings more efficiently. I also like that H1 helps me track my bounty budget and related expenses.

What do you dislike about the product?

There needs to be a more structured approach, with clear terms, for researchers who request higher payouts. Also, when researchers submit findings, HackerOne should flag possible duplicates. It doesn’t have to show the full details of those duplicates, but it should at least indicate that a similar report has already been submitted.

What problems is the product solving and how is that benefiting you?

H1 is helping us maintain a more continuous approach to testing and reviewing our systems, since vulnerabilities can be detected at any time. This is a big improvement over relying only on scheduled pentests, which can leave you blind until the next cycle.

What do you like best about the product?

It’s easy to use, and it offers numerous qualified researchers, along with new integrations and tools.

What do you dislike about the product?

The report staging system felt a bit complex to understand at first, and it took me some time to get familiar with how it works.

What problems is the product solving and how is that benefiting you?

Getting valuable security reports from well-qualified researchers, along with a third-person perspective on security.