HackerOne’s UI, its integration with their proprietary artificial intelligence agent (HAI) to help analyze incoming reports, and—most importantly—its customer success team all contribute to a strong overall experience on the platform. Another thing that makes the platform stand out is the community of hackers and researchers that HackerOne has grown over the years. Every hacker we’ve interacted with so far has been helpful, open to communication, and willing to retest issues we’ve found, which makes the community genuinely easy to work with. The ability to connect our workflow to external platforms via APIs also helps us strengthen validation and stay on top of new reports as they come in. Overall, it has been a great experience. Review collected by and hosted on G2.com.

The recent rise in AI-assisted pentesting has led to a large increase in the number of new reports being submitted to the platform overall, which in turn has increased triage times. This isn’t an issue with the platform itself, but it has resulted in longer SLA times. Over the past few months, the HackerOne team has been addressing this by adding more automated validations using their AI agents, with the goal of getting triage times back to being faster. Review collected by and hosted on G2.com.

The biggest impact of running a program through H1 is that in the first month it already uncovered critical vulnerabilities that weren’t found in the designated audit.

Also, managing incoming reports and remediations for an open source project can get overwhelming. H1 makes it much easier to keep track of things and make sure nothing slips through the cracks. Specifically, filtering out duplicate reports saves a lot of time for the team. Review collected by and hosted on G2.com.

UI can be hard to navigate.

We'd love to see more flexibility around hacker management not only based on performance metric on H1 platform as a whole but also specific to particular program. Review collected by and hosted on G2.com.

Over the last year, we’ve run a few different programs with H1. One of those was a penetration test to validate new security controls for our login interface. The pen test program was easy to set up, straightforward to pay for, and it was simple to communicate with the researchers assigned to the engagement.

We also get a lot of value from our bug bounty program, which helps us surface some of our most critical, previously overlooked vulnerabilities. Review collected by and hosted on G2.com.

The interface can be confusing at times, depending on which program you’re viewing. Until recently, my biggest frustration with the H1 platform was the billing structure around system tiers and committed spend for paying out vulnerabilities. Even if we went just one dollar over, we would have been forced to upgrade to the next tier. On top of that, we couldn’t integrate our SIEM with hackerone because we didn’t have the enterprise tier. This has since been addressed with the new billing plan. Review collected by and hosted on G2.com.

I really like the way critical and high findings are prioritized. The H1 triage analysts are extremely helpful and genuinely pleasant to work with.

I also appreciate that the platform offers many different ways to pull metrics, which makes it easier to share clear updates with leadership on how the program is progressing.

The researcher community is very large and includes highly talented security researchers from around the world, so it’s easy to find people who can support our program’s specific needs.

Additionally the UI in the platform is very appealing and easy to use (especially in dark mode). Review collected by and hosted on G2.com.

The pricing structure (consumption tiers every 50-100K in bounty spend) is the worst part about H1. It makes running a program significantly more difficult and forces us to be very careful when paying researchers and hinders out ability to mature our program. The value that comes from a 50K different in bounty spend is not work the additional cost from the consumption tier. Switching to a unlimited tier structure would be amazing.

The triage time historically has also been quite slow, although recently we have seen large improvements via prioritization of high impact findings.

The support in terms of getting quotes and working with HackerOne folks also has room for improvement. It is a difficult process to work back and forth trying to get renewals/upgrade quote processed.

HAI also hallucinates metrics all the time and will struggle to provide details on where it got the data.

The findings tab should also have the ability to export results across all pages, not just one page at a time. This would make it much easier to generate out own metrics using data we trust. Review collected by and hosted on G2.com.

H1 is easy to use, and the built-in AI tooling gives us quick insight into our most impactful bugs without the sloppiness and hallucinations you hear about with AI elsewhere. Onboarding quality researchers is simple, and because we run an invite-only program, we control who gets access and keep the expertise level high. That control over researcher quality is a significant reason I wouldn't use any other platform. Review collected by and hosted on G2.com.

There isn't really anything we don't like. HAI helps to navigate when we can't find anything and is is getting better every day. For our use case the Platform is perfect. Review collected by and hosted on G2.com.

I like H1 Platform for its ease of use and navigation, which makes it easier for me to segregate each of our products into their own pentests. I also find it really handy that I can send the reports directly to Jira with synced comments. The initial setup was very easy, and it's only gotten easier and more efficient over time. Review collected by and hosted on G2.com.

I would say the other thing that doesn't work as well would be permissions when it comes to starting up a new pentest. I would like to see a group that can just be added vs individual users each time that manage the pentests. Review collected by and hosted on G2.com.

It helps us coordinate our many repeat yearly pentests into one manageable platform. Review collected by and hosted on G2.com.

The user rights management is one of the convoluted I've ever used, for example I have to assign rights to a new pentest to every individual analyst working on it, every time.

There was also a period where we had a new technical contact ever 2-3 months, with a 3 month span where we just didn't seem to have one. Review collected by and hosted on G2.com.

The biggest benefit is having the entire triage process in one place; from intake and researcher back-and-forth to severity scoring. So things do not get lost. The researcher pool is strong too. They regularly find issues that our automated scans miss. Review collected by and hosted on G2.com.

The biggest issue is report quality. Too much triage time goes to filtering low-effort or duplicate submissions before we can focus on valid findings. The platform can also feel slow and clunky when moving between reports, programs, and analytics. Review collected by and hosted on G2.com.

Gives researchers a direct channel to us, which reduces noise and duplicate reports through triage. "Hai" AI Assistance is also a nice addition for summarizing reports. Review collected by and hosted on G2.com.

I would like a better option for exporting reports so I can share them more easily with our developer teams. Review collected by and hosted on G2.com.

As an engineer, I really appreciate the API availability. It lets me pull findings via the API and feed them into triage agents, which helps me develop fixes for those findings more efficiently. I also like that H1 helps me track my bounty budget and related expenses. Review collected by and hosted on G2.com.

There needs to be a more structured approach, with clear terms, for researchers who request higher payouts. Also, when researchers submit findings, HackerOne should flag possible duplicates. It doesn’t have to show the full details of those duplicates, but it should at least indicate that a similar report has already been submitted. Review collected by and hosted on G2.com.