What Happened to HackerOne?

HackerOne was founded in 2012 by Dutch hackers Jobert Abma and Michiel Prins, along with Alex Rice and Merijn Terheggen, after their 'Hack 100' initiative revealed vulnerabilities in major tech companies. The company quickly established itself as a pioneer in crowdsourced security, creating a safe and legal framework for ethical hackers to report vulnerabilities to organizations through bug bounty programs and coordinated vulnerability disclosure (CVD). This model addressed the previously risky and legally ambiguous landscape for security researchers, providing a mutual space for collaboration and incentivizing vulnerability discovery.

Early growth was fueled by significant funding rounds, including a $9 million Series A in 2014 and a $25 million Series B. A key turning point came in March 2016 when the U.S. Department of Defense (DoD) launched its 'Hack the Pentagon' initiative on the HackerOne platform, demonstrating the efficacy of crowdsourced security for government entities. This success led to the DoD developing a Vulnerability Disclosure Policy, further legitimizing the bug bounty model. Mårten Mickos, former MySQL CEO, took over as CEO in June 2015, guiding the company through a period of rapid expansion and increased adoption by Fortune 500 companies.

In the following years, HackerOne continued to expand its offerings and global reach. It acquired Breaker 101 in January 2018 to enhance hacker education and PullRequest in April 2022 to integrate expert code review services earlier into the software development lifecycle. By December 2022, HackerOne's network had paid out over $230 million in bounties, a figure that surpassed $350 million by January 2026. However, the company also faced challenges, including an insider incident in November 2019 where a hacker gained unauthorized access to an analyst account, and a more serious incident in July 2022 where a former employee abused internal access to steal bounties.

A significant leadership change occurred in September 2024 when Kara Sprague was appointed CEO, with a mandate to expand beyond the core bug bounty platform. Under her leadership, HackerOne has increasingly focused on AI security. The company raised an additional $36.4 million in 2025, bringing its total funding to $195 million, although its valuation reportedly declined by 23% from its 2022 peak of $829 million to approximately $635 million by July 2026.

The current status of HackerOne, as of August 2026, is heavily centered on AI. The company has launched several AI-powered initiatives, including an AI-driven continuous pentesting service, h1 Validation for AI-discovered vulnerabilities, and Agentic Prompt Injection Testing. HackerOne also introduced the Hacker Milestone Rewards Program in September 2025 to recognize researchers for validated vulnerabilities. Recent controversies in early 2026 regarding HackerOne's Terms of Service updates and the potential use of hacker reports for AI model training sparked discussions within the hacker community, prompting the company to clarify its responsible AI practices. HackerOne continues to host live hacking events and participate in major cybersecurity conferences, positioning itself as a leader in Continuous Threat Exposure Management (CTEM) and AI security.