HackerOne Blog

Exposure Management

wave crashing

Crowdsourced Security

Exposure Management

The Exposure Debt Benchmark: What the 2026 Data Says About the Find-to-Fix Gap

October 14, 2026

Exposure management is falling behind discovery. See how backlogs grew 131% while resolution time fell to 62 days, and download the 2026 report.

Read Now

All

AI

CTEM

Engineering

Cloud Security

Code Security

Crowdsourced Security

Culture & Talent

Defense in Depth

From the CEO

HackerOne News

Offensive Security

Public Policy

Return on Mitigation

Security Compliance

Security Research

Exposure Management

ROI vs. ROM

Exposure Management

Quantifying the Value of Bug Bounty Programs: ROI, ROM, or Both?

September 4, 2024

Is ROI the right method to measure bug bounty value? Check out the cost-benefit analysis of ROI vs. ROM.

Bug bounty and VDP

Exposure Management

Crushing FUD: Embracing Ethical Hackers to Strengthen Cybersecurity

September 3, 2024

FUD can overshadow proactive collaboration with ethical hackers. Let's explore how to combat FUD and get organizational buy-in for bug bounty and VDP.

Visual Guide to Bug Bounty Success

Exposure Management

A Visual Guide to Bug Bounty Success

August 7, 2024

We've created a visual guide to planning, operating, and evaluating your bug bounty program for success.

bug bounty program standards

Exposure Management

Security Page Updates: Boosting Consistency & Transparency for Security Researchers and Customers

August 1, 2024

HackerOne has launched new updates to program security pages that standardize policy fields and drive hacker engagement.

Authentication bypass

Exposure Management

Security Research

How a GraphQL Bug Resulted in Authentication Bypass

July 29, 2024

Experienced security researchers explain how a GraphQL bug resulted in authentication bypass — and how to avoid it.

Graphic showing NIST controls

Security Compliance

Exposure Management

Are You Ready for the New NIST Control Around Public Disclosure Programs?

July 25, 2024

A new NIST control requires SaaS vendors to “establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.”

HackerOne Custom Inbox Enhancements

Exposure Management

Streamline Report Management with Custom Inboxes: Reducing Delays and Security Risks

July 23, 2024

Custom Inboxes Enhancements provide flexible report segmentation, reduce administrative overhead, and mitigate security risks.

Retail vulnerabilities

Exposure Management

Common Ecommerce Vulnerabilities: Reflected XSS

June 27, 2024

With an example from Shopify, learn about the impact of Reflected XSS vulnerabilities in ecommerce.

bug bounty with HackerOne

Exposure Management

From Zero to Hero: Your Guide to Building a Bug Bounty Program With HackerOne

June 6, 2024

Learn the value of bug bounty for your security program and how to launch and manage a successful BBP with HackerOne.