M&A activity, supply chain risk, and multi-framework compliance make enterprise CTEM a different challenge. See how security teams should scale continuous threat exposure management.

Public Policy

Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules

August 20, 2026

HackerOne submitted comments to CISA on CIRCIA's proposed rules. Here's what needs to change to make federal cyber incident reporting focused, fair, and workable.

Public Policy

H1 Response

Cybersecurity Oversight Belongs to the Board

August 18, 2026

NIS2 places cybersecurity oversight on boards, not just security teams. See what documented accountability looks like and how to build a process regulators expect.

CTEM

H1 Platform

How to Build a CTEM Program: A 90-Day Implementation Roadmap

August 13, 2026

A 90-day roadmap for building a continuous threat exposure management program, covering governance, discovery, validation, and mobilization.

Clock firing three colorful rays of light

CTEM

H1 Platform

New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure

August 5, 2026

Vulnerability counts no longer tell the full story. Here are the three CTEM metrics security leaders should bring to the board in the age of AI-accelerated exposure.

Exposure Management

Hai Triage

Vulnerability Prioritization Is Broken: Your Mediums Are Chaining Into Criticals

July 30, 2026

AI attack chains turn medium findings into criticals. Why severity-sorted queues fail, and what chain-aware vulnerability prioritization looks like instead.

CTEM

Exposure Management

HackerOne News

Fixing the Fix Gap: Introducing H1 Remediation

July 29, 2026

Validated findings shouldn't stall in a backlog. H1 Remediation delivers source code-informed fix plans directly to your engineering team, automatically.

Exposure Management

H1 Response

What Hardware Manufacturers Can Learn From OPPO's Vulnerability Prioritization Program

July 14, 2026

Hardware manufacturers face a hard deadline under the EU Cyber Resilience Act. OPPO's structured program shows that early remediation of vulnerabilities helps reduce the risk of exploitation and minimizes the number of vulnerabilities that need to be reported.