HackerOne Blog

Security Research

Return on Mitigation

Security Research

A New Approach to Proving Cybersecurity Value (That Isn’t ROI)

February 14, 2025

Over the past 8 months, Luke (hakluke) Stephens and I have spoken with 10 security...

Read Now

All

Cloud Security

Code Security

Crowdsourced Security

Culture & Talent

Defense in Depth

From the CEO

HackerOne News

Offensive Security

Public Policy

Return on Mitigation

Security Compliance

Security Research

Exposure Management

Security Research

Evolving with AI: How One Security Researcher Built a Career Around Time

April 7, 2026

Meet Douglas Day and see how bug bounty programs and AI automation helped him build a security research career with more flexibility and freedom.

Code Security

Security Research

How to Find XSS: Techniques Security Researchers Use in Real Environments

April 1, 2026

Learn how to find XSS vulnerabilities and validate real exploitability using techniques trusted by security teams.

Security Research

AI Red Teaming

Advancing AI Red Teaming: Agentic Taxonomies and Governance-Ready Reporting

March 24, 2026

AI Red Teaming now maps validated agentic exploit paths to OWASP, NIST, ISO, and the EU AI Act. Get governance-ready reporting without spreadsheets.

Security Research

104 Hacking Tools and Resources

January 14, 2026

Updated list of 104 hacking tools and resources for security researchers, covering web proxies, recon, API testing, mobile, cloud, and more.

Security Research

The Security Researcher Who Thinks Like a Pastor

January 13, 2026

What do pastoring and vulnerability research share? Presence. Evan Connelly explains how attention, patterns, and prevention shape better security work.

Public Policy

Security Research

A Safer Future for Security Research: Landmark Moves in Portugal and the UK

December 18, 2025

Portugal’s Article 7 and the UK’s proposed statutory defence mark major steps toward protecting good-faith security research. Explore how these reforms reduce risk and strengthen coordinated vulnerability disclosure.