HackerOne
Submitted by HackerOne on

As VDPs Remain a Fundamental Tool for Reducing Cybersecurity Risk, Essential VDP Simplifies How Organizations Embrace this Best Practice and Stay Compliant

SAN FRANCISCO, September 12, 2024 — HackerOne, the leader in human-powered security, today announced Essential VDP — a free, entry-level tier of HackerOne Response, its Vulnerability Disclosure Program (VDP) product. Any organization can now establish a VDP with HackerOne to help address compliance requirements and maintain a direct channel for the global researcher community to report high-impact vulnerabilities. 

“Adopting a vulnerability disclosure program ensures that an organization is prepared to handle security vulnerabilities effectively,” said Jason DeBord, CISO, Ohio Secretary of State. “Our VDP gives us a communication channel with security researchers so they can report vulnerabilities before bad actors find them.”

A growing list of standards and regulatory requirements from governments recognize VDPs as an essential security best practice, including NIST 800-53, ISO 27001, and the Product Security and Telecommunications Infrastructure Act (PSTI).

“Thousands of leading organizations have already adopted, and continue to adopt, VDPs because they work. They are a proven and fundamental best practice that reduces cybersecurity risk,” said Ilona Cohen, Chief Legal and Policy Officer at HackerOne. “Improving access to VDPs will make it easier for individual organizations to meet compliance standards and collectively improve the safety of the internet for everyone.”

Essential VDP gives organizations new to vulnerability disclosure free access to set up a VDP on HackerOne’s platform with the tools to: 

  • Launch quickly through a guided onboarding experience, which includes training, product documentation, templated disclosure guideline support, and integration with a HackerOne inbox for easier vulnerability tracking and remediation.
  • Access industry-leading policy guidance and best practices informed by the thousands of programs on the HackerOne Platform.
  • Address compliance requirements with in-platform attestation reports as proof that you maintain a VDP for common frameworks and mandates.

“We found that handling reports via email was becoming difficult to manage,” said Arthur Weibe, Site Reliability Engineer, ADAMnetworks. “HackerOne Essential VDP resolves this issue by providing a structured way to track all reports from triage to resolution. We get better reports, and the team has better visibility.”

HackerOne continues to support thousands of programs for leading brands, including established VDPs for The Ohio Secretary of State, Department of Defense, John Deere, and Adobe. Learn more about HackerOne’s VDP offerings and Essential VDP here.

About HackerOne

HackerOne is the global leader in human-powered security, harnessing the creativity of the world’s largest community of security researchers with cutting-edge AI to protect your digital assets. The HackerOne Platform combines the expertise of our elite community and the most up-to-date vulnerability database to pinpoint critical security flaws across your attack surface. Our integrated solutions, including bug bounty, pentesting, code security audits, spot checks, and AI red teaming, ensure continuous vulnerability discovery and management throughout the software development lifecycle. Trusted by industry leaders such as Coinbase, General Motors, GitHub, Goldman Sachs, Hyatt, PayPal, Snap Inc, and the U.S. Department of Defense, HackerOne was named a Best Workplace for Innovators by Fast Company in 2023 and a Most Loved Workplace for Young Professionals in 2024.