HackerOne Blog

The latest from HackerOne

Finding Fast, Fixing Slow: The Rising Exposure Debt

May 6, 2026

Vulnerability submissions are up 76%. Unresolved criticals grew 25x. HackerOne platform data reveals a widening remediation gap that security teams can't afford to ignore.

Read Now

All

CTEM

Engineering

Cloud Security

Code Security

Crowdsourced Security

Culture & Talent

Defense in Depth

From the CEO

HackerOne News

Offensive Security

Public Policy

Return on Mitigation

Security Compliance

Security Research

Exposure Management

Public Policy

Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules

August 20, 2026

HackerOne submitted comments to CISA on CIRCIA's proposed rules. Here's what needs to change to make federal cyber incident reporting focused, fair, and workable.

Public Policy

H1 Response

Cybersecurity Oversight Belongs to the Board

August 18, 2026

NIS2 places cybersecurity oversight on boards, not just security teams. See what documented accountability looks like and how to build a process regulators expect.

CTEM

H1 Platform

How to Build a CTEM Program: A 90-Day Implementation Roadmap

August 13, 2026

A 90-day roadmap for building a continuous threat exposure management program, covering governance, discovery, validation, and mobilization.

Clock firing three colorful rays of light

CTEM

H1 Platform

New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure

August 5, 2026

Vulnerability counts no longer tell the full story. Here are the three CTEM metrics security leaders should bring to the board in the age of AI-accelerated exposure.

Exposure Management

Hai Triage

Vulnerability Prioritization Is Broken: Your Mediums Are Chaining Into Criticals

July 30, 2026

AI attack chains turn medium findings into criticals. Why severity-sorted queues fail, and what chain-aware vulnerability prioritization looks like instead.

CTEM

Exposure Management

Fixing the Fix Gap: Introducing H1 Remediation

July 29, 2026

Validated findings shouldn't stall in a backlog. H1 Remediation delivers source code-informed fix plans directly to your engineering team, automatically.

Exposure Management

H1 Response

What Hardware Manufacturers Can Learn From OPPO's Vulnerability Prioritization Program

July 14, 2026

Hardware manufacturers face a hard deadline under the EU Cyber Resilience Act. OPPO's structured program shows that early remediation of vulnerabilities helps reduce the risk of exploitation and minimizes the number of vulnerabilities that need to be reported.

CTEM

What Automated CTEM Tools Miss, and Why Human Attackers Still Win

July 10, 2026

Automated CTEM tools confirm what you already know to test for. Here's why adversarial exposure validation still requires human attackers to find chained exploits, business logic flaws, and AI-specific vulnerabilities.

CTEM

CTEM for AI Systems: How to Apply the 5-Stage Framework to Your AI Attack Surface

July 10, 2026

AI systems break traditional CTEM programs. Here's how to extend the five-stage framework to cover language models, agentic workflows, and training pipelines and close the gap before attackers do.