How HackerOne's Continuous Threat Exposure Management (CTEM) Works

HackerOne's CTEM is a single connected system that spans four stages — discovery, validation, prioritization, and remediation — with the stated goal of closing the gap between finding vulnerabilities and actually fixing them. It combines two engines: Hai, an agentic AI orchestrator that coordinates agents across every stage and continuously scores and validates findings, and an elite community of security researchers who surface issues automation can't reach. The platform's framing is explicit: "Not every vulnerability matters. Fix the ones that do." CTEM is the right fit if your problem is not a shortage of findings but an inability to tell which ones are real and exploitable in your environment — and to get them fixed quickly.

The four stages, and what runs at each

The design point is that these aren't separate products stitched together — Hai sits across all of them, so a finding discovered by one component is validated and scored by the orchestrator rather than handed off as a raw alert.

How the two engines divide the work

Hai (agentic AI) handles scale and speed: coordinating agents across stages, continuously scoring and validating findings, and compressing prioritization from hours of human triage to seconds. It is also the layer behind H1 Code, which reviews pull requests, validates exploitability, and pushes context-aware fixes into developer workflows.

The researcher community handles what automation misses. HackerOne describes elite researchers as finding "novel attack chains and business logic flaws no automated tool reaches" — the class of vulnerability that pattern-matching scanners structurally cannot produce.

The practical consequence: automated coverage gives you breadth and always-on testing, while bounty and pentest engagements give you depth on logic flaws and chained exploits. CTEM's value comes from both feeding the same validation and prioritization pipeline.

Where each component fits

• H1 Bounty — continuous crowdsourced testing; best when you have production assets and want ongoing researcher attention.
• H1 Bounty Challenge — incentivized, time-boxed testing rallied around a specific scope or objective; use for fast, focused answers on a launch or a new surface.
• H1 Agentic Pentest — AI-driven pentesting that scales with attack surface, positioned against time-boxed engagements.
• H1 Continuous Testing — always-on agentic testing that finds, validates, and proves exploitable vulnerabilities across applications.
• H1 AI Red Teaming — adversarial testing for AI systems and models, mapped to OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF.
• H1 Code / H1 Code Security Audit — PR-level review plus agentic analysis for flaws built up over years of releases and for AI-generated code shipping too fast to review manually.
• H1 Validation and H1 Remediation — the noise filter and the fix-delivery layer that sit downstream of everything above.

A concrete example of the gap it targets

Say a scanner flags a medium-severity finding in a checkout service. Under a findings-list workflow, it enters a backlog and competes with hundreds of others. Under CTEM as described: Hai's agents validate whether it's actually exploitable in your environment, a researcher may chain it with a business-logic flaw into a real attack path, the combined finding is scored and ranked within seconds, and a source code-informed fix plan is delivered to engineering in one click. The difference isn't detection — it's that validation, ranking, and fix authoring happen inside the same loop instead of as separate handoffs.

Evidence it works, and how to judge fit

HackerOne cites Shopify reaching "inbox zero" and accelerating validation and triage by 62% using Hai's agentic AI capabilities, and Snap using H1 AI Red Teaming for its AI work. These are vendor-published customer stories, so treat the numbers as directional rather than independently verified.

Choose CTEM if your bottleneck is triage volume, exploitability confirmation, or remediation turnaround. If you only need a one-off penetration test or a single disclosure program, individual components (H1 Agentic Pentest, or vulnerability disclosure) may be a better match than the full connected system. Pricing and access terms aren't specified in the available material, so confirm commercial details directly with HackerOne before planning a rollout.