What Products Does HackerOne Offer for Finding and Fixing Vulnerabilities?

HackerOne's platform is organized around Continuous Threat Exposure Management (CTEM), a connected system spanning discovery, validation, prioritization, and remediation. Its product line splits into two broad groups: services that find vulnerabilities (H1 Bounty, H1 Bounty Challenge, H1 Agentic Pentest, H1 Continuous Testing, H1 AI Red Teaming, H1 Code, H1 Code Security Audit) and services that validate and fix them (H1 Validation, H1 Remediation). All of it is coordinated by Hai, HackerOne's agentic AI orchestrator, which scores and validates findings continuously and, per HackerOne, reduces prioritization decisions from hours to seconds.

Finding vulnerabilities

H1 Bounty

Crowdsourced bug bounty where elite researchers hunt for critical vulnerabilities, including novel attack chains and business logic flaws that automated tools cannot reach. Best fit: organizations with production applications and a mature enough security process to triage incoming reports.

H1 Bounty Challenge

An incentivized, time-boxed version of bounty testing that rallies researchers around a specific scope or objective. Best fit: teams that need fast, focused answers on a particular asset or feature rather than a standing program.

H1 Agentic Pentest

AI-driven pentesting that scales with your attack surface. HackerOne positions it as delivering depth and speed that time-boxed human engagements cannot match. Best fit: broad or fast-changing attack surfaces where periodic point-in-time pentests leave gaps.

H1 Continuous Testing

Always-on agentic testing that continuously finds, validates, and proves exploitable vulnerabilities across your applications. Best fit: teams that want ongoing coverage between scheduled assessments.

H1 AI Red Teaming

Adversarial testing for AI systems and models, mapped to OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF. Best fit: organizations shipping LLM-based features or models that need testing aligned to recognized AI security frameworks.

H1 Code

AI code security that reviews pull requests, validates exploitability, and delivers context-aware fixes into developer workflows. Best fit: teams that want security checks embedded at the PR stage.

H1 Code Security Audit

Agentic analysis aimed at flaws built up over years of releases, as well as issues in AI-generated code that ships too fast for manual review. Best fit: legacy codebases or heavy AI-assisted development where point-in-time review misses accumulated risk.

Validating and fixing

H1 Validation

Confirms exploitability in your own environment and filters out noise. HackerOne states 95% accuracy and a 40% improvement in signal. Best fit: teams drowning in scanner output who need to know which findings are actually exploitable before assigning engineering time.

H1 Remediation

Closes the discovery-to-remediation gap with source code-informed fix plans delivered to engineering in one click. Best fit: organizations where findings stall because fix guidance is vague or disconnected from the codebase.

How the pieces fit together

The design intent is that these are not standalone tools but stages of one loop: discovery feeds validation, validation feeds prioritization, and prioritization feeds remediation. Hai sits across all stages, scoring and validating findings continuously.

Choosing between them

The decision usually comes down to where your gap is:

• No program at all, or only periodic pentests → start with H1 Bounty or H1 Agentic Pentest depending on whether you want human ingenuity or AI scale.
• Plenty of findings but poor signal → H1 Validation first; adding more discovery before fixing noise usually makes the problem worse.
• Findings piling up unfixed → H1 Remediation, since the bottleneck is the fix path, not detection.
• Shipping AI features → H1 AI Red Teaming, because framework-mapped testing (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF) addresses risks generic testing does not cover.
• Security reviews lagging behind development → H1 Code for PR-level checks, or H1 Code Security Audit for accumulated and AI-generated code.

HackerOne cites customer outcomes such as Shopify reaching inbox zero and accelerating validation and triage by 62% using Hai's agentic capabilities, and Snap using H1 AI Red Teaming for its AI work. These are vendor-published case studies, so treat the numbers as directional rather than independently verified.

Pricing, plan tiers, and access requirements are not specified in the available material; confirm those directly with HackerOne before committing to a specific product.