HackerOne - Experts & Thought Leaders

HackerOne, a pioneer in Continuous Threat Exposure Management (CTEM), today released its 10th annual HackerOne Security Research Report, revealing that on the H1 Platform, the backlog of validated, unresolved vulnerabilities grew 131% in two years, even as average resolution time improved 54%. This year's report, Exposure Debt: The Next Challenge in Cybersecurity, introduces the urgent challenge security teams are grappling with in the race to stay ahead of attackers. AI has changed what security researchers can find. In skilled hands, advanced models are surfacing authorisation flaws and multi-step attack chains that traditional scanners often miss. Organisations are responding: the average resolution time improved 54% this year, but discovery is outpacing remediation, and the gap between them continues to widen. Every vulnerability an organisation knows about and hasn't fixed is a risk it already owns and hasn't paid down. That's Exposure Debt, and it grew 131% in just two years. Sensitive information disclosure Key findings from the report include: Exposure Debt is compounding: Despite the fastest remediation speeds recorded on the H1 Platform, the backlog of known, unresolved findings has still grown 131% over the past two years. Security leaders are feeling the pressure: 75% of surveyed security leaders said their organisations formally track exposure debt, and nearly 70% confirmed that validated findings are entering their systems faster than their teams can fix them. AI vulnerabilities are shifting as systems become more connected: System Prompt Leakage reports increased 557% year over year, Misinformation rose 455%, and Improper Output Handling increased 264%. Prompt injection and sensitive information disclosure continue to account for the largest share of AI vulnerability reports on the platform. Bug bounty programmes “AI is changing both sides of the security equation. It’s helping researchers find vulnerabilities faster and go deeper, while representing entirely new attack surfaces for them to test,” said Kara Sprague, CEO of HackerOne. “At the same time, nearly 70% of security leaders say findings are piling up faster than their teams can address them. Fixing got faster. It still lost ground. The constraint is no longer discovery; it is everything between a report arriving and a risk being resolved.” Additional notable findings from the report include: Researchers have incorporated AI into their workflows: 85% of surveyed researchers are actively upskilling in AI, with nearly three-quarters self-reporting a meaningful increase in valid findings. Complexity is the new frontier: 68% of surveyed researchers have shifted toward higher-complexity, higher-bounty bugs as AI changes how and where researchers spend their time. Remediation is faster than ever: Across HackerOne programmes, organisations have cut average resolution time from 135 days to 62 days, a 54% improvement in just two years. Researchers earned a record $89 million from July 2025 to June 2026: Organisations running bug bounty programmes on the H1 Platform awarded $89 million to security researchers, an 18% increase over the prior year and the highest annual total in the platform’s history. Highest annual total “AI hasn’t replaced how I think as a security researcher. It’s changed how much ground I can cover,” said Douglas Day, a top-earning security researcher on HackerOne. “I’ve automated parts of my research process that used to take hours, which gives me more time to focus on the vulnerabilities that require creativity, context, and an understanding of how systems actually work. The researchers who get the most out of AI won’t be the ones who simply turn it on. They’ll be the ones who know how to guide it, question it, and recognise when it has found something worth pursuing. The most valuable skill in the age of AI will be the ability to be flexible and adapt to new tools and technologies as they become available.”

HackerOne, a global pioneer in Continuous Threat Exposure Management (CTEM), announces the upcoming integration of Anthropic’s Claude Mythos across select H1 Platform products: H1 Code Security Audit and H1 Code. The integration will make frontier cyber AI available in existing security workflows, connecting agentic vulnerability discovery with validation, prioritisation, and remediation. Enterprises are identifying possible exposures faster than ever, yet falling further behind on validating true exposure and making fixes. Frontier AI is widening that gap in both directions. According to H1 Platform data, critical vulnerability mean time to remediate (MTTR) improved by more than 50% over the past 12 months. Existing engineering workflows Over the same period, the unresolved critical backlog grew 29x. As frontier cyber AI increases the speed and depth of discovery, organisations need a scalable way to validate and prioritise what it finds. The H1 Platform harness will be available with Mythos through discovery of source code vulnerabilities with controls designed to improve coverage, validate model outputs, and bring validated exposures into existing engineering workflows. "Frontier cyber AI models can do one of two things to a security team," said Nidhi Aggarwal, Chief Product Officer at HackerOne. "It can hand them a longer list, or it can hand them a list they can act on. Which one depends entirely on what sits between the model and the security team. A harness helps turn model output into a validated exposure a security team can act on. We ran and validated the H1 Platform harness for ourselves before any customer saw it." Surface complex vulnerabilities On the discovery side, H1 Code Security Audit scans full repositories to surface complex vulnerabilities, including compositional vulnerabilities that can span years of commits and multiple authors, and H1 Code reviews pull requests. “Attackers are already using frontier AI to find and exploit vulnerabilities faster than humans alone can respond,” said Kara Sprague, Chief Executive Officer at HackerOne. “Defenders need access to advanced cyber-capable models, with people accountable for the decisions those models inform and the actions those models take. Finding vulnerabilities faster matters only if organisations can validate, prioritise, and act on them.” Complementary layers of continuous security Frontier cyber AI is one layer of coverage. An elite community of security researchers provides another, bringing creativity, contextual understanding, and real-world adversarial expertise to complex attack chains, business logic flaws, and novel exploitation paths. Together, frontier cyber AI and human expertise provide complementary layers of continuous security. HackerOne does not use or permit use of confidential researcher submissions or customer vulnerability data to train, fine-tune, or otherwise improve generative AI models. The select H1 Platform offerings will soon be available with Mythos. Users can also read more about what HackerOne found running Mythos on its systems as part of Project Glasswing and learn more about the H1 Platform.

HackerOne, a global pioneer in Continuous Threat Exposure Management (CTEM), announces a partnership with OpenAI to make frontier GPT cyber models available in select H1 Platform products, H1 Code Security Audit, H1 Code, and H1 Remediation, to help teams find and fix vulnerabilities faster. GPT cyber models use is optional and enabled by the customer. The partnership addresses a growing challenge facing security leaders applying increasingly capable AI across the exposure management lifecycle to find vulnerabilities and exposures, validate which ones pose real risk, and help teams prioritise and remediate them. As frontier AI increases the speed and depth of discovery, the H1 Platform helps organisations turn that capability into measurable risk reduction. Exposure management lifecycle “AI is making complex attack paths increasingly discoverable, changing the risk calculation for every security leader,” said Kara Sprague, Chief Executive Officer at HackerOne. “Defenders have to assume that if an exposure exists, it will be found, and act before attackers do. That means building security programmes that continuously discover, validate, and eliminate risk, so organisations can move from reacting to threats to staying ahead of them.” Addressing that new risk requires connecting expanded discovery capabilities to the rest of the security lifecycle. “Frontier AI can significantly expand what defenders can discover, but findings must still be validated, prioritised, and translated into action,” said Nidhi Aggarwal, Chief Product Officer at HackerOne. “The H1 Platform can put frontier AI to work across the security lifecycle, finding and validating the exposures that pose real risk, tracing them to root cause, and giving teams a clear path to remediation.” Multi-model harness The H1 Platform multi-model harness can use OpenAI’s frontier cyber models through the Daybreak Defence Network to broaden coverage, validate outputs, and trace findings to root cause. Security teams receive each finding with a developer-ready fix plan designed to cut overall time to remediate. Frontier cyber AI is one layer of coverage. An elite community of security researchers provides another, bringing creativity, contextual understanding, and real-world adversarial expertise to complex attack chains, business logic flaws, and novel exploitation paths. Together, frontier cyber AI and human expertise provide complementary layers of continuous security. Improving generative AI models HackerOne does not use or permit use of confidential researcher submissions or customer vulnerability data to train, fine-tune, or otherwise improve generative AI models. The partnership builds on HackerOne and OpenAI’s work to strengthen cyber defense. HackerOne recently signed OpenAI’s “A call for collective action on cyber defence,” an open letter from organisations around the world calling for collective action to expand access to advanced defensive capabilities, share practical security expertise, and accelerate verified fixes. HackerOne is also a launch partner in Patch the Planet, an OpenAI initiative focused on using AI-assisted security research and human expertise to identify and remediate vulnerabilities in critical open-source software. To learn how frontier cyber AI is transforming Continuous Threat Exposure Management, register for their upcoming webinar, Outpacing the Attacker, on Friday, September 11, 2026, at 18:30 BST.