Professional Documents
Culture Documents
7th Annual Hacker Powered Security Report
7th Annual Hacker Powered Security Report
Contents
It’s Riskier Not to Work With Hackers 3
What You Will Learn From the Hacker-Powered Security Report 5
Conclusion 36
96% of HackerOne customers say their organization is better positioned to requirement to drive down
resist cyberattacks by accepting vulnerability reports from third parties, and rising costs while continuing to
70% say hacker efforts have helped them avoid a significant security incident.
The 7th annual Hacker-Powered Security Report goes deeper than ever before evolving threat landscape.…
with customer insights, in addition to the opinions of some of the world’s top From an ROI perspective, bug
hackers. We also take a more comprehensive look at the top ten vulnerabilities
bounty is one of the most
and how various industries are performing when it comes to incentivizing
effective programs in our
hackers to find the vulnerabilities that are most important to them.
security strategy.”
Seema Sangari
Program Management
How hackers are using AI How to attract the top How your industry How you can save money The latest bounty data and
and what they can tell you hackers to your program compares against the top by incorporating code how your median and top
about the security risks ten vulnerability stats and security audits and bounties stack up against
While nondisclosure agreements
why your program may pentesting into your bug your peers’
55% of hackers say that (NDAs) remain a hot topic in the return different results than bounty strategy
generative AI (GenAI) tools hacking community, only 9% of the HackerOne platform The median cost of a bug on the
themselves will become a major hackers say NDAs put them off averages A code security audit could save HackerOne platform is $500, the
target for them in the coming hacking a target (down from 11% you a potential $18,000 on your average cost is $1,048, and the
years, and 61% said they plan to When we look at the high and bounty program. 90th percentile is $3,000.
in 2022) and only 14% are put off
use and develop hacking tools critical vulnerabilities compared
by the inability to publicly
using GenAI to find more against all vulnerability reports,
disclose vulnerabilities (down
vulnerabilities. Another 62% of from 17% in 2022), showing we see a higher ranking for
hackers said they plan to hackers’ adaptability and insecure direct object references
specialize in the OWASP
(IDOR), for example, because
willingness to work within
Top 10 for Large Language these are not vulnerabilities
these constraints.
Models (LLMs). you can scan for. This highlights
the importance of human
intelligence in seeking out these
weaknesses.
While hackers are always looking for generous “Of course I’m motivated by
bounties, they’re motivated by more than just money: money, but I also choose
programs that offer great
80 % 78 % 47 %
communication with the
community.”
of hackers hack to earn of hackers also say
of hackers say they hack
Tom Anthony
money (up from 71% in 2022) they do it to learn to protect and defend
businesses and end users Hacker
58 %
Internet and online services are a top target for hackers,
with 58% spending time on programs in this realm. These
organizations pay top bounties and are a dominant Financial services & insurance
presence on the HackerOne platform, making up 25% of
all customer programs.
53 %
Financial services is a growing sector, with 53% of hackers
spending time on these organizations’ programs, up from
Government
40 %
44% in 2022.
16 %
seen increased ethical hacker activity in prior years, now
have fewer hackers focusing on them—down to 16% from
17% in 2022.
53 % 48 % 16 % 19 %
Government Media & entertainment Professional services Telecommunications
40 % 40 % 30 % 29 %
Automotive & ground Computer hardware &
Healthcare Medical technology
transport peripherals
33 % 19 % 14 % 24 %
43 % 15 % 41 % 30 %
Internet & online Electronics &
Travel & hospitality
services semiconductor
58 % 15 % 32 %
the Hacking Community 47% specialize in network application testing, 20% have experience with social
engineering, and 63% do vulnerability research. 36% of hackers say they are
most skilled at the reconnaissance part of hacking, and 20% say they are best
at exploitation.
95 % 47%
applications, meaning that hackers are already very
familiar with their mechanisms. Moreover, the attack
surface of web applications provides a particularly wide Web application Network penetration
testing
testing
and rich testing ground, with organizations having huge
sets of assets across the internet. I also specialize in social
engineering. It’s always fascinated me; instead of hacking
technical systems, we’re trying to open a window into the
human mindset. While it seems that our brain is immensely
more complex than a computer, social engineering is the
40 % 10 %
Purple team testing
easiest way for a malicious actor to reach their target. Red team testing
Social engineering is more challenging to run as an ethical
hacking exercise since the hacker needs to have an
understanding of psychology and sociology, while also
understanding the ethics behind any assessment.”
63 %
Vulnerability
18 %
Wireless
research penetration testing
Roni Carta a.k.a. @arsene_lupin
Hacker and co-founder of Lupin & Holmes 20 %
Social engineering
testing
12%
Gaining privileged access
8%
36%
Chaining bugs
Reconnaissance
11 %
6%
Explaining the impact
Exploitation
7%
Escalating bugs
Their Efforts
hack websites, 17% hack iOS applications (up from 15% in 2022), and 43% hack
Android applications (up from 39% in 2022). Eight percent specialize in IoT
technology, and, with the explosion of GenAI in the past year, 7% of hackers
now specialize in these tools, while blockchain specialization is down to 6%
(compared to 8% in 2022).
17 %
43 %
iOS mobile
applications
Android mobile
applications
9% 6%
Blockchain
23 %
Windows mobile
applications
98 %
Websites
Open source
7%
AI tools
17 %
Desktop software
6%
Firmware
55 % 8%
iOT
11 % 7%
APIs
technology while ensuring protection from inherent security issues and threats.
28 %
of hackers are
This challenge includes staying ahead of adversaries who may discover and
concerned about
exploit malicious uses before organizations can address them. Ethical hackers
criminal
have been experimenting with GenAI since 2022 and are already becoming exploitation of AI
66 %
GenAI has become a “significant tool” for 14% of hackers, and 53% of hackers are using it
in some way.
reports
55% of hackers say that GenAI tools themselves will become a major target for them in
the coming years, and 61% said they plan to use and develop hacking tools that employ
GenAI to find more vulnerabilities. Another 62% of hackers said they plan to specialize in
When we asked hackers to rank their concerns about the risks GenAI poses, 28% were
most concerned about criminal exploitation of the tool, 22% about disinformation, and 18%
While 38% of hackers say they think GenAI will reduce the number of vulnerabilities in
code, 43% say it will lead to an increase in vulnerabilities. Find out more in our blog post
on the potential risks GenAI poses.
these applications are new and developing really fast; they don’t
necessarily take security very seriously. I’ve spent a lot of time this
year looking for those security issues and reporting them to the
development teams.
The big companies that are creating their own versions of AI tools
given alpha or beta access to these tools so they can see it first
and reveal those vulnerabilities before it goes out the door. From
that will help us hack better, but the AI models are getting harder
Hacker specializing in AI
insider threats.
We also asked hackers what they think are the biggest security challenges
organizations face. Lack of in-house skills and expertise was the top response,
with 32% saying this was the biggest challenge. 91% of HackerOne customers
say that hackers provide more impactful and valuable vulnerability reports
23 %
Lack of visibility into
than AI or scanning solutions. the attack surface
22 %
9 %
Nation-state actors
20 %
Phishing
Insufficiently
deep testing
12 %
Third-party
software
59 % 13 %
Exploited vulnerabilities Insider threats
11 %
Infrequent testing
We asked hackers what makes for a program they want to hack on.
those numbers are down slightly from 2022. These numbers illustrate
Hacker
73 % 20 %
Bounties Recognition
73%
45 % 39 %
Challenge and
Fast resolution time
opportunity to learn 46%
3% 42 %
Dislike the brand Fast bounty time
45%
27% 39%
21%
17% 42%
20%
16%
42 % 50%
Like the brand A lot of vulnerabilties
50%
42% 3%
Off a Program
from 51% in 2022. Of the hackers that have held back on a disclosure, 45% said it was because there
was no channel through which to disclose. 13% cited threatening legal language on an
organization’s website as the reason they didn’t disclose the vulnerability. There remains a critical
need for organizations to establish clear, accessible, and well-communicated vulnerability
disclosure policies and mechanisms to ensure vulnerabilities are reported and addressed promptly.
29 % 44 %
Skills mismatch Negative reviews
17 % from others
58 %
Dislike the brand Limited scope
48 % 9%
Low bounties NDAs
58%
37 % 44%
14 %
Slow time to bounty No opportunity for
public disclosure
48%
29%
37%
55 % 17%
9%
60 %
Poor communication 55% 14% 60% Slow response
times
for a Bug?
The median price of a bug on the HackerOne platform
is $500, up from $400 in 2022. The average bounty in
the 90th percentile is up from $2,500 to $3,000. The
automotive industry, which is just emerging on the $0.5k $3.8k $1.25k $0.5k $5k $1k $0.5k $1.5k $1k $0.5k $3k $1.1k $0.5k $3k $1.2k
HackerOne platform, has seen the largest increase in Telecoms Automotive Computer Software Media & Entertainment Internet & Online Services
bounties. As security leaders in this sector gain
understanding and confidence in ethical hacking,
hackers are increasingly incentivized to seek out
impactful bugs.
$1k
Average bounty for all industries
$3k
90th percentile average for all industries
$0.4k $6k $3.1k
Financial Services
$0.75k $3.4k $1.2k
Government
$0.3k $1.5k $0.7k
Expect to Pay for a Bug? online services are also offering highly competitive rewards for the most critical
vulnerabilities. The more security-mature industries can afford to be more generous with
the top bounties, as they receive fewer high and critical vulnerabilities. 26% of vulnerabilities
reported to internet and online services organizations are high and critical, and only 22% of
those reported to crypto and blockchain are high or critical.
$12k
90th percentile
Average bounty
$2k $8.4k $4.2k $5k $5k $2.9k $1k $12k $2.6k $3k $12.5k $3.2k $3.1k $21k $5.7k $10k $100k $24.8k $2.5k $5k $2.4k $5k $6k $3.3k $3.1k $7.5k $3.1k $3k $7k $2.9k
Telecoms Automotive Computer
Media & Internet & Online Cryptocurrency & Retail &
Financial
Government Travel &
Software Entertainment Services Blockchain E-commerce Services Hospitality
Bug Bounty
introduce (and find) the most bugs.
SDLC
Customer HackerOne
Development Automated Testing Code Security Audit Pentest Bug Bounty Program
Secure by design Analysis on code changes Secure auditing of your Frequent testing to validate Continuous testing by
frameworks and libraries and live applications code base coverage security experts
programs. The output of a bug bounty program can help HackerOne Code
HackerOne
Test Monitor
HackerOne
Pentest
18% of security fixes are incomplete, making them one of the most essential
types of code changes to audit.
Design flaws and logic errors Insecure coding practices Hidden backdoors and
Sensitive data leakage
Code audits can uncover design flaws and logic Input validation and output encoding issues,
malicious code Data such as hard-coded credentials, API keys,
errors that might not be immediately apparent lack of proper error handling, inadequate These are sometimes intentionally or or encryption keys are often stored insecurely
during production testing. access controls, and other insecure coding unintentionally inserted into the codebase, and within the code.
practices can lead to various attacks, including are often difficult to detect through traditional
injection attacks, cross-site scripting (XSS), and production testing methods alone.
privilege escalation.
Cryptographic vulnerabilities Application and Infrastructure-
Insecure dependencies Unintended information disclosure
Security vulnerabilities related to cryptography—
as-Code misconfigurations Code audits that include software composition Sensitive information—such as debug
such as weak encryption algorithms, improper These might lead to security vulnerabilities analysis (SCA) can easily uncover information, comments, or metadata—
key management, and insecure random such as incorrect and missing security settings, vulnerabilities in third-party libraries and might unintentionally leak details about the
number generation—are more likely to be
default configurations, or insecure cloud dependencies that the application might use. application's internals and infrastructure.
found during a code audit due to their code- configurations.
centric nature.
has shipped
delivers significant $ 18,037
savings Estimated bounty cost savings2
$ 11,400
2 Calculations based off median bounty reward
figures across a sample of 1,100+ active
HackerOne programs
With Industry
Standards via Pentest Pentest top ten vulnerabilities Bug bounty ranking
7 Cryptographic 44
6 Misconfiguration 1
After launching a bug bounty, the median time to receive
the first valid report is 20 days. Hackers are reporting 13% 7 Improper authentication - generic 16
more critical bugs in 2023, and 15% more high-severity
bugs. Critical or high-rated bugs make up 29% of valid
bug bounty reports. 8 Business logic errors 21
9 Open redirect 15
10 Improper authorization 13
Platform Average
Improper access control - generic 13% 12% 13% 28% 10% 10% 10% 13% 12% 9% 8%
Information disclosure 11% 13% 5% 9% 13% 11% 10% 14% 10% 7% 13%
Cross-site scripting (XSS) - Reflected 10% 10% 15% 8% 13% 19% 11% 5% 9% 4% 16%
Privilege escalation 5% 6% 4% 3% 3% 4% 5% 6% 5% 5% 5%
Misconfiguration 5% 4% 2% 6% 3% 3% 7% 4% 5% 6% 4%
Platform Average
When we look at the high and critical vulnerabilities, we
see a high ranking for insecure direct object references
12 % Information disclosure
7%
give an attacker access to the backend of your systems.
Privilege escalation
7% Misconfiguration
4% SQL injection
Improper access control - generic 11% 16% 16% 11% 12% 12% 9% 8% 10% 3% 10%
Insecure direct object reference (IDOR) 9% 13% 13% 9% 11% 12% 9% 6% 9% 4% 13%
Privilege escalation 7% 5% 8% 8% 4% 5% 7% 8% 6% 7% 5%
Misconfiguration 7% 6% 2% 8% 4% 4% 13% 4% 5% 9% 5%
Government agencies are performing poorly when it comes to the low-hanging fruit. This is likely Because the computer software industry’s products are largely delivered by desktop
due to these organizations relying on older systems that get overlooked for reasons of budget, applications, fewer web vulnerabilities like cross-site scripting affect these businesses.
breadth, and forgotten assets. Government agencies are seeing fewer reports for more complex
vulnerabilities like business logic errors because hackers exhaust the plentiful low-hanging fruit
Internet and Online Services
before delving deeper.
We see a high level of security maturity in the internet and online services industry because
Telecoms security has always been a key focus for them. This industry sees a particularly high percentage
of high and critical cross-site scripting (stored) vulnerabilities. This is because those
Telecoms also rely on legacy systems, which are hard to make changes to. When those systems vulnerabilities will have a particularly significant impact on this industry, allowing an attacker to
were implemented, there was less of a focus on security, so a lot of vulnerabilities would have deface websites and degrade customer trust, meaning that Internet and Online Services
been introduced—meaning high volumes of improper authentication and misconfigurations. organizations incentivize hackers to report cross-site scripting vulnerabilities.
Implementing authentication mechanisms on older systems is challenging and there is an
incredibly large telecom user base to authenticate. It may be, therefore, that telecom companies
Crypto and Blockchain
want access control to be a point of focus and are incentivizing hackers to find these vulnerabilities.
The results for crypto and blockchain diverge most significantly from the average. This is in part
Retail and E-commerce because this young industry has no reliance on legacy software and their developers have
strong insight into security. Crypto and blockchain companies are more likely to incentivize
Retail and e-commerce businesses, on the other hand, are typically using newer systems and hackers to find vulnerabilities that could result in the stealing or draining of cryptocurrency
are constantly refreshing. We see fewer improper access control vulnerabilities because there is wallets, which is why we’re seeing a higher portion of reports for misconfiguration and business
less nuance in their authentication mechanisms: a straightforward log-in to an account. logic errors.
Information disclosure and cross-site scripting are in higher volumes, and the overall numbers
for vulnerabilities are fairly high because there are a lot of parallels between e-commerce sites,
Travel and Tourism
so testing for one will be very similar to testing for the next—meaning it’s easy to replicate testing
methods across hundreds of sites. The higher-than-average volume of cross-site scripting reports for travel and tourism
businesses is attributable to their huge attack surfaces. Frequent mergers and acquisitions in
Automotive this industry add to an existing attack surface, and it’s not uncommon for each hotel property to
have its own web presence. Findings for information disclosure and IDOR are also higher because
It’s not surprising that the automotive industry receives the greatest quantity of cross-site scripting this industry has a strong customer loyalty focus, so ensuring customer data is secure is a
vulnerabilities. Historically, websites haven’t been their main focus when it comes to security particular priority.
software and they likely have a lot of third-party and franchise websites that have these
vulnerabilities within them. The volume of high percentages in the high/critical category is because
the automotive industry is relatively new to bug bounty programs, so there’s more clean-up to do.
Measuring
Success
This year we’ve seen a significant 28% improvement in
the time it takes to remediate a vulnerability once
reported—from an average of 35.5 days down to 25.5
days. Automotive, media and entertainment, and 51 46 45 21 43 29 39 20 31 27
government customers have seen the biggest Telecoms Automotive Computer Software Media & Entertainment Internet & Online Services
improvements in time to remediate, each with at least
50% improvement since 2022.
35.5
2022 average days to remediation
25.5
2023 average days to remediation
15 9
Financial Services
89 44
Government
36 26
Measuring Success asked our customers how they measure success. The majority (71%) measure
the absence of incidents or breaches, and many (59%) combine this with the
estimated savings of reputational or customer-related incidents.
clear that the use cases for ethical hacking will continue
Methodology
HackerOne’s annual hacker survey surveyed 2384 hackers that were active
on the platform in the 30 days prior to the survey. The survey took place
The data collected from HackerOne’s platform is from the period between
Trusted by