HackerOne vs. Hackrate

Our security team will never scale like we'd like to do having this had been extremely helpful to manage, address, and payout vulnerabilities reported. I like having one "door" for this and not multiple ways to report stuff

Incentivized

Any scenario where having an ethical hacking program is crucial, but you simply do not have the manpower, capability, or know-how on how to deal with reporters or the reports, or verify if the reported issues are as serious as the reporters say. It's an easy way to offload work from your team to professionals who are always ready to help.

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• Ease of use
• Communication with the Hackrate team
• Well defined rules that were helpful in determining which areas we want to focus on.

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

It's a fantastic service that you can rely on. The only minor inconvenience was the overall usability of the platform itself, but you get used to it after using it a few times. The recap meet with the team was always a fantastic time, and helpful in giving the reports further context.

I haven't used any other products as such but I have read about bugcrowd.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized