Hackerone Inc.

San Francisco, CA HQ

UEI
KGSEGCXA2JN1
CAGE
7JUM3
Primary NAICS
541519 Other Computer Related Services
SAM.gov registration
Active through

Company facts

Self-certified in SAM.gov
  • For Profit Organization
Entity structure
Corporate Entity (Not Tax Exempt)
SAM.gov registration date
Physical address
44 Montgomery, 44 Montgomery St, San Francisco, CA 94104, USA
Website
hackerone.com
Founded
2012
Employees
1K-5K
Estimated annual revenue
$1B-$10B
Industry
  1. Information Technology
  2. Software & Services
  3. IT Services
  4. Data Processing & Outsourced Services
SIC code
73 Business Services

Registration and certifications come from SAM.gov and the SBA; company details from public web sources. Updated .

Contract obligations by fiscal year

Fiscal year Obligated
FY2027 To date $0
FY2026 $162,801
FY2025 $400,311
FY2024 $624,370
FY2023 $698,090

Top agencies by obligations

Rank Agency Obligated, FY2026–FY2027 Share
1 Air Force $162,801

Contract vehicles

No active vehicles.

1 expired vehicle

Contract awards

Latest 5 listed here. See the rest on GovTribe.

Similar vendors

About the company

HackerOne Inc. HQ Division, a for-profit corporation headquartered in San Francisco, California, operates as a prime contractor delivering bug bounty platforms, vulnerability disclosure services, and crowdsourced security testing to the federal government under full-and-open competition with no set-aside designations. The vendor competes entirely as a prime contractor (100% of recent awards) across civilian and defense agencies.

HackerOne's federal capability portfolio centers on vulnerability identification, ethical hacker engagement, and managed security assessment platforms. Representative prime contracts include a $14.6 million firm fixed price definitive contract awarded by the GSA Office of the Chief Information Officer on September 25, 2023, for bug bounty SaaS services through September 2028; a $900,801 firm fixed price definitive contract awarded by the Department of Defense's District Washington on February 1, 2026, for the DC3 Vulnerability Disclosure Program Enterprise Management System running through January 2031; a $1.5 million total small business set-aside definitive contract from the Consumer Financial Protection Bureau on September 28, 2021, for HackerOne's cybersecurity testing platform subscription through December 2026; and a $492,650 delivery order against the Crowdsourced Vulnerability Discovery and Disclosure (CVDD) IDIQ from the Office of the Secretary of Defense on June 29, 2022, for bug bounty services.

The vendor's customer concentration is heavily skewed toward Department of Defense accounts. The top five funding organizations account for 91% of recent awards by count and 99% by potential value, anchored by the Office of the Secretary of Defense (15 awards, $40.7 million combined potential value) and the GSA Office of the Chief Information Officer (2 awards, $25.5 million). Secondary customers include GSA Technology Transformation Service (3 awards, $3.7 million), the Consumer Financial Protection Bureau (2 awards, $3 million), and the Department of the Air Force Headquarters (5 awards, $2.5 million). The two rankings diverge on magnitude — OSD dominates both volume and dollars, while GSA OCIO concentrates a disproportionate share of contract value in a smaller award count.

HackerOne holds positions on the Indefinite Delivery Contract HQ003416D0002 (12 task orders, $2.6 million combined potential value) and the Crowdsourced Vulnerability Discovery and Disclosure IDIQ (6 task orders, $2.3 million). Activity has contracted materially over recent years — four awards in 2020 and 2021 each, declining to two in 2022, one in 2023, and one in 2026 — indicating a flattening or declining pipeline after prior peak activity. Two awards with combined potential value of $3 million reach ultimate completion within the next twenty-four months and face recompete exposure.

Service Contract Inventory data shows limited federal services-contract activity captured above the $150,000 reporting threshold. SCI-reportable invoiced revenue totaled $388 thousand across FY2022–FY2024 (FY2022: $98 thousand; FY2023: $290 thousand; FY2024: $0), with the vendor reporting zero FTEs in SCI across all years — a signal that HackerOne's federal work is primarily product licensing or platform access rather than labor-based service delivery. Government-paid rates in SCI records run uniformly at $19,500 per hour. The vendor operates without subcontractor engagement across SCI-reportable prime contracts, delivering services through internal team deployment rather than sub-reliance. HackerOne competes exclusively as a prime contractor with no sub-award activity in the source data.

Quick answers

Is Hackerone Inc. registered in SAM.gov?

Yes. Hackerone Inc.'s SAM.gov registration is active through February 26, 2027.

Which contract vehicles does Hackerone Inc. hold?

Hackerone Inc. holds a place on 1 federal contract vehicle: CVDD.

How much has Hackerone Inc. received in federal contracts?

Federal contracts obligated $400,311 to Hackerone Inc. in fiscal year 2025 and $1,885,572 in fiscal years 2023 through 2027.

How does Hackerone Inc. rank among federal contractors?

Hackerone Inc. ranked #52 at the Consumer Financial Protection Bureau in FY2025.

What is Hackerone Inc.'s most recent federal award?

Hackerone Inc.'s most recent federal contract award is DC3 vulnerability disclosure program (VDP) enterprise management system (EMS) (FA701426C0010), from District Washington (HAF), on February 1, 2026.

On GovTribe

See Hackerone Inc.'s full federal record

  • Federal contract awards
  • IDV awards
  • Contract vehicles
  • Subcontracting relationships
  • Funding analysis by agency, NAICS and set-aside
  • Similar vendors