Hackerone Inc.

HackerOne Inc. HQ Division, a for-profit corporation headquartered in San Francisco, California, operates as a prime contractor delivering bug bounty platforms, vulnerability disclosure services, and crowdsourced security testing to the federal government under full-and-open competition with no set-aside designations. The vendor competes entirely as a prime contractor (100% of recent awards) across civilian and defense agencies.

HackerOne's federal capability portfolio centers on vulnerability identification, ethical hacker engagement, and managed security assessment platforms. Representative prime contracts include a $14.6 million firm fixed price definitive contract awarded by the GSA Office of the Chief Information Officer on September 25, 2023, for bug bounty SaaS services through September 2028; a $900,801 firm fixed price definitive contract awarded by the Department of Defense's District Washington on February 1, 2026, for the DC3 Vulnerability Disclosure Program Enterprise Management System running through January 2031; a $1.5 million total small business set-aside definitive contract from the Consumer Financial Protection Bureau on September 28, 2021, for HackerOne's cybersecurity testing platform subscription through December 2026; and a $492,650 delivery order against the Crowdsourced Vulnerability Discovery and Disclosure (CVDD) IDIQ from the Office of the Secretary of Defense on June 29, 2022, for bug bounty services.

The vendor's customer concentration is heavily skewed toward Department of Defense accounts. The top five funding organizations account for 91% of recent awards by count and 99% by potential value, anchored by the Office of the Secretary of Defense (15 awards, $40.7 million combined potential value) and the GSA Office of the Chief Information Officer (2 awards, $25.5 million). Secondary customers include GSA Technology Transformation Service (3 awards, $3.7 million), the Consumer Financial Protection Bureau (2 awards, $3 million), and the Department of the Air Force Headquarters (5 awards, $2.5 million). The two rankings diverge on magnitude — OSD dominates both volume and dollars, while GSA OCIO concentrates a disproportionate share of contract value in a smaller award count.

HackerOne holds positions on the Indefinite Delivery Contract HQ003416D0002 (12 task orders, $2.6 million combined potential value) and the Crowdsourced Vulnerability Discovery and Disclosure IDIQ (6 task orders, $2.3 million). Activity has contracted materially over recent years — four awards in 2020 and 2021 each, declining to two in 2022, one in 2023, and one in 2026 — indicating a flattening or declining pipeline after prior peak activity. Two awards with combined potential value of $3 million reach ultimate completion within the next twenty-four months and face recompete exposure.

Service Contract Inventory data shows limited federal services-contract activity captured above the $150,000 reporting threshold. SCI-reportable invoiced revenue totaled $388 thousand across FY2022–FY2024 (FY2022: $98 thousand; FY2023: $290 thousand; FY2024: $0), with the vendor reporting zero FTEs in SCI across all years — a signal that HackerOne's federal work is primarily product licensing or platform access rather than labor-based service delivery. Government-paid rates in SCI records run uniformly at $19,500 per hour. The vendor operates without subcontractor engagement across SCI-reportable prime contracts, delivering services through internal team deployment rather than sub-reliance. HackerOne competes exclusively as a prime contractor with no sub-award activity in the source data.