HackerOne Adds a Global Top 10, CVE Exploitation Index and Bounty Calculator to Its Platform

HackerOne, which describes itself as the world's most trusted hacker-powered security platform, has introduced a set of new features for customers and hackers, timed to coincide with its annual Security@ conference. The updates fall into three groups: security intelligence, tools that make hackers more efficient, and workflow changes aimed at large global enterprises.

On the intelligence side, the company has created the HackerOne Global Top 10, a vulnerability rating table intended to sit alongside OWASP's Top 10 and based on real-world vulnerabilities reported by its worldwide hacker community. A CVE Exploitation Index will show which vulnerabilities are being exploited. For hackers, HackerOne released what it calls the first hacker API in July and has now added bounty table ranges and a bounty calculator to make payouts more transparent. Enterprise customers get better access management and control, and improved connections to external applications.

Rand Wacker, SVP of Product at HackerOne, said that making vulnerability management programmes simpler for customers of every size has been central to the company since it was founded. The aim, he said, is to let hackers concentrate on hunting bugs while customers receive sophisticated intelligence, a combination he expects to make a real difference to their security strategies. He added that HackerOne is keen to see how customers apply the data its hackers generate to shape security programmes across their organisations.

A Top 10 that goes beyond OWASP

Security teams widely use the Open Web Application Security Project (OWASP) Top 10 to decide where to focus their vulnerability management. The 2021 edition added three new categories: Insecure Design, Software and Data Integrity Failures, and a group covering Server-Side Request Forgery (SSRF) attacks. HackerOne says it supplied data for that list, and that its continuing collaboration and partnership with OWASP shaped the content as well.

The HackerOne Global Top 10 is meant to go further, with more frequent updates and data broken down by industry. Drawing on its own dataset of what is found and rewarded on the platform, HackerOne says it can show customers which weaknesses matter most from a hacker's point of view, including ones that would not have appeared in the OWASP Top 10. The Global Top 10 will also become a standard part of HackerOne Assessment scopes, so that testing goes past the usual pentest check against the OWASP list.

The CVE Exploitation Index adds another layer. A scanner reports only what a fixed algorithm or an analyst's estimate produces; the index instead ranks CVEs by how exploitable they are, using real-world data from the HackerOne platform on which CVEs hackers discover most often. Customers can combine it with CISA's list of the 30 most exploited CVEs to patch the vulnerabilities that expose them most. HackerOne expects both intelligence features to be available on the platform by the end of the year.

Less admin for hackers

According to HackerOne, smoother workflows and clearer payments let hackers spend their time finding vulnerabilities and fitting into customers' existing development processes.

With the new bounty table ranges and bounty calculator, customers can define bounty ranges so that rewards are awarded consistently. The company says this gives hackers more transparency, builds trust between organisations and hackers, and improves motivation.

The Hacker API is intended to free up more time for vulnerability hunting by automating parts of the hacker's workflow. It provides immediate access to programme information, lets hackers view all vulnerabilities and follow report updates, and allows them to track earnings and payouts for tax reporting.

Enterprise workflow updates

HackerOne's security workflows bring access management, control and connections to external applications together inside the platform. The latest changes are:

• Organised homepage access: a single view with quick links to the different parts of a programme, such as the security page, settings, reports and an inbox that puts the most important reports first.
• Centralised user management: users can be added to the organisation's view and their access to several programmes and reports controlled from one place.
• Enhanced navigation: a report sidebar makes it easier to see and pass on report information while keeping the metadata needed for security actions close at hand, and mobile optimisation lets users work with the platform away from their workstations.
• Improved Jira integration: connections to any number of Jira instances, configurable for different teams and projects, removing the need for manual workarounds.

The company also expanded its capabilities for Amazon Web Services (AWS) customers during the quarter to strengthen cloud security, which it said would be a major theme of this year's Security@ conference. Product sessions at the event were set to cover support for cloud migrations, using data to strengthen security response programmes, and adding value to existing systems through integrations.