HackerOne Services Now Listed in AWS Marketplace

HackerOne, the hacker-powered security platform, has entered AWS Marketplace. Customers of Amazon Web Services (AWS) can now find and buy HackerOne's services through the marketplace, a curated digital catalogue of software, data and services that run on AWS. HackerOne says it is among the first providers of comprehensive security solutions to quote and contract services there.

Organisations that were born in the cloud, and those moving to it, need strong security to keep the risk of cloud development down and to find and fix new vulnerabilities before attackers can use them. Operating in the cloud brings new cyber risks, and companies need to know where the gaps are so they can close them quickly. HackerOne's programmes are built to help with finding and managing vulnerabilities on AWS. According to the company, AWS customers can use its products and services to uncover security risks, vulnerabilities and misconfigurations sooner and to fix the most important problems with the right skills and the right team. Having the services in AWS Marketplace gives customers one central, simpler place to buy software and the services that go with it.

Marten Mickos, HackerOne's chief executive, said companies gain unprecedented flexibility and agility when they run applications and data in the cloud, but that their exposure to cyber threats changes as well. In his view, only a view from the outside in can show which vulnerabilities need fixing to prevent data breaches. HackerOne has offered this kind of service to the world's leading cloud-native companies for years, he said, preventing breaches by resolving tens of thousands of weaknesses. Building on its relationship with AWS, the company is now offering its application security services in an easy-to-consume form to every organisation that is moving to the cloud or started there. "We hack for good," Mickos said, adding that the aim is to protect digital assets in the cloud.

The vulnerabilities that matter most on AWS

HackerOne says it holds the largest and most robust database of valid vulnerabilities. That includes insight into Improper Access Control, Information Disclosure and Server-Side Request Forgery, which it identifies as the three most severe and most common weaknesses in applications hosted on AWS. On that basis it offers agile, cloud-optimised products, and its whole range of vulnerability assessment services will be on sale in AWS Marketplace.

Three products in the marketplace

HackerOne Response. Vulnerability disclosure programmes, considered industry best practice, direct hackers to report what they find through proper channels. HackerOne Response lets customers feed those findings straight into software development, knowing that reports arrive quickly and consistently and connect to existing security workflows so fixes happen sooner.

HackerOne Pentest. Running on AWS, Pentest shows customers threats specific to the cloud, covering cloud APIs, IAM risks, serverless deployments, DNS management and Amazon Simple Storage Service (Amazon S3), among other areas. Customers get live access on the platform to programme analytics such as response targets, submissions and spend. HackerOne says this takes customers past the traditional pentest model and produces reports ready for compliance with SOC 2 Type II, ISO 27001 and other standards, while lowering risk.

HackerOne Bounty. HackerOne's community has deep expertise in cloud security, and the hacker's point of view offers a fresh understanding of which services can be exploited and how attackers go after cloud infrastructure. Bounty, also now listed in AWS Marketplace, lets customers call on what HackerOne describes as the world's largest community of ethical hackers to test applications continuously. These hackers, whom the company describes as specialised, trusted and diverse, are paid rewards for finding vulnerabilities and reporting them for verification and fixing. HackerOne says this unstructured testing imitates the real attempts attackers make to exploit weaknesses, offering scale, speed and human intelligence that traditional testing lacks.