HackerOne thinks its freelance hackers can conduct penetration tests better than actual pentesting companies

The penetration testing market now sits at roughly $1 billion, according to CEO Marten Mickos, nearly ten times more than bug bounties.

A big player in one of the buzziest areas of cybersecurity has started offering penetration testing services, entering a market where firms deploy dedicated teams or use automation to perform the same tasks.

Since its founding in 2012, bug bounty program provider HackerOne has made its name by building a stable of freelance security researchers that poke around on client networks. By connecting hackers with customers including GM, Starbucks and the U.S. Department of Defense, HackerOne helps more than 1,200 organizations find and fix security vulnerabilities.

The San Francisco-based firm now says it’s expanding to offer crowdsourced pen-testing, a market CEO Mårten Mickos suggested now stands at roughly $1 billion. It’s a step up from the current bug bounty market, which he pegged at around $150 million.

“Most [penetration testing] companies suck,” Mickos said during a recent interview in New York City. “Our plan is to take the market share from pen test companies.”

HackerOne already is conducting pen tests with roughly a dozen clients, he said. Next, the company plans to recruit experienced penetration testers to boost its ranks, perhaps even by paying employed pen testers to do some work for HackerOne during their free time.

Market research firm Gartner defines penetration testing as going beyond vulnerability scanning, using multi-step and multi-vector attack techniques that not only find bugs, but work to exploit them. Bug bounty testing typically consists of finding and reporting vulnerabilities like cross-site scripting or misconfigured servers, though terms vary drastically depending on the agreement.

The size of the pen-testing market is difficult to pin down. Various forecasters have predicted that figure will grow to anywhere from $2.8 billion by 2023, to a high-end measurement of $12 billion by 2020.

“I can’t comment on the accuracy of any number like that, but the market is large,” said Toby Bussa, a Gartner analyst specializing in security and privacy. “It can be a challenge for companies to decide which vendor to work with.”

Security giants like Symantec and FireEye have offered pen testing for years, and other bug bounty players like Bugcrowd and Synack also conduct crowdsourced pen tests.

But the market is growing thanks in part to a number of compliance rules that require companies to conduct these kinds of services. The Payment Card Industry’s Data Security Standard, for example, explicitly requires penetration testing while other rules, like the Health Insurance Portability and Accountability Act, require companies to conduct a risk analysis. Pen testing usually satisfies that requirement.

Clients typically conduct a handful of pen tests every year. The software company Zenefits conducts at least two the penetration tests every year, the Wall Street Journal has reported, while others, like the security vendor Sumo Logic, a HackerOne client, holds pen tests at least every quarter.

Assessments might last a few hours to more than a week, depending on the terms of the agreement, and cost between $1,000 for the time of a single consultant to a six-figure dollar amount for larger services. HackerOne’s pen tests will be priced competitively, likely in the tens of thousands of dollars, and last between two to four weeks, resulting in a detailed report about problem areas, Mickos said.

“We’re not only doing this for compliance,” he said. “We’re going to find honest customers who really want to know what’s wrong.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure