HackerOne Pentest Pricing 2026: Hours, Tiers and the Prices in Public Records

HackerOne prints no price for H1 Pentest on its own website, but a US federal catalogue does: on GSA Advantage, purchased hours for a HackerOne pentest subscription are listed at US$128.36 each on the Essential tier and US$218.22 each on the Premium tier, sold by a reseller on a federal schedule contract and read on 13 November 2026. HackerOne's pricing page explains why its own site carries no number: "We scope pricing to what you actually need so you are not paying for a tier built for someone else. Your team gets a clear, itemized quote before any commitment."

Quick answer: A HackerOne pentest is bought in testing hours on top of an H1 Platform subscription, and the price arrives in an itemized quote. HackerOne publishes how a test is sized (40 hours per tester across two calendar weeks, in sizes named P40 to P200) and what the Essential and Premium tiers include. It does not publish a commercial price for either. The public dollar figures sit elsewhere: a reseller's federal catalogue prices for purchased pentest hours of the FedRAMP edition, listed "each," separately listed tester fees, a US$500,000 twelve-month platform listing on AWS Marketplace, and a handful of government contract values. None of them is a quote for a commercial buyer.

This page covers HackerOne's penetration testing products, H1 Pentest and H1 Agentic Pentest, which are sold separately from its bug bounty programs. It is built only from primary sources read on 13 November 2026: HackerOne's website, product documentation and customer terms, three cloud marketplaces, public procurement records in the United States, Canada and the United Kingdom, and archived copies of HackerOne's own pages. Where no public number exists, the page says so instead of estimating one.

HackerOne pentest pricing at a glance

How HackerOne prices a pentest: platform, product, hours

HackerOne describes its commercial model in one sentence on the pricing page: "A committed platform subscription plus prepaid credits you size up front." For a pentest buyer that breaks into three layers.

1. A platform edition. "You start with one H1 Platform edition, Professional, Enterprise, or Enterprise Plus, that acts as the foundation for everything else. From there you activate the products you need, such as H1 Bounty and H1 Pentest, on the same platform." Each edition card on the page ends in a "Talk to Sales" button.

2. A pentest product. The pentest page sells two. H1 Agentic Pentest pairs AI agents with human testers and, in HackerOne's words, "currently accelerates web application and API testing." H1 Pentest covers the workloads the agentic product does not yet cover, "network, mobile, cloud, desktop, and PCI segmentation," and any engagement that must be fully human-led.

3. Hours. Each test is sized in testing hours, and HackerOne's documentation says the output of scoping includes "A commercial quotation: How much this will cost."

The pricing page FAQ adds that expert and managed services, "including managed triage and validation, security advisory services, and live hacking events," are optional and "confirmed in the quote rather than bundled in by default."

One point works in the buyer's favour. Once quoted, the price of a HackerOne pentest does not move with the number of findings. The pentest FAQ states: "The HackerOne Pentest is set at a fixed cost. Given there are no bounties, and pentesters are compensated for their effort and time, the total cost is 100% fixed and predictable." The quote is custom; the invoice is not open-ended.

How a HackerOne pentest is sized: P40 to P200

HackerOne's documentation is unusually specific about effort. "All pentests, regardless of their size or tier, are designed to run over two calendar weeks (14 days)," and every tester on the team "is expected to commit a total of forty hours of effort during this period." A test therefore grows by adding people, not weeks, and each size is named after its total hours.

The size is not chosen by the buyer. The documentation says it "is calculated from the type of asset and qualities such as the number of functions that an application performs and the number of user roles," and that HackerOne evaluates the assets "to accurately determine the needed pentest size" before sending a quote. Scoping and setup take "48 hours to 7 business days," HackerOne "needs as little as three working days to source the pentest team" after the kickoff call, and the final report follows three to five business days after testing ends.

For a portfolio, the hours are pooled. "Most organizations will be developing and maintaining multiple systems, and therefore, will need multiple tests. This is addressed with a consumption contract. A set number of hours are purchased, and these hours are deducted from the total during the contract period." The platform dashboard shows hours used and remaining.

The people doing the work are members of HackerOne's community, selected and vetted for pentest work. The FAQ is direct about it: "Pentesters are not HackerOne employees. Tests are conducted by our community." HackerOne staff, called technical engagement managers, run the kickoff call, coordinate delivery, check the quality of results and hold the debrief.

Essential and Premium: what each tier includes

Every HackerOne pentest sits in one of two tiers, and the asset type decides which. The documentation gives the example of an Android application: when one is added to the scope, "the test will be defined as a premium test to reflect the increased complexity of testing." It also notes that "Customers on the Platform Entitlement (login required) will utilize the Premium Tier."

Source: the tier table in HackerOne's Pentest Phases and Terminology article, read 13 November 2026. The table marks both launch times as guaranteed and footnotes the selection row: HackerOne "can sort by citizenship and location based solely on self-reported information." The product page carried a similar comparison in an archived copy of 12 June 2025, with "Contact Us" where a price would be; the live product page no longer shows it.

Neither tier has a published commercial price. The federal catalogue below is the only place we found the two tiers priced apart.

The public dollar figures, and what each one means

GSA Advantage: federal catalogue prices for pentest hours

GSA Advantage is the US government's online catalogue for schedule contracts. A search for HackerOne returns five pages of items with HackerOne as the manufacturer, each sold by one source: Carahsoft Technology Corporation, on contract 47QSWA18D008F, which the listing shows running to 21 August 2028. We found seven items specific to pentesting. The names below are shortened: each begins "Designated FedRAMP," and the fee items end "1 Year Subscription + Support."

This is the closest thing to a HackerOne pentest price list in public view, and it needs six cautions before anyone budgets from it.

• It is the government edition. The items are the FedRAMP designated versions of HackerOne's products, sold to public sector buyers. A commercial quote can differ in either direction.

• It is a reseller's schedule price. Schedule prices are a starting point for federal buyers: the Federal Acquisition Regulation says "ordering activities may request a price reduction at any time before placing an order" (FAR 8.405-4).

• The unit is "each." The catalogue prices every item per unit and does not define the unit. An item named Purchased Hours reads as a price per hour, and that is how this page treats it.

• Hours and tester fees are separate items. The catalogue does not say how they combine. HackerOne's customer terms treat its own fees and payments to community members as different things. Ask the reseller which lines a quote will carry.

• The consumption item is unexplained. The catalogue does not say what the "$78K" in its name measures or why the item is listed at US$109,108.31.

• The catalogue is undated. It does not date its prices. Its product names predate the platform editions on HackerOne's current pricing page, so the list may be older than the packaging a buyer is quoted today.

With those cautions, the catalogue gives a federal buyer two unit prices to hold against a quote, and HackerOne's documentation gives the hours in each test size. This page does not multiply them into a price per test: the catalogue does not say whether the tester fee items are charged on top of the hours, a platform edition is a separate line, and a schedule price can be reduced for an order. Ask for the rate per hour and every fee line in writing, then do the multiplication on your own quote.

AWS Marketplace: US$500,000 for the platform

HackerOne has one listing on AWS Marketplace, sold by HackerOne itself. It names H1 Pentest among the products on the platform and shows a single price: a 12-month contract for the "HackerOne Platform" dimension at US$500,000.00, plus a usage dimension, "Rewards overage fee," at US$0.01 per unit. The overview tells buyers what to do next: "For custom pricing, EULA, or a private contract," contact HackerOne "for a private offer." The refund policy is one line: "There are no refund options available."

That figure is one list price for the entire platform, not the price of a pentest, and private offers are not public. It tells a buyer two useful things: HackerOne can be bought through an AWS account, and the listing steers buyers toward a negotiated private offer. On the other two large clouds, a search of Microsoft Marketplace returned one HackerOne entry, a Microsoft Entra ID application with no price, and a search of Google Cloud Marketplace returned no HackerOne listing.

Government contract records

Public contract databases show what some governments have paid HackerOne, though rarely with the scope attached.

• United States. A recipient search of USAspending.gov returns 29 prime contract awards to HackerOne Inc. with start dates from March 2016 to February 2026 and combined obligations of about US$9.1 million. Most are described as bug bounty, crowdsourced vulnerability discovery or vulnerability disclosure work. Two are labelled as penetration testing: a General Services Administration purchase order described as "LOGINGOV CROWDSOURCED PENTEST" with US$60,000 obligated between March and December 2018, and a Department of Defense delivery order described as "INFORMATION TECHNOLOGY SECURITY PENETRATION TESTING" for US$441,798 from September 2020 to September 2021, issued under the same parent contract as the department's bug bounty and crowdsourced vulnerability disclosure orders.

• Canada. The federal contract disclosure portal lists a Treasury Board of Canada Secretariat contract with the reseller Softchoice Corporation, dated 20 April 2022 and running to 19 April 2023, with a total value of $35,599.28 and the comment "Subscription to HackerOne Pentest Pro software." The record gives no currency code or scope.

• United Kingdom. Contracts Finder returns six awards naming HackerOne as the supplier, for vulnerability reporting platforms, bug bounty and ethical hacking programmes. None is described as a penetration test. The G-Cloud catalogue returns 0 results for "hackerone."

These are contract totals, not unit prices. Without the number of applications, hours and testers behind each one, they cannot be turned into a cost per test, and this page does not try.

What archived pages show

HackerOne has not published and then withdrawn a price list, as far as the archive shows. The Internet Archive returned no capture of the current pricing page when checked on 13 November 2026. Eight archived copies of the pentest product page, one from each year between the capture of 17 December 2019 and the capture of 6 March 2026, carry no dollar figure.

Third-party review and procurement sites publish price ranges for HackerOne today. Those are estimates of what some buyers paid, not HackerOne list prices, and none is repeated here.

Terms that change the real cost

The rate is one input. The terms around it decide what the hours are worth. All quotations in this section are from HackerOne's documentation, its pricing page or its Customer Terms and Conditions (effective 11 May 2026).

The retest window depends on the tier. HackerOne's retesting guide, dated 13 June 2025, says: "The length of the remediation period depends on the type of pentest (30 calendar days for Essential, 90 calendar days for Premium). Customers can request unlimited retests on vulnerabilities during the remediation period at no extra cost." The guide for customers, dated 24 March 2026, gives the same period as "typically lasting 30 or 90 calendar days." That is a strong term. The pentest FAQ, an older article dated 17 July 2024, describes it differently: "There is a 60-day window to initiate two retests per report at no additional cost." The pages do not agree, so have the window and the number of retests written into the Order Form.

Late retests are paid per retest request. After the remediation period ends, retests continue "as long as your service with the HackerOne platform is still active," but they are no longer included: "You can set a fee (minimum $50 USD) for the team to retest findings," and the full amount goes to the tester. A team that fixes findings over several quarters should price that in.

Hours live inside a contract period. Purchased hours "are deducted from the total during the contract period." HackerOne's public pages do not say what happens to hours that are still unused when the period ends, so ask, and get the answer in the Order Form.

The platform edition is its own line. The pentest runs on an H1 Platform edition, and the editions differ in what they include. The pricing page lists an "attestation letter" among the Enterprise edition's features, while the pentest FAQ says "we offer a letter of attestation for our pentest assessments." Confirm which edition your quote assumes and whether the letter depends on it.

Payment and exit. Fees are due "within thirty (30) calendar days of the date of HackerOne's invoice unless otherwise stated on the Order Form," with interest on undisputed late amounts "at a rate of 1.5% per month or the maximum rate permitted by law, whichever is less." Fees "are non-refundable, except as otherwise specifically provided herein or in the applicable Order Form." Under the General Terms, an Order Form "may be terminated by HackerOne or the Customer solely if the other party fails to cure a material breach" within 30 calendar days of written notice. The terms leave the start and end dates of the subscription to the Order Form and do not mention renewal, so read the Order Form for both.

Agentic products are metered separately. The pricing page labels H1 Continuous Testing, H1 Remediation and H1 Code Security Audit "Paid with credits." HackerOne's documentation calls Agentic Credits "the consumption currency for HackerOne's agentic products" and says "Your entitlement is set by your platform tier and any additional credits you have purchased." Agentic products stop when the entitlement is used up, overage "is off by default," and notices go out at 50%, 75%, 90% and 100%. The price of a credit, and the number of credits a continuous test consumes, are shown in a pricing menu inside the platform and are not public.

Pentest cost versus bug bounty cost at HackerOne

Searches for HackerOne pricing often mix the two products, and they are budgeted in opposite ways.

A pentest is a fixed fee for a fixed effort. The testers are paid for their time, no bounties are awarded for findings, and retests inside the window are included. HackerOne's FAQ is candid about what that buys: "The goal of HackerOne Pentests is to help meet regulatory compliance and pass vendor assessments through a structured and checklist-driven process." Testers "look for coverage of the scope" and report low and informative findings as pentest practice requires.

A bug bounty program has a variable part. The pricing page explains that "Customers set their own reward table and approve every payout," that rewards "sit separate from the platform subscription," and that "A rewards service fee applies to the bounty program and is confirmed in the quote." The usage dimension on the AWS Marketplace listing, a rewards overage fee, belongs to this side of the business. HackerOne's own FAQ sends buyers who want to pay for critical findings instead of coverage toward its bounty products.

The practical point for a pricing comparison: quote the pentest as a pentest. Our guide to penetration testing versus bug bounty covers when each one fits.

How to compare a HackerOne quote with a fixed-price quote

An hours quote and a fixed-price quote describe the same purchase in different units. Converting one into the other takes five steps.

1. Get the size and the tier in writing. Ask for the P size, the number of testers, the tier, and the assets, functions and user roles the sizing assumed.

2. Separate the lines. A HackerOne quote can carry a platform edition, pentest hours, Agentic Credits and optional managed services, and the federal catalogue also lists tester fees. Compare only the pentest lines with a pentest proposal, then add the platform line to see the cost of the year.

3. Convert hours to tester-days. A P80 is 80 hours, or ten 8-hour days, split across two testers in two weeks. A fixed-price proposal should state its own effort the same way. Our guide to decoding two pentest quotes into scope, days and day rate shows the arithmetic.

4. Match the deliverables. Line up the report type (standard or custom), the letter of attestation, the retest window, the launch time, and who does the testing: community testers matched to the asset, or a named in-house team.

5. Price the year, not the test. Add retests requested after the window, hours left unused at the end of the period, and the platform subscription under each model. For a portfolio, the enterprise PTaaS quote worksheet lays out the columns.

Questions worth sending to HackerOne before signing:

• What is our rate per hour on each tier, and is there a separate fee for the testers?

• Which P size does each of our assets need, and what happens if the scope proves larger during testing?

• Which platform edition does the quote assume, and what does the pentest need from it?

• What happens to purchased hours that are unused when the contract period ends?

• Is the retest window 30, 60 or 90 days for our tests, and how many retests per finding does it include?

• Does the Order Form contain renewal language, and what is the notice period?

For published prices across the wider market, see PTaaS pricing compared. The same exercise for a credit-based platform is in Cobalt pricing 2026, and the 2026 penetration testing cost guide covers the market as a whole.

When HackerOne's model is the better buy

Hours on a platform are a reasonable answer to several real problems, and a fair comparison says where.

• You already run a bounty or disclosure program on HackerOne. Pentest findings land in the same inbox and workflow as everything else. HackerOne's pitch is that "Bounty, pentest, continuous testing, and remediation run on a single license and workflow."

• You run many tests a year across asset types. A pool of hours under one consumption contract can be drawn down across web, API, network, mobile, cloud and desktop tests, and earlier tests can be cloned.

• You buy for a US federal agency. HackerOne's products are listed on GSA Advantage in a FedRAMP designated edition, with schedule prices an agency can order against.

• You need testers with a specific location or citizenship. The Premium tier selects testers by geolocation, citizenship and time zone.

• You need a recognised accreditation on the supplier. HackerOne describes itself as "a CREST-accredited and CSA-licensed penetration testing provider."

The model fits less well when the plan is one or two applications a year, when finance needs a number before any sales conversation, or when the buyer wants the same employed testers on every engagement. Those are the cases where a published fixed price and an in-house team are easier to buy.

Stingrai's published prices for the same decision

Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters. The team includes a researcher with 400+ Hall of Fame reports at Apple, Facebook, Google, Yahoo and the US Department of Defense, and holds 18 published CVEs. Its prices for web application testing are fixed and public on the pricing page, and each covers one web application and associated APIs.

• Autonomous Pentest. US$3,000 per assessment, or US$650 a month on a 12-month plan. Testing is run by Snipe, Stingrai's autonomous AI agent for web applications and associated APIs, across up to 200 API endpoints or dynamic pages and up to 3 user roles, with same-day results, automated retests and AutoFix pull requests. The deliverable is a pentest report.

• Hybrid Pentest. US$6,800 per assessment, or US$1,275 a month on a 12-month plan. Stingrai's penetration testers and Snipe test the same application together throughout, adding manual testing, human context for hunting novel bugs and vulnerability chaining to everything in the Autonomous Pentest. The one-time engagement includes 12 monthly vulnerability scans after the pentest; the continuous plan runs monthly Snipe testing, human-verified, with a quarterly deep dive by human penetration testers. The deliverable is a human-validated pentest report and an attestation letter that supports SOC 2, HIPAA and PCI DSS programs.

• Enterprise. Custom quote for a full attack surface. Mobile, AI and LLM, cloud, internal and external network, Active Directory, Wi-Fi, phishing, physical and red team work is scoped per engagement, human-led or hybrid, one-time or continuous.

On human-led engagements the testers are Stingrai's own: two named penetration testers from a team holding OSCE³, OSWE, OSEP and CREST CRT certifications, reviewed by the team lead, who post each finding to the PTaaS portal as it is confirmed, with a working proof of concept, and stay reachable by live chat during the test. Retesting of remediated findings is included. Both one-time tests and continuous programs are sold, so the choice follows the release rate and the audit calendar. The web application penetration testing page describes the method.

Sources: HackerOne's pricing page, documentation and GSA Advantage listing, and Stingrai's pricing page, read 13 November 2026. The products are built differently, so the table compares published price and terms, not depth. For a fuller side by side, see HackerOne Pentest vs Stingrai, and for other platforms, HackerOne alternatives.

Frequently Asked Questions

How much does a HackerOne pentest cost in 2026?

HackerOne does not publish a price for H1 Pentest or H1 Agentic Pentest; each is sold by itemized quote on top of an H1 Platform subscription. A pentest is sized in hours, from 40 hours (P40) to 200 hours (P200). The only public figures for pentest hours are on the US federal catalogue GSA Advantage, where a reseller lists purchased hours for the FedRAMP edition at US$128.36 each on the Essential tier and US$218.22 each on the Premium tier. The catalogue's unit is "each," which this page reads as per hour. Those are federal schedule prices, not commercial quotes.

Does HackerOne publish its pricing?

No. HackerOne's pricing page lists three platform editions, Professional, Enterprise and Enterprise Plus, each with a Talk to Sales button, and says pricing is scoped to each program with an itemized quote before any commitment. Its AWS Marketplace listing shows one figure, US$500,000 for a 12-month HackerOne Platform contract, and directs buyers to a private offer for custom pricing.

How is a HackerOne pentest sized?

By hours. HackerOne's documentation says every pentest is designed to run over two calendar weeks and every tester commits 40 hours, so tests are named by total hours: P40 is one lead tester, and P80, P120, P160 and P200 add one supporting tester each. The size is calculated from the type of asset, the number of functions an application performs and the number of user roles. Organizations with several systems buy a set number of hours that are deducted during the contract period.

What is the difference between the Essential and Premium pentest tiers?

Essential covers web applications, external networks and APIs, with testers selected on availability, a program launch in 7 days, standard reports and retesting included for 30 days. Premium adds internal networks, Android, iOS, cloud and code security audit, selects testers by geolocation, citizenship and time zone, launches in 4 days, and includes custom reports, a dedicated engagement manager and retesting for 90 days. Customers on HackerOne's platform entitlement use the Premium tier.

Is retesting included with a HackerOne pentest?

Yes, inside a window. HackerOne's retesting guide gives a remediation period of 30 calendar days for Essential and 90 calendar days for Premium, with unlimited retests at no extra cost during that period. Its older pentest FAQ describes a 60-day window with two retests per report. After the remediation period, the customer sets a fee of at least US$50 per retest request, paid to the tester.

Is HackerOne on AWS Marketplace or GSA Advantage?

Both. HackerOne sells one listing on AWS Marketplace, priced at US$500,000 for a 12-month platform contract, with private offers for custom pricing. On GSA Advantage, the reseller Carahsoft lists HackerOne's FedRAMP designated products on contract 47QSWA18D008F, including seven pentest items. A search of Microsoft Marketplace returned a Microsoft Entra ID application with no price, and Google Cloud Marketplace returned no HackerOne listing.

What are HackerOne Agentic Credits?

Agentic Credits are a prepaid pool that pays for HackerOne's agentic products. The pricing page marks H1 Continuous Testing, H1 Remediation and H1 Code Security Audit as paid with credits, every platform edition includes an allotment, and more can be added at any time on the same term as the platform subscription. The price of a credit is not public. Human-led H1 Pentest work is sized in hours, not credits.

Is a HackerOne pentest priced like a bug bounty?

No. HackerOne's pentest FAQ says the pentest is set at a fixed cost, with no bounties, and that testers are compensated for their effort and time. A bug bounty program adds researcher rewards, which the customer sets and approves, and a rewards service fee that is confirmed in the quote. The two should be budgeted and compared separately.

How does HackerOne pentest pricing compare with Stingrai pricing?

HackerOne sells pentest hours by quote on a platform subscription, and the only public prices for its pentest hours are a reseller's federal catalogue figures for the FedRAMP edition. Stingrai publishes fixed prices for one web application and associated APIs: the Autonomous Pentest is US$3,000 one-time or US$650 a month, and the Hybrid Pentest, with human penetration testers and Snipe testing together, is US$6,800 one-time or US$1,275 a month. Other scopes are quoted by both companies.

Related reading

• HackerOne Pentest vs Stingrai: community vs in-house testing and compliance evidence

• HackerOne alternatives: pentest and bug bounty platforms compared

• HackerOne vs Bugcrowd for penetration testing

• Cobalt pricing 2026: credits, tiers and what a pentest costs

• PTaaS pricing compared: published prices and credit models

• Two pentest quotes, 3x apart: decode any proposal into scope, days and day rate

• Penetration testing vs bug bounty: when each one fits

• Penetration testing cost: prices by scope and compliance driver

Sources

1. HackerOne. H1 Pricing. Read 13 November 2026. hackerone.com/h1-pricing

2. HackerOne. H1 Agentic Pentest and H1 Pentest product page. Read 13 November 2026. hackerone.com/product/pentest

3. HackerOne. Pentest Phases and Terminology, Pentest FAQs, Retesting Pentests, Manage Pentest Retesting, Your Pentest Team and Agentic Credits. Product documentation, read 13 November 2026. docs.hackerone.com

4. HackerOne. Customer Terms and Conditions and General Terms and Conditions, effective 11 May 2026. hackerone.com/terms

5. HackerOne. Autonomous pentesting solution page. Read 13 November 2026. hackerone.com/solutions/autonomous-pentesting

6. US General Services Administration. GSA Advantage, HackerOne items sold by Carahsoft Technology Corporation on contract 47QSWA18D008F. Read 13 November 2026. gsaadvantage.gov

7. Federal Acquisition Regulation, 8.405-4, Price reductions. acquisition.gov

8. AWS Marketplace. HackerOne, sold by HackerOne. Read 13 November 2026. aws.amazon.com/marketplace

9. Microsoft Marketplace and Google Cloud Marketplace searches, 13 November 2026.

10. USAspending.gov, contract awards to HackerOne Inc., searched 13 November 2026. usaspending.gov

11. Government of Canada. Search Government Contracts over $10,000. Searched 13 November 2026. search.open.canada.ca/contracts

12. UK Contracts Finder and the G-Cloud catalogue, searched 13 November 2026. contractsfinder.service.gov.uk

13. Internet Archive. Captures of HackerOne's pentest product page from 17 December 2019 to 6 March 2026, starting with the capture of 17 December 2019.

14. Stingrai. Plans and Pricing. stingrai.io/pricing

Talk to Stingrai

Bring the hours quote you are comparing. On a free scoping call Stingrai will size the same application by roles, pages and endpoints, say whether an Autonomous Pentest, a Hybrid Pentest or a human-led engagement fits the audit and the release rate, and put a fixed price next to the hourly math. Get a quote or read the published pricing.