# HackerOne vs Bugcrowd for buying a pentest Source: https://pentestcompare.com/compare/hackerone-vs-bugcrowd/ Publisher: Excession Labs (pentestcompare.com) Last updated: 2026-11-09 HackerOne vs Bugcrowd for buying a pentest: price, retest terms, launch time, scope and sample reports from vendor pages checked 9 November 2026. No winner. > **Short answer:** HackerOne and Bugcrowd both sell pentests as a service on a crowdsourced platform, and neither publishes a price. They differ on retests and timing. HackerOne docs give unlimited retests in a remediation window of typically 30 or 90 days. Bugcrowd Standard gives one year of retesting with one report revision, and tests launch in under 72 hours. Vendor pages checked 9 November 2026. This page compares HackerOne and Bugcrowd as places to buy a penetration test. It does not cover hacker earnings or bug bounty program choice, which the [bug bounty vs pentest guide](/guides/bug-bounty-vs-pentest/) explains. Facts come from vendor pages read on 9 November 2026. ## How do HackerOne and Bugcrowd compare at a glance? Both sell pentests as a service through a platform, both use quote-based pricing, and both pair human testers with AI in some form. | Field | HackerOne | Bugcrowd | |---|---|---| | Pentest product | H1 Pentest (fully human-led); H1 Agentic Pentest (AI agents with human review of every agent finding) | Pen Test as a Service in Standard, Plus and Max tiers; testers matched by CrowdMatch AI | | Price | Not published; all tiers route to sales | Not published; purchase options named: subscription, flat-rate or pay for impact | | Scope listed | Web app, API, cloud, network, mobile, AI apps (agentic tier: web apps and APIs only) | Web, mobile, network, API, IoT, cloud and AI targets | | Start or launch time | Not published on the product page | Tests launch in under 72 hours; Standard: within 3 business days | | Report time | Final report 3 to 5 business days after testing ends (HackerOne docs) | Not published | | Retesting | Unlimited during the remediation period (typically 30 or 90 days) per docs | Standard: 1 year with one report revision | | Sample report | Not published | Public, for the Standard web app test | Sources: [HackerOne pricing](https://www.hackerone.com/pricing), [HackerOne pentest page](https://www.hackerone.com/product/pentest), [Bugcrowd PTaaS](https://www.bugcrowd.com/products/pen-test-as-a-service/). The full fields are on the [HackerOne](/providers/hackerone/) and [Bugcrowd](/providers/bugcrowd/) profiles. ## Which fits which need? The dataset's best-fit notes point to different buyers. A to Z: - Bugcrowd fits teams that want a platform-managed pen test with tiered scope and a path to continuous testing or bug bounty. - HackerOne fits organizations that already use HackerOne or want pentests from the same vendor as a bug bounty or disclosure program, and that want a choice between fully human and AI-assisted testing. If you only need a one-off test of one web app, compare both with providers that publish a price. The [penetration testing cost guide](/guides/penetration-testing-cost/) and [Cobalt alternatives](/compare/cobalt-alternatives/) list them. ## Where do they differ on price, retests and start time? Price is a tie because neither publishes one. Retests and timing are where the two vendors differ in writing. The pricing pages add a few details. HackerOne's only metered unit is monthly automations on its platform tiers, which is not a pentest price. Bugcrowd says external web app and network tests can be bought through AWS Marketplace, and that advanced targets (IoT or hardware, crypto, binary, OT, onsite) cost extra on the Plus tier. The extra amounts are not published. Bugcrowd's launch figure is time to launch, not time to the final report. HackerOne's docs figure is report delivery after testing ends, not time to start. The two numbers measure different events, so you cannot subtract one from the other. For retests, the question is how long you need. HackerOne's docs describe unlimited retests inside the remediation period, typically 30 or 90 days, usually completed in 72 hours or less once claimed. After the window a fee, with a minimum of $50, can be set. Older docs and posts show 60-day and two-retest wording, so ask which applies. Bugcrowd Standard allows retesting for one year with one report revision, for web apps, networks and APIs only. Plus extends the same terms to every asset type, and Max matches Plus. > **Retest scenario with invented dates:** This is a demonstration. No real customer system was tested. Suppose a test ends on 1 March and the team ships fixes on 20 May. A 30-day remediation window would have closed on 31 March, and a 90-day window on 30 May. A one-year retest period would still be open. The dates decide which vendor's wording covers the retest. Put your own fix timeline next to each quote. ## What changes if you want bug bounty instead of a pentest? A pentest is a time-boxed test of a defined scope by selected testers. A bug bounty is an open program that pays for valid findings. Both vendors sell both, which is why searches for the two names often return bounty-hunter threads. Bugcrowd's Max tier pairs methodology-based testing with bug bounty. HackerOne routes pentest and program buyers through one platform. If you want a program, use the [bug bounty vs pentest guide](/guides/bug-bounty-vs-pentest/) to decide first. Bounty pricing is outside our dataset, so we publish none. ## What to ask both vendors Send both vendors the same scope and ask for these items in writing: 1. The total price for your assets, the unit, the term and the quote expiry date. 2. The retest window, the number of retests, the report revisions and the fee after the window. 3. What the start or launch time measures, and the date of the final report. 4. Which asset types the retest terms cover. 5. Who tests, how they are matched to your stack, and who reviews AI-assisted findings. 6. A sample or redacted report. Bugcrowd links one for the Standard web app test. 7. Credentials. Bugcrowd's site claims CREST accreditation, but we checked no CREST directory entry, so we list none for either vendor. The [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) list and the [scoping checklist](/tools/scoping-checklist/) cover the rest. For HackerOne against Cobalt, read [Cobalt vs HackerOne](/compare/cobalt-vs-hackerone/). Found an error? [Send a correction](/methodology/#corrections). ## Questions ### Is Bugcrowd or HackerOne cheaper for a pentest? Neither publishes a pentest price, so the dataset cannot say. HackerOne's pricing page routes every tier to sales. Bugcrowd's PTaaS page names subscription, flat-rate and pay-for-impact options but lists no amounts. Send both the same scope and compare written quotes. ### Which one has the better retest terms? The terms differ, so neither is better on paper. HackerOne docs list unlimited retests during the remediation period at no extra cost. Bugcrowd Standard lists one year of retesting with one report revision, for web apps, networks and APIs only. Match each against how long your fixes take. ### Do HackerOne and Bugcrowd both offer bug bounty and pentest? Yes. Both started as crowdsourced platforms and now sell pentests too. Bugcrowd's Max tier pairs methodology-based testing with bug bounty. HackerOne offers a human-led H1 Pentest and an H1 Agentic Pentest. This page covers the pentest product only. ### Does either vendor publish a sample pentest report? Bugcrowd links a sample report for the Standard web app test from its PTaaS page. HackerOne's pentest product page does not offer one. Ask HackerOne for a redacted report before you buy. ## Sources - [HackerOne pricing](https://www.hackerone.com/pricing) - [HackerOne pentest product page](https://www.hackerone.com/product/pentest) - [HackerOne docs: retesting pentests (found via search; not opened directly)](https://docs.hackerone.com/en/articles/8541386-retesting-pentests) - [Bugcrowd PTaaS](https://www.bugcrowd.com/products/pen-test-as-a-service/) - [Bugcrowd homepage](https://www.bugcrowd.com/)