# HackerOne: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/hackerone/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

HackerOne at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

HackerOne offers pentest as a service in two forms: a human-led H1 Pentest and an H1 Agentic Pentest where AI agents work under human review. Results stream into the HackerOne platform and a final report closes the engagement.
- Website: https://www.hackerone.com/
- Type: Crowdsourced platform
- Delivery: hybrid. H1 Pentest is fully human-led; H1 Agentic Pentest pairs AI agents with human pentesters who review every agent finding.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: custom quote
- Pricing note: No dollar amounts on the pricing page; all tiers route to sales. The only metered unit shown is monthly automations for the platform tiers, which is not a pentest price. The agentic tier currently covers web apps and APIs only; the wider scope list applies to the human-led H1 Pentest.
- Turnaround: Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. (Docs figure is report delivery after the testing phase, not time to start.)
- Retesting: Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS, DORA, NIST CSF 2.0, GDPR
Good fit when: Organisations that already use HackerOne or want pentests from the same vendor as a bug bounty or disclosure program, and that want a choice between fully human and AI-assisted testing.
Tradeoffs: Pricing is quote-only, no sample report is offered and no testing lead time is published. Retest terms differ between product page, docs and older posts.
Last checked: 2026-11-09
Sources:
- HackerOne pricing: https://www.hackerone.com/pricing (checked 2026-11-09)
- HackerOne pentest product page: https://www.hackerone.com/product/pentest (checked 2026-11-09)
- HackerOne docs: retesting pentests (found via search; not opened directly): https://docs.hackerone.com/en/articles/8541386-retesting-pentests (checked 2026-11-09)