$ diff --left=hackerone --right=bugcrowd
Two bug-bounty platforms with separately scoped pen-test products. Neither publishes a dollar figure.
Neither publishes a starting price for their pen-test product. HackerOne wins on researcher reputation and the breadth of its bug-bounty platform; Bugcrowd wins on customer-success integration and triage SLAs. Pick by the platform you already run for bug bounty, since consolidation is the only real cost lever. Both vendors are quote-only as of June 2026.
Last verified June 2026
HackerOne Pentest
Pen test is sold as a separately scoped product line on top of (or independent of) the HackerOne Bounty platform. Pricing routes to a sales call. Researcher pool overlaps with the bug-bounty marketplace.
Bugcrowd Pentest as a Service
Same playbook: bug-bounty marketplace plus a separately scoped PtaaS product. Bugcrowd publishes more case-study language around triage SLAs and customer success; price still requires a quote.
$ heatmap --features
| Feature | HackerOne | Bugcrowd |
|---|---|---|
| Published price | ✗ | ✗ |
| PtaaS product line | ✓ | ✓ |
| Bug-bounty platform on same MSA | ✓ | ✓ |
| Web-app pen test | ✓ | ✓ |
| Mobile app pen test | ✓ | ✓ |
| Network pen test (internal) | ◐ | ◐ |
| Red-team engagement | ◐ | ◐ |
| Continuous retest included | ◐ | ◐ |