Pentesting & Bug Bounty

Penetration testing firms, bug bounty platforms and vulnerability disclosure programs.

5 results in Pentesting & Bug Bounty

Active Pro listings from this category appear first. Your sort applies within Pro and Free results.

Bishop FoxPentesting & Bug BountyBishop Fox is an offensive security company offering penetration testing, Continuous Security Testing delivered on its Cosmos platform and portal, red team exercises and AI security testing, and it publishes open-source tools such as Sliver and CloudFox.CommercialWeb platformContact sales

Views · 7 daysTop 16%

44 views

View details

BugcrowdPentesting & Bug BountyBugcrowd runs bug bounty, vulnerability disclosure and penetration-testing-as-a-service programs through a managed platform and vetted researcher community.CommercialSoftwareContact sales

Views · 7 daysTop 29%

21 views

View details

HackerOnePentesting & Bug BountyHackerOne supports vulnerability disclosure programs and bug bounty programs with defined researcher rules.CommercialSoftwareFreemium

Views · 7 daysTop 29%

25 views

View details

NucleiVulnerability ManagementNuclei is an MIT-licensed command-line vulnerability scanner from ProjectDiscovery. YAML templates describe each check across HTTP, DNS, network, SSL, headless, file, JavaScript and code protocols, for CI pipelines and bulk scans.Open sourceSoftwareFreemium

Views · 7 daysNo views in 7 days

0 views32,650 stars

View details

Trail of BitsPentesting & Bug BountyTrail of Bits is a security firm doing audits and research in cryptography, blockchain, AI/ML and application security, with 200+ open-source repos.CommercialSoftwareContact sales

Views · 7 daysTop 29%

34 views

View details

Focused collections

Shortlists for Pentesting & Bug Bounty

Explore collections with tools relevant to this category, grouped by deployment, source model or workload.

IT tools with an API →

4 matching tools from this category

How to choose pentesting & bug bounty tools

Pentesting and bug bounty services bring human attackers to your systems under agreed rules: consultancies run scoped penetration tests, red team exercises and code audits, while platforms manage crowdsourced bug bounties and vulnerability disclosure programs. They find issues that automated scanners miss, such as logic flaws and chained attacks. Vulnerability management tools track and prioritize findings, whereas this category is about obtaining them through skilled testing.

Read the guide

Who uses these tools

Security leaders commissioning annual penetration tests
Product security teams running public bug bounties
Compliance managers needing third-party test reports

Capabilities to compare

Scoped web, mobile, cloud and network testing
Red team and adversary emulation engagements
Managed triage of researcher submissions
Disclosure policy hosting and safe harbor terms
Retesting and remediation verification

Operating considerations

Scope, rules of engagement and legal authorization
Report quality and evidence for auditors
Bounty budget and payout predictability
Triage load from low-quality submissions
Testing impact on production availability

Selection checklist

Write a clear scope listing assets, environments and exclusions before requesting proposals or launching a program.
Ask for sample reports and check that findings include reproduction steps, impact and practical remediation guidance.
Start with a private bounty or disclosure policy before opening a public program to all researchers.
Confirm that testers' specialisms, such as cloud, mobile or cryptography, match the systems in scope.

What belongs in this category: Providers fit here when they deliver offensive security testing by people, as consulting engagements, managed bounty programs or disclosure platforms, rather than selling scanners or patch tracking software.

Pentesting & Bug Bounty on iThub in figures

iThub lists 5 tools in Pentesting & Bug Bounty. 1 of 5 is open source, 2 of 5 have a free, freemium or open-source pricing model and 4 of 5 offer an API.

Tools listed: 5
Open source: 1
Free to start: 2
With an API: 4
Web app: 1
Desktop app: 1

Recently added: Bishop Fox, Nuclei, Trail of Bits, Bugcrowd

Typical use cases

Annual penetration test to satisfy a compliance audit
Security review of a smart contract or cryptography library
Running a public vulnerability disclosure program
Red team exercise to test detection and response

Trade-offs to model

Consultancy tests give a fixed scope and a formal report, while bounty programs provide continuous coverage with variable cost.
Public bounties attract many researchers, but they generate more duplicate and low-value reports than invite-only programs.

Common mistakes

Launching a public bounty before the team can triage and fix reports quickly, which frustrates researchers.
Commissioning a test with a deliberately narrow scope just to obtain a clean report for auditors.

Browse vulnerability management tools →Browse application security tools →See security tools for MSPs →

Decision resources

Continue the technical evaluation

Use the resources that match your decision stage. Profile data and linked sources were refreshed through November 10, 2026.

Evaluation methodology · Corrections process