YesWeHack

YesWeHack, founded in Paris in 2015, runs a crowdsourced vulnerability discovery platform that connects organizations with a global community of independent security researchers through bug bounty programs, coordinated vulnerability disclosure (VDP), and pentest management. The core mechanics are the same as the US-based category leaders, HackerOne and Bugcrowd: researchers submit findings, the platform triages and routes them, and the customer pays out bounties for validated, in-scope vulnerabilities. YesWeHack’s differentiation is largely geographic and regulatory rather than technical — it operates as a European company under EU data-residency rules, which matters to public-sector and regulated buyers who are wary of routing vulnerability data through a US-headquartered vendor.

That positioning has translated into real public-sector traction, including a published bug bounty program for Sante Publique France, the French national public health agency, and customers across telecom, finance, and government in France, Canada, Singapore, and Spain. The company reports more than 500 customers and says annual recurring revenue grew roughly sixfold since its 2021 funding round, alongside a tripling of registered researchers on the platform — growth figures that are self-reported but consistent with the broader bug bounty market’s expansion as EU rules like NIS2 push more organizations toward continuous, externally sourced vulnerability testing.

YesWeHack raised a EUR26 million (~$28 million) Series C in 2024, led by Wendel with participation from Bpifrance and other European investors, bringing total disclosed funding to more than $50 million. That’s a meaningfully smaller capital base than HackerOne or Bugcrowd have raised, and the company is correspondingly smaller in scale, but it has built a durable, defensible niche as the European-native option in a category otherwise dominated by US platforms.

For CISOs specifically, the value case is straightforward: crowdsourced testing surfaces vulnerabilities that scheduled, point-in-time pentests miss, at a cost structure (pay for validated findings, not researcher hours) that scales differently than traditional consulting-based testing. The tradeoff is the same one that applies to any bug bounty platform — program design, scope discipline, and triage quality determine whether the output is signal or noise, and that quality is not something a funding round or headcount figure can verify from the outside.