HackerOne growth playbook

Choose one URL as the CTEM hub (the Knowledge Center address suits a definition), merge the best of both guides into it, 301-redirect the other, and add a short, quotable definition at the top with a dated, named expert author. Link the hub from the CTEM solution page and the main menu, and link the ten-plus CTEM posts (program roadmap, board metrics, CTEM vs vulnerability management, CTEM for AI, enterprise) as numbered spokes that each link back. Use the 10th-edition report data as the hub's evidence.

One strong page earns the links and citations that two half-strong pages split, and a clear hub tells answer engines which page is HackerOne's definition.

[ ] One hub URL chosen
[ ] Other guide merged and 301-redirected
[ ] Two-sentence definition at the top
[ ] Named expert author and review date
[ ] Linked from the CTEM solution page and menu
[ ] Ten spoke posts linked both ways
[ ] 10th-edition data cited
[ ] Monthly check of six CTEM questions

• Losing traffic from the redirected page

  Redirect section by section to matching anchors on the hub.

• Hub grows too long

  Keep the hub to definitions and stages; depth lives in the spokes.

• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source
• Competitor researchRivals' own homepages: YesWeHack, "the global leader in Offensive Security and Exposure Management"; Cobalt, "Continuous Offensive Security Testing"; Synack, "AI-powered penetration testing with elite human researchers" on a PTaaS platform; Bugcrowd, "#1 Crowdsourced Cybersecurity Platform"; Intigriti, "Leading global bug bounty platform".See the research Source
• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source

Add BlogPosting markup sitewide (headline, datePublished, dateModified, author, publisher), create author pages for the researchers, engineers and leaders who write, and show the expert's name on new posts.

Answer engines and search favour content with clear authorship and freshness, and security buyers trust named practitioners.

• Experts are busy

  Byline the reviewer when an expert reviews a draft.

• Site checkA sample of 29 blog posts across the sitemap: all are marked up as a generic WebPage, none as Article or BlogPosting, so dates and authors are not given to search and answer engines in structured form. The sitemap has concept comparisons ("bug bounty vs VDP", "CTEM vs vulnerability management") but no pages comparing HackerOne with other vendors.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source

Add a banner to each old edition ("New: the 2026 Security Research Report") linking to the 10th edition, add meta descriptions, and plan industry cuts of the 10th edition to replace them.

Old report pages still rank; pointing them at the new edition turns that traffic into report downloads.

• Losing industry-specific rankings

  Keep the pages until each industry cut exists.

• SitemapThe sitemap (checked October 22, 2026) lists 1,876 URLs: 1,287 blog posts (96 last updated before 2021, including 2018 report write-ups such as "118 fascinating facts" from the Hacker-Powered Security Report 2018), 158 press releases, 98 event pages, 61 Knowledge Center articles and 17 report pages. 7th- and 8th-edition industry reports are still listed (automotive, financial services, retail, government, advanced technologies) next to the new 10th edition; the financial services edition page has no meta description.Source
• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source

Publish one short page per headline finding: the stat, a chart, the method line, what it means and a link to the full report. Use them in social and sales follow-ups.

Each finding page becomes a citable source that brings readers back to the report.

• Fewer gated downloads

  Keep the full data and benchmarks behind the form.

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• News coverageNews in the last 30 days: 16 mentions, led by coverage of the 10th-edition report (October 17, 2026).Source

Audit the 96 posts: update the ones that still earn traffic or links, merge near-duplicates, redirect the rest to current pages, and add "last reviewed" dates.

A tighter archive concentrates authority on current pages and keeps old positioning out of answers.

• Losing backlinks

  Redirect to the closest current page.

• SitemapThe sitemap (checked October 22, 2026) lists 1,876 URLs: 1,287 blog posts (96 last updated before 2021, including 2018 report write-ups such as "118 fascinating facts" from the Hacker-Powered Security Report 2018), 158 press releases, 98 event pages, 61 Knowledge Center articles and 17 report pages. 7th- and 8th-edition industry reports are still listed (automotive, financial services, retail, government, advanced technologies) next to the new 10th edition; the financial services edition page has no meta description.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source

Cut the webinar into five 60-second clips (one finding each), post them on LinkedIn with the finding pages, and send a recap email to registrants who did not attend.

Repurposing one recording multiplies reach at almost no cost and keeps the report in the conversation for weeks.

• Speakers need approval

  Send clips for sign-off.

• #4 Turn the 10th edition's headline findings into short pages people and answer engines can quote

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source

Tag each story by CTEM stage and industry, show the right stories on the hub, each spoke and each industry page, and lead each with one measured result.

Proof that matches the reader's situation converts better than a story list.

• Customers limit what can be said

  Use approved wording only.

• #1 Make one CTEM page the answer: merge the two "What is CTEM" guides into a single hub

• Your websiteCustomer stories (19 in the sitemap) include Snap, Adobe, TikTok, Shopify, Bitwarden, pixiv, Redis, monday.com, Temu, Helvetia, KOHO and a UK insurer using H1 Agentic Pentest; 2026 stories span bounty, validation, agentic pentest and continuous testing.Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source

Publish short industry cuts from the 10th-edition data, each with its own page, a benchmark chart and a matching customer story. Retire the old editions as each replaces them.

Industry buyers trust peers' data, and sales gets a reason to call each vertical.

• Small samples

  Merge industries where needed and show sample sizes.

• #3 Send readers of the old 7th- and 8th-edition reports to the 10th edition

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• SitemapThe sitemap (checked October 22, 2026) lists 1,876 URLs: 1,287 blog posts (96 last updated before 2021, including 2018 report write-ups such as "118 fascinating facts" from the Hacker-Powered Security Report 2018), 158 press releases, 98 event pages, 61 Knowledge Center articles and 17 report pages. 7th- and 8th-edition industry reports are still listed (automotive, financial services, retail, government, advanced technologies) next to the new 10th edition; the financial services edition page has no meta description.Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source

Run one recorded interview a month with an internal expert on a CTEM topic, publish it as a post, a short video and quotes for social, and add the expert as a byline.

A steady stream of expert voices builds authority and fills the editorial calendar.

• Sensitive details

  Review every piece for customer confidentiality.

• #2 Mark up 1,287 blog posts as articles with dates and named authors

• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• HiringCompany description in every post: "a global leader in Continuous Threat Exposure Management (CTEM)" uniting "agentic AI solutions with the ingenuity of the world's largest community of security researchers"; customers named include General Motors, Goldman Sachs, Lufthansa, Uber, the UK Ministry of Defence and the U.S. Department of Defense; a value is "Default to Disclosure". An AI Product Manager (Pune, posted August 18) works on agents that "triage analysts and security researchers keep accurate and trustworthy".Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source

Invite five top researchers a quarter to write about how they approach testing (methods, not findings), pay an honorarium and promote their profiles.

Researcher content is distinctive, shareable in the hacker community and credible to buyers.

• Disclosure of program details

  Methods only; no program or customer specifics.

• HiringCompany description in every post: "a global leader in Continuous Threat Exposure Management (CTEM)" uniting "agentic AI solutions with the ingenuity of the world's largest community of security researchers"; customers named include General Motors, Goldman Sachs, Lufthansa, Uber, the UK Ministry of Defence and the U.S. Department of Defense; a value is "Default to Disclosure". An AI Product Manager (Pune, posted August 18) works on agents that "triage analysts and security researchers keep accurate and trustworthy".Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source
• Competitor researchRivals' own homepages: YesWeHack, "the global leader in Offensive Security and Exposure Management"; Cobalt, "Continuous Offensive Security Testing"; Synack, "AI-powered penetration testing with elite human researchers" on a PTaaS platform; Bugcrowd, "#1 Crowdsourced Cybersecurity Platform"; Intigriti, "Leading global bug bounty platform".See the research Source

Capture first and last content touches on leads and contacts, roll them up to opportunities, and give the content team a monthly report of pipeline influenced by hub, spokes and reports.

Pipeline numbers decide budget, and they show which topics to write more of.

• Over-crediting

  Show first, last and influenced separately.

• HiringApplications Engineer and Senior Applications Engineer, GTM Systems (Pune, both posted October 21, 2026): build "the systems that power how our Go-to-Market (GTM) teams operate" across "our Salesforce ecosystem and connected applications" for Sales, Marketing and Customer Success, with "an AI-Native mindset to automate workflows", as HackerOne opens a new Pune office.Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source

Run 30 buyer questions monthly in the main assistants and search AI answers, record which sources are cited and how HackerOne is described, and feed gaps into the editorial calendar.

You can only improve what you measure, and this shows where rivals are winning answers.

• Answers vary run to run

  Run each question three times.

• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Competitor researchRivals' own homepages: YesWeHack, "the global leader in Offensive Security and Exposure Management"; Cobalt, "Continuous Offensive Security Testing"; Synack, "AI-powered penetration testing with elite human researchers" on a PTaaS platform; Bugcrowd, "#1 Crowdsourced Cybersecurity Platform"; Intigriti, "Leading global bug bounty platform".See the research Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source

Publish factual comparison pages: approach, products, community, AI, reporting and integrations, with dates and sources, reviewed by legal. Link them from the CTEM hub.

Comparison searches are late-stage and high intent, and fair pages build trust.

• Out-of-date claims

  Date and source every row.

• Site checkA sample of 29 blog posts across the sitemap: all are marked up as a generic WebPage, none as Article or BlogPosting, so dates and authors are not given to search and answer engines in structured form. The sitemap has concept comparisons ("bug bounty vs VDP", "CTEM vs vulnerability management") but no pages comparing HackerOne with other vendors.Source
• Competitor researchRivals' own homepages: YesWeHack, "the global leader in Offensive Security and Exposure Management"; Cobalt, "Continuous Offensive Security Testing"; Synack, "AI-powered penetration testing with elite human researchers" on a PTaaS platform; Bugcrowd, "#1 Crowdsourced Cybersecurity Platform"; Intigriti, "Leading global bug bounty platform".See the research Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source

Replace free-form requests with a one-page brief: audience, question answered, existing pages on the topic, the hub it belongs to, evidence and the success metric. Score briefs on demand and overlap, and publish the queue so teams see priorities.

A brief that checks existing pages first stops duplicates before they are written and points effort at gaps.

• Seen as bureaucracy

  Keep it to one page and answer within a week.

• #1 Make one CTEM page the answer: merge the two "What is CTEM" guides into a single hub

• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source
• SitemapThe sitemap (checked October 22, 2026) lists 1,876 URLs: 1,287 blog posts (96 last updated before 2021, including 2018 report write-ups such as "118 fascinating facts" from the Hacker-Powered Security Report 2018), 158 press releases, 98 event pages, 61 Knowledge Center articles and 17 report pages. 7th- and 8th-edition industry reports are still listed (automotive, financial services, retail, government, advanced technologies) next to the new 10th edition; the financial services edition page has no meta description.Source

Publish a glossary page with one short definition per term, each linking to its deeper page, mark it up with DefinedTerm data, and link terms from the hub and spokes. Keep it in the style guide.

Consistent definitions across the site make HackerOne the clearest source for the category's vocabulary.

• Overlap with the hub

  Keep glossary entries short and link to the hub.

• #1 Make one CTEM page the answer: merge the two "What is CTEM" guides into a single hub

• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source
• Competitor researchRivals' own homepages: YesWeHack, "the global leader in Offensive Security and Exposure Management"; Cobalt, "Continuous Offensive Security Testing"; Synack, "AI-powered penetration testing with elite human researchers" on a PTaaS platform; Bugcrowd, "#1 Crowdsourced Cybersecurity Platform"; Intigriti, "Leading global bug bounty platform".See the research Source

Publish a short quarterly index from aggregated platform data (the gap between findings and fixes, time to fix, by industry), with the same method each quarter, a chart pack and a press note.

A recurring index makes HackerOne the reference for the term it coined and gives reporters a reason to come back.

• Volatile numbers

  Use rolling averages and keep the method fixed.

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• News coverageNews in the last 30 days: 16 mentions, led by coverage of the 10th-edition report (October 17, 2026).Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source

Build a 12-question self-assessment by stage, score it against the report's survey data, give a short personalised result, and route high-intent results to sales in Salesforce.

An assessment creates qualified leads with context and gives sales a starting point.

• Low completion

  Keep it under five minutes.

• #1 Make one CTEM page the answer: merge the two "What is CTEM" guides into a single hub

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• Your websiteTwo definitional CTEM guides published two days apart: "What Is Continuous Threat Exposure Management (CTEM)?" in the Knowledge Center (June 30, 2026, about 4,000 words) and "The Complete Guide to Continuous Threat Exposure Management (CTEM)" on the blog (July 2, 2026, about 6,400 words, by "HackerOne Team"). Each is its own canonical page with FAQ markup, and neither links to the other. The CTEM solution page links to neither guide. At least ten more CTEM blog posts went up from June to October 2026 (how to build a program, metrics for the board, CTEM vs vulnerability management, CTEM for AI systems, CTEM for enterprise).Source
• HiringApplications Engineer and Senior Applications Engineer, GTM Systems (Pune, both posted October 21, 2026): build "the systems that power how our Go-to-Market (GTM) teams operate" across "our Salesforce ecosystem and connected applications" for Sales, Marketing and Customer Success, with "an AI-Native mindset to automate workflows", as HackerOne opens a new Pune office.Source

Film a short series around one event: the researchers, how they work and the community, with no program or customer details. Release episodes on YouTube and LinkedIn.

Human stories make an AI-heavy category memorable and recruit researchers too.

• Confidential details on camera

  Film people and process, not screens.

• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source
• HiringCompany description in every post: "a global leader in Continuous Threat Exposure Management (CTEM)" uniting "agentic AI solutions with the ingenuity of the world's largest community of security researchers"; customers named include General Motors, Goldman Sachs, Lufthansa, Uber, the UK Ministry of Defence and the U.S. Department of Defense; a value is "Default to Disclosure". An AI Product Manager (Pune, posted August 18) works on agents that "triage analysts and security researchers keep accurate and trustworthy".Source

Publish a monthly column on aggregate trends (signal versus noise, time to validate, how agents and humans split the work), never naming customers or findings.

Insider, aggregate views are distinctive content that shows how the platform works.

• Sensitive details

  Aggregate only; legal review each issue.

• HiringCompany description in every post: "a global leader in Continuous Threat Exposure Management (CTEM)" uniting "agentic AI solutions with the ingenuity of the world's largest community of security researchers"; customers named include General Motors, Goldman Sachs, Lufthansa, Uber, the UK Ministry of Defence and the U.S. Department of Defense; a value is "Default to Disclosure". An AI Product Manager (Pune, posted August 18) works on agents that "triage analysts and security researchers keep accurate and trustworthy".Source
• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source

Publish short country summaries with local stats and a local spokesperson, in German for Germany, and pitch them to national trade press.

Local data earns local coverage, which global reports rarely do.

• Small samples

  Combine with platform data and show sizes.

• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source
• HiringCompany description in every post: "a global leader in Continuous Threat Exposure Management (CTEM)" uniting "agentic AI solutions with the ingenuity of the world's largest community of security researchers"; customers named include General Motors, Goldman Sachs, Lufthansa, Uber, the UK Ministry of Defence and the U.S. Department of Defense; a value is "Default to Disclosure". An AI Product Manager (Pune, posted August 18) works on agents that "triage analysts and security researchers keep accurate and trustworthy".Source
• Your websiteHomepage: "Not every vulnerability matters. Fix the ones that do."; CTEM "closes the discovery-remediation gap"; products Hai, H1 Bounty, Agentic Pentest, Continuous Testing, Remediation, AI Red Teaming, Validation, Code; "1300+ companies trust HackerOne", "90% of customers have Hai AI agent enabled"; stories from Snap and Shopify ("accelerated validation and triage by 62%"). The menu lists nine industries, a researcher Leaderboard, the Ambassador World Cup, Live Hacking Events and a Community Edition.Source

Launch a fortnightly LinkedIn newsletter from the company page: one idea, one chart, one link, from the hub, spokes and report findings.

A subscribed audience gets every new piece without paid promotion.

• Low engagement

  Lead with the most practical idea.

• HiringContent Marketing Manager (remote in US hubs, posted October 20, 2026): "lead key parts of our content program, including the HackerOne blog, annual research, search optimization, and editorial standards"; "Help execute our answer engine optimization (AEO) and search engine optimization (SEO) strategy"; "Maintain and apply HackerOne's Style Guide"; "Manage the content intake process"; "Multiply the impact of our best stories by adapting content for campaigns, social media"; "Find stories across HackerOne by interviewing subject matter experts"; "Measure content performance".Source
• Your websiteHackerOne Security Research Report 2026, 10th Edition: "quantifies Exposure Debt: the growing gap between what security teams find and what they can fix", built on 92,194 valid reports and $89.1M in bounty payouts; methodology: platform data (July 2025-June 2026), a survey of 111 security leaders at $100M+ companies in six countries (US, Canada, UK, Australia, Singapore, Germany) and 408 researchers; findings include "39% of organizations say the CISO takes the blame" and "Only 10% have a formal framework for who owns that call". A report webinar page went up October 14.Source