European Bug Bounty Platforms

#1 YesWeHack

Paris, France Founded 2015 Pricing on request; the vendor site publishes no price list Demo on request

Best for: Security teams that want a managed bounty with in-house triage and EU-only hosting

• Operating company. Yes We Hack S.A.S.
• Jurisdiction. EU (France)
• Where the data sits. EU only, in a SecNumCloud-qualified private cloud (per vendor trust page)
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd

YesWeHack runs its platform from Paris and contracts through Yes We Hack S.A.S., founded in 2015, so a customer signs with a French simplified joint stock company. The vendor says its community has more than 160,000 ethical hackers and that incoming reports are triaged by its own employees, who remove duplicates, reproduce the proof of concept and set severity. A customer success team helps set up the first programme: private or public, budget, reward grid and later scope changes.

The trust page states hosting in a SecNumCloud-qualified private cloud with European providers only, and ISO 27001 and ISO 27017 certificates are listed. Customers can enforce two-factor login, connect SAML 2.0 single sign-on and route hunter traffic through a fixed-IP VPN. Prices are not published, the managed model is heavier than a small team needs, and the vendor also has offices in Singapore, so confirm which entity signs the order form.

Standout feature. It is the only platform in this list that names EU-only hosting in a SecNumCloud-qualified environment and pairs it with employee-run triage.

#2 Intigriti

Antwerp, Belgium Founded 2016 Plans named Core, Premium and Enterprise; prices on request Demo on request

Best for: Companies that want a bounty and a pentest-as-a-service option from one Belgian vendor

• Operating company. Intigriti NV
• Jurisdiction. EU (Belgium)
• Where the data sits. Not stated on the pages checked; stored data is encrypted at application level
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd

Intigriti is the Antwerp platform operated by Intigriti NV, which its company information page names at Klokstraat 16, and the about page says it was founded in 2016. The vendor reports more than 100 employees across Belgium, the UK, the US, the Netherlands and South Africa, and a EUR 21 million Series B round in 2022. An in-house team vets incoming reports, and the platform pages mention access to more than 150,000 independent researchers.

Beyond the bounty, Intigriti sells managed vulnerability disclosure and pentest as a service in Focused, Comprehensive and Certified types, plus live hacking events and programmes scoped around AI features. Plans are named Core, Premium and Enterprise, with prices on request. The pages checked do not name a hosting location, though a published post explains application-level encryption of stored data, and the product pages mark the pentest offer and CrowdRecon as beta.

Standout feature. Its Certified pentest type targets regulated buyers inside the same contract as the bounty, which no other crowd platform here offers.

#3 Yogosha

Paris, France Founded 2015 Pricing on request; PtaaS is described as fixed cost, bounty as pay per valid vulnerability Demo on request

Best for: Teams that want a closed, vetted researcher pool for pentests and private bounties

• Operating company. Yogosha (S.A.S. Yogosha by Creative, per website terms)
• Jurisdiction. EU (France)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd

Yogosha is a Paris offensive-security platform founded in 2015, whose website terms name S.A.S. Yogosha by Creative. Its research pool is called the Strike Force, and according to the vendor only 10 percent of applicants are accepted after a technical and written test, with ID checks and an NDA for members. The site cites 1,100 or more researchers for pentests and more than 800 in the private bounty community.

Pricing logic differs by product: pentest as a service is described as a fixed cost for a small team on a defined asset, while bounty pays per valid vulnerability. Special operations include red teaming, hardware pentesting and social engineering, and the home page promotes audits of LLM systems. Prices and hosting location are not stated on the pages checked, and the pool is deliberately smaller than an open crowd.

Standout feature. Joining its researcher pool takes a test, an identity check and an NDA, and the vendor says nine in ten applicants are turned away.

#4 Detectify

Stockholm, Sweden Founded 2013 Starter free (up to 5 users, 100 assets) / Standard €2,500 / Professional €5,000 / Enterprise €15,000 per year Demo on request

Best for: Security teams that want continuous external scanning of their web assets and a price list they can budget from

• Operating company. Detectify AB
• Jurisdiction. EU (Sweden)
• Source code. Closed source
• Replaces. Tenable, Qualys, Invicti

Detectify is a Stockholm company, Detectify AB, founded in 2013, that combines external attack surface management with dynamic application security testing. It maps what an organisation exposes to the internet and then tests each asset, drawing payloads partly from its own research and partly from Crowdsource, a network of more than 400 ethical hackers. Coverage reaches REST and GraphQL APIs from the Standard tier.

Prices are public: a free Starter tier for five users and 100 assets, Standard at EUR 2,500, Professional at EUR 5,000 and Enterprise at EUR 15,000 per year. Standard caps at 750 assets and 10 users, and CI/CD integration starts at Professional. It is a scanner, not a WAF or CDN, so it reports exposure and blocks nothing, and no human reads your application the way a bounty researcher does.

Standout feature. It is the one tool here with a free tier and a complete price list up to enterprise level.

#5 Pentest-Tools.com

Bucharest, Romania Founded 2017 From $96/month (NetScan), $140/month (AppScan), $190/month (Exploit), by asset count Demo on request

Best for: Pentesters and security teams that run their own tests and want evidence and reports

• Operating company. PENTESTTOOLS S.A.
• Jurisdiction. EU (Romania)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. Self-run testing; complements HackerOne and Bugcrowd

Pentest-Tools.com is a toolkit sold by PENTESTTOOLS S.A. of Bucharest, headquartered there since 2017 according to its about page. The company says it has more than 2,100 customers in 119 or more countries. You buy scanners and exploiters, and you run the tests yourself, so there is no researcher crowd and no triage of outside reports.

Plans are priced by asset count: NetScan from $96 a month for 16 assets, AppScan from $140 for 5 assets and Exploit from $190 for 5 assets, with yearly billing quoted at ten months. All plans include API access, unlimited rescans, team access and integrations, and Exploit adds import of Burp Suite findings. The report generator is an add-on, prices are in US dollars, and AI pentests and the MCP server are marked new on the site.

Standout feature. Every plan carries unlimited rescans and an API, with the price set by how many assets you scan.

#6 Zerocopter

Groningen, Netherlands Pricing on request Demo on request

Best for: Dutch and Benelux organisations that want bounty, pentest and CVD from one local vendor

• Operating company. Zerocopter B.V.
• Jurisdiction. EU (Netherlands)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd

Zerocopter is a Dutch security company that offers four programmes together: a coordinated vulnerability disclosure policy, recon for new and forgotten systems, pentests with a formal report, and a bug bounty with vetted hackers. The terms of sale name Zerocopter B.V. as the contracting party and define researchers as third-party suppliers, so the customer never contracts with an individual hacker.

Its legal documents are public: terms of sale (version of 19 July 2024), a privacy and cookie statement, a disclosure policy and a researcher code of conduct. The two legal pages give different cities, Amsterdam and Groningen, so confirm the address in the order form. No prices, researcher numbers, founding year or hosting location appear on the pages checked, and parts of the site are in Dutch.

Standout feature. It frames the offer as a ladder from a disclosure policy up to a bounty, so a first-time buyer can start small under one Dutch contract.

#7 SignalFisher

Lucerne, Switzerland Pricing on request Demo on request

Best for: Swiss and DACH regulated companies replacing yearly pentests with a continuous program

• Operating company. SignalFisher AG
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd

SignalFisher is the new name of Bug Bounty Switzerland, shown by a banner on its site, and the imprint names SignalFisher AG at Morgartenstrasse 3 in Lucerne with register number CHE-218.065.572. The company says its roots go back to 2015. The about page names the three co-founders and lists Direttissima Growth Partners and Deutsche Beteiligungs AG as growth partners, the only source we checked for ownership.

The programme runs in three steps: scoping from business context and regulation, testing by vetted researchers against the external attack surface, and interpretation with reports, trend analysis and recommended actions. The site quotes the CISO of Helvetia Baloise Group about a partnership since 2021 and shows Swiss Post and Stadler as customers. Prices, hosting and researcher numbers are not published, and you do not set the reward grid yourself.

Standout feature. It sells scoping and interpretation of the results as part of the programme, where a classic bounty platform leaves both to the buyer.

#8 Ethiack

Coimbra, Portugal Pricing on request Demo on request

Best for: Teams that want continuous automated pentesting with proof-of-exploit instead of a yearly snapshot

• Operating company. Ethiack, S.A.
• Jurisdiction. EU (Portugal)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd, point-in-time pentests

Ethiack is a testing engine from Coimbra, Portugal, run by Ethiack, S.A. under registration number 516856146. Its agentic AI pentester, called Hackian, replaces scheduled tests with autonomous ones that, according to the vendor, trigger on code pushes, infrastructure changes and new knowledge. It maps internal, external and third-party assets and lists reports for NIS2, DORA, SOC 2, ISO 27001 and PCI.

Findings are described as validated for exploitability and come with a proof of exploit and remediation guidance. Case studies name ANA Aeroportos, Bluepharma and Universidade do Porto; the quoted figures, such as a 650 percent return, are vendor claims. There is no crowd or reward grid, no published price, no stated hosting location, and the privacy policy page we checked is dated 2022.

Standout feature. Each confirmed finding comes with a proof of exploit, so a human does not have to reproduce it before the ticket is opened.

#9 Securitum

Krakow, Poland Founded 2009 Time and materials EUR 640 to 890 per man day; fixed projects typically EUR 3,500 to 14,000 (vendor pricing page) Demo on request

Best for: Teams that want a manual pentest with a transparent price range

• Operating company. Securitum Audyty Sp. z o.o.
• Jurisdiction. EU (Poland)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd, pentest-as-a-service

Securitum is a Krakow penetration testing firm, Securitum Audyty Sp. z o.o., whose about page gives 2009 as its founding year and almost 2,000 pentests in the last three years. It lists web, mobile, infrastructure and cloud pentests, red teaming, source code review, configuration analysis, OSINT, SSDLC implementation and trainings, and publishes example reports.

The pricing page is the most open in this list: EUR 640 to 890 per man day on time and materials, and EUR 3,500 to 14,000 for typical fixed projects of one to four weeks. These are ranges, not quotes, and the work is a point-in-time test by Securitum's own team. There is no bounty pool or researcher crowd, and the company describes a focus on Central and Eastern Europe.

Standout feature. It publishes day rates and project ranges in euros, which almost no other vendor in this category does.

#10 Patchstack

Pärnu, Estonia See website; separate pricing page for mitigation Demo on request

Best for: WordPress plugin and theme vendors that need a managed disclosure channel

• Operating company. Patchstack OÜ
• Jurisdiction. EU (Estonia)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne VDP, Bugcrowd VDP (for the WordPress ecosystem)

Patchstack is an Estonian company, Patchstack OÜ (register code 14331217), based in Pärnu, and its terms apply Estonian law to customers outside the Americas and Delaware law to those headquartered in North, Central or South America. The scope is narrow: vulnerabilities in WordPress and the wider open-source ecosystem, not a company's own web estate.

The bounty page lists a guaranteed monthly pool of USD 10,000 and zero-day payouts up to USD 33,000, paid by PayPal, Bitcoin or Ethereum. Researchers report through Patchstack, which assigns the CVE in their name. The managed disclosure product takes over report handling for maintainers, and the site says it manages security for 1,134 plugins. The pages checked give no hosting location.

Standout feature. It assigns the CVE in the researcher's name and runs a public vulnerability database for the WordPress ecosystem.

#11 Vaadata

Lyon, France Founded 2014 Quote on request Demo on request

Best for: French and European teams that want a human-led pentest or red team from a French SARL

• Operating company. VAADATA SARL
• Jurisdiction. EU (France)
• Where the data sits. Not stated on the pages checked
• Source code. Closed source
• Replaces. HackerOne, Bugcrowd, pentest-as-a-service

Vaadata is a Lyon offensive-security firm, VAADATA SARL, registered under RCS 797 558 590, which says it was created in 2014 and is financially independent. It claims more than 800 clients. The tests run as black, grey or white box and cover web, mobile, cloud, infrastructure, IoT, social engineering and LLM systems, including RAG, agents and MCP servers.

Red team audits test detection and reaction against realistic attack scenarios, and assumed breach exercises start from a compromise. There is no bounty, no crowd and no published price, only a quote request. The legal notices state that the marketing website is hosted by Kinsta Inc. in the United States; that concerns the website, not engagement data, but it is worth a question during procurement.

Standout feature. It lists a dedicated LLM pentest for RAG, agents and MCP servers as its own service alongside the classic scopes.