Yogosha
Paris offensive security platform with a vetted, ID-checked researcher community for pentests, bug bounty and VDP
Quick Overview
| Company | Yogosha (S.A.S. Yogosha by Creative, per website terms) |
|---|---|
| Category | Bug Bounty Platforms |
| Headquarters | Paris, France |
| Founded | 2015 |
| EU Presence | Yes - France (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | Partner option: strategic partners can self-host the Yogosha technology |
| Main Features | Pentest as a service, bug bounty, VDP, live hacking events, special operations (red teaming, hardware, social engineering), LLM and GenAI audits, vetted researcher community, dashboard with retests |
| Pricing | Pricing on request; PtaaS is described as fixed cost, bounty as pay per valid vulnerability |
| Best For | Teams that want a closed, vetted researcher pool for pentests and private bounties |
| Replaces | HackerOne, Bugcrowd |
Detailed Review
Yogosha describes itself as an offensive security testing platform and was founded in 2015. Its website terms name S.A.S. Yogosha by Creative, a simplified joint stock company registered in Paris, and the about page says headquarters remain in Paris with teams also in England and Dubai.
The product is a bounty and pentest marketplace with a gatekeeping step: researchers join the Yogosha Strike Force only after a technical and written test.
A Vetted Pool Instead of an Open Crowd
According to the vendor, only 10% of applicants are accepted into the Strike Force, researchers are ID checked and sign terms with an NDA. The site cites 1,100+ researchers for pentests and an 800+ private community for bounty.
Reports are described as fully documented, with a CVSS score, proof of concept and remediation guidance, and direct contact with the researcher.
Pentest and Bounty with Different Pricing Logic
PtaaS deploys a small team of researchers on a defined asset for a fixed cost; the bug bounty pays only when a valid vulnerability is submitted. A VDP product handles unsolicited reports.
Special operations cover red teaming, threat intelligence, hardware pentesting, social engineering, digital forensics and CTFs on request.
AI and LLM Testing
The home page promotes audits of large language models and generative AI deployments as a separate service line, alongside the standard web, mobile and infrastructure scopes.
Limitations to Consider
Yogosha publishes no prices, and the pages checked do not state where platform data is hosted. The researcher pool is smaller than an open crowd, which is a deliberate trade for vetting but means fewer eyes on a public program than at the larger bounty platforms. The legal entity named in the website terms is the one for the site; confirm the order-form entity when you buy. For an open community model see YesWeHack or Intigriti.
Who Should Use Yogosha
French and European organisations that prefer a private, vetted group of testers with a mix of fixed-cost pentests and pay-per-bug programs.
Pros and Cons
Pros
- Researchers pass a test and an ID check
- Fixed-cost PtaaS next to pay-per-bug bounty
- Special operations including hardware and red team
- Documented reports with remediation guidance
- Paris-based contracting entity
Cons
- No published prices
- Hosting location not stated on pages checked
- Smaller pool than open crowds
- Public program reach is limited by design
Alternatives to Yogosha
Other European bug bounty platforms worth comparing before you decide:
YesWeHack
France · Paris bug bounty and exposure platform hosted in an EU private cloud
Intigriti
Belgium · Antwerp bug bounty platform with managed VDP and PTaaS
Detectify
Sweden · Stockholm attack-surface and application scanner with ethical-hacker payloads
Pentest-Tools.com
Romania · Bucharest pentest toolkit with scanners, exploiters and reporting
See all European bug bounty platforms or compare them directly against HackerOne on our alternatives page.
Frequently Asked Questions
The vendor says only 10% of applicants are accepted into the Yogosha Strike Force after a technical and written test, and that members are ID checked and sign terms with an NDA.
Both. It sells pentest as a service at a fixed cost, bug bounty where you pay only for valid vulnerabilities, a VDP product and live hacking events.
The about page says headquarters are in Paris, with teams in England and Dubai, and the website terms name a French simplified joint stock company registered in Paris.