YesWeHack is a French offensive security company that helps organisations find and fix vulnerabilities in their websites, apps, devices and infrastructure. It connects security teams with a global community of ethical hackers and combines their work with automated testing, so organisations get continuous evidence of where they are exposed rather than a once-a-year snapshot.
The platform aims to turn “testing into evidence” for security teams, auditors and boards alike.
At A Glance
| Vendor | YesWeHack |
|---|---|
| Category | Bug bounty, vulnerability disclosure, offensive security testing |
| Deployment | SaaS |
| Customers | Tencent, Swiss Post, Telenor, Ooredoo, Orange |
| Certifications | ISO 27001, ISO 27017, CREST, Cyber Essentials, GDPR compliant |
| Founded | 2015, Paris |
| Market classification | Vulnerability Management |
What YesWeHack Does
Scanners and annual pentests leave gaps, and the people best placed to find what they miss are often outside researchers. YesWeHack gives those researchers a controlled way to test an organisation’s assets and report what they find, then helps the security team handle the results. Findings from bug bounty programmes, disclosure reports, pentests and the company’s own scanning are brought into one place, together with vulnerabilities from other external sources, so triage, prioritisation, remediation and compliance reporting happen in a single workflow.
Products
Bug Bounty
Bug Bounty lets an organisation invite vetted, KYC-verified security researchers to test its assets in private or public programmes. There is no limit on the number of programmes, scopes or assets, and access to targets can be controlled through SSO, VPN and User Agent settings, with granular roles and rights for the customer’s own staff. For organisations that only want a safe channel for researchers to report issues they find on their own, the Vulnerability Disclosure Policy product receives and manages those reports.
Attack Surface Management
Attack Surface Management continuously maps an organisation’s internet-exposed assets, checks them for exposure to known vulnerabilities and ranks findings by severity, exploitability and asset criticality. It is turnkey to deploy and combines its own scan results with findings from Bug Bounty, Pentest Management and the disclosure programme into “a one-stop-shop for all vulnerabilities”.
Continuous And Autonomous Pentesting
Pentest Management organises traditional pentest engagements on the platform. Continuous Pentesting and Autonomous Pentest extend this into ongoing testing, with Autonomous Pentest keeping an up to date view of assets evaluated against actively exploited vulnerabilities.
Vulnerability And Exposure Management
Exposure Management aggregates vulnerabilities from several external sources so teams can triage, prioritise and remediate them and produce compliance reports from one list.
How It Works
The platform is a SaaS service, and findings from every product are handled in one place.
| Component | What it does |
|---|---|
| Researcher community | Vetted ethical hackers test the assets in scope of each programme and submit reports through the platform, where the customer’s team validates and rewards them. The community counts a reported 135,000 or more experts. |
| Prioritisation | Findings follow the five CTEM phases of “scope, discover, prioritise, validate, mobilise”. |
| Workflow | Results from all products are consolidated and passed to existing security workflows through integrations and a public API. Hosting uses ISO-certified, SecNumCloud-compliant infrastructure. |
Integrations
| Area | Integrations |
|---|---|
| Ticketing and ITSM | JIRA, ServiceNow |
| Source control | GitLab, GitHub |
Company Background
| Founded | 2015, by ethical hackers Guillaume Vassault-Houlière, Manuel Dorne and Romain Lecoeuvre. |
|---|---|
| Headquarters | Paris, France, with offices in Rouen, Rennes, Lausanne, Munich and Singapore. |
| Leadership | Guillaume Vassault-Houlière, CEO and Co-Founder. |
| Reach | More than 500 reported customers, with programmes in 50 or more countries. |
| Funding | 4 million euros in 2019, a 16 million euro Series B in 2021 and a 26 million euro Series C in June 2024 led by Wendel, with Adelie and Seventure Partners joining and Bpifrance, Open CNP and Eiffel Investment Group reinvesting. |
Note: This overview is compiled from YesWeHack’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.