HackerOne has expanded its Continuous Threat Exposure Management offering with H1 Remediation, a new H1 Platform capability aimed at helping engineering teams act faster on confirmed security findings.
The product creates developer-ready remediation plans for vulnerabilities that have already been validated as exploitable. Those plans are based on the customer’s source code, linked to the affected lines and delivered into the systems developers already use to manage and fix issues.
The launch addresses a persistent problem for security teams: vulnerability discovery is accelerating, while remediation capacity is failing to keep pace.
HackerOne’s platform data shows that the backlog of unresolved critical findings increased 29-fold over the past year. That growth occurred even though mean time to remediate critical findings improved by more than 50%.
The figures suggest that faster resolution of individual issues has not been enough to offset the volume of new findings entering the system. For organizations building CTEM programs, that leaves a growing amount of exposure debt and makes it harder to demonstrate measurable risk reduction.
"Boards no longer want to hear how many vulnerabilities were found. They need to know the magnitude of the exposure debt you’re carrying and what you are doing about it,” said Kara Sprague, CEO at HackerOne. “H1 Remediation gives security leaders a defensible answer to both. Every finding carries a documented trail from validated exploitable vulnerability to verified fix, with exposure duration as a measurable, reportable metric. Closing that gap faster is both an operational improvement and a governance imperative.”
H1 Remediation is designed to give security and engineering teams a common evidence base. Security teams can show that a finding has been validated and tied to a real attack path, while developers receive enough code-level detail to begin remediation without a lengthy clarification process.
Each fix plan can include an explanation of the root cause, the point where risky input enters the application, the location where the damage occurs and recommendations tailored to the relevant programming language.
The capability can connect to code hosted in GitHub, GitLab, Azure DevOps and Bitbucket. It also uses information from tools including Jira, Linear and Confluence to add asset details, incident history and other context that may affect prioritization.
“The value for us is in speed to resolution. H1 Remediation hands our engineers clear technical steps already grounded in our own code, so they can move straight to a fix,” said Connor Knabe, Application Security Architect at Veterans United Home Loans. “This results in time saved for the security and product teams. It's clear this isn't generic guidance. It's based on our actual code and fits right into how our team already works, so there's no new process, just better information showing up exactly where we need it.”
Once created, remediation plans can be sent into Jira, Linear or ServiceNow as structured tickets. Their status is then synchronized with the H1 Platform, allowing security teams to follow a finding from validation through resolution.
Developers can also access the plans through HackerOne’s Model Context Protocol server. That integration makes the guidance available within supported development environments and AI coding agents, including Claude Code and Cursor.
H1 Remediation applies to findings generated through HackerOne’s bug bounty programs, agentic pentesting and continuous testing services. After exploitability and severity are confirmed, Hai, the company’s agentic AI orchestrator, reviews the relevant code and prepares the fix plan.
HackerOne is drawing a clear line between this approach and the use of general AI coding assistants for security work. The remediation process begins with a confirmed vulnerability rather than an unverified alert, and the proposed response is based on the organization’s own code and operating context.
"Every customer conversation comes back to the same problem: validated findings sitting unresolved because engineering lacks the context to act on them quickly," said Nidhi Aggarwal, Chief Product Officer at HackerOne. "H1 Remediation extends the workflow from discovery to verified fix. When a fix plan starts from a validated, exploitable finding traced to the actual source code, is informed by the customer’s context, and is delivered into the engineering workflows teams already use, the friction that stalls remediation disappears. Combining agentic capabilities with human ingenuity from the security research community is what gives teams the confidence that what they are fixing is real. That is what turns remediation from a backlog problem into a continuous improvement process that drives measurable risk reduction.”
Alongside the code-level guidance, H1 Remediation includes reporting on resolution rates, remediation times, incoming and completed findings, and the size of the remaining exposure backlog. Security leaders can also compare performance with peers and review year-over-year results.
That reporting supports the wider CTEM focus on outcomes rather than discovery volume. The relevant measure is how quickly a validated exposure is reduced and whether the organization’s unresolved risk is declining over time.
H1 Remediation is generally available in the H1 Platform.
