YesWeHack Due Diligence
Run due diligence on YesWeHack: check compliance and get alerts when suppliers change.
France · www.yeswehack.com · 7 vendors
YesWeHack is a global Offensive Security and Exposure Management platform. It provides a crowdsourced platform for bug bounty programs, connecting organizations with a community of ethical hackers to identify and remediate security vulnerabilities in their digital assets.
Resilience scores
- Digital Sovereignty: 14
- Digital Resilience: 8
- Financial Resilience: 6
Technology vendors
- Apple Inc. — Technology — United States
- Atlassian Corporation Plc — Technology — Australia
- Sanity AS — Technology — Norway
- and 4 more
Services catalogue
1 service in catalogue across 1 category; runs on 7 sub-vendors.
- Bug bounty platform
Insights
Last updated 2026-07-09 · revision 2
7 direct vendors, 106 subvendors
Direct vendors by controlling owner country (sample)
- United States: 4
- Australia: 1
- France: 1
Subvendors by controlling owner country (sample)
- Sweden: 3
- France: 4
- Japan: 1
Compliance
9 in-scope frameworks identified; showing 3.
NIS2 (source) — No public evidence
Evidence: https://www.yeswehack.com/about, https://www.yeswehack.com/product/trust-security, https://www.yeswehack.com, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555
GDPR (source) — Evidence found
Evidence: https://www.yeswehack.com/page/privacy-policy, https://www.yeswehack.com/product/trust-security, https://www.yeswehack.com/about, https://www.cnil.fr/fr/plaintes
ISAE 3000 (source) — No public evidence
Evidence: https://www.yeswehack.com/product/trust-security, https://www.yeswehack.com/about
Financials
Three-year financials
- 2023:
- 2022:
- 2021:
Financial Resilience Score: 6/10
YesWeHack is a well-established, VC-backed French cybersecurity scale-up with strong European and APAC market positions. The company benefits from significant venture capital backing, including a €16M Series B round in December 2021 led by Eiffel Investment Group, with cumulative funding estimated at €25-30M. Its enterprise and regulated-sector client base (L'Oréal, Ferrero, TeamViewer, European government/defense entities) provides recurring revenue with long-tenured contracts supporting low churn. The company's sovereignty positioning (ISO 27001/17/18/27701, SOC 2 Type II, SecNumCloud-compliant, CREST-accredited, EU-hosted infrastructure) provides differentiation against US competitors in EU public-sector and regulated-industry markets, aligned with NIS2/DORA/GDPR. Its subscription/platform business model in bug bounty and continuous pentesting offers visibility on ARR. However, as a private SAS with confidential accounts, precise revenue, EBIT, and equity figures are not publicly available, limiting external stakeholders' ability to assess resilience directly. The company faces competitive pressure from larger US-based competitors (HackerOne, Bugcrowd) and European rival Intigriti. Typical of scale-ups in growth mode, cash burn is likely and no public profitability signal is available. Overall resilience score reflects strong strategic positioning offset by disclosure opacity and competitive dynamics.
Key strengths: €16M Series B (Dec 2021) led by Eiffel Investment Group, Cumulative funding of approximately €25-30M, Strong enterprise client base including L'Oréal, Ferrero, TeamViewer, EU sovereignty positioning aligned with NIS2/DORA/GDPR, ISO 27001, SOC 2 Type II, SecNumCloud compliance, Recurring subscription/platform revenue model, Community of 135,000+ ethical hackers, Customers in 50+ countries, Revenue reportedly doubled YoY in 2020 and 2021, Product expansion beyond bug bounty into Autonomous/Agentic Pentest
Risk factors: Competitive pressure from larger US-based competitors (HackerOne, Bugcrowd), Direct European competition from Intigriti, Concentration in Europe/APAC with smaller North America presence, Likely cash burn typical of growth-stage scale-ups, Two-sided marketplace requires continuous investment in both sides, Confidential accounts limit financial transparency, FX and geopolitical exposure across 50+ countries, Consolidation risk in crowdsourced security space
Revenue by geography
- France & Rest of EU: 65%
- APAC: 20%
- Rest of World (Americas, Middle East): 15%
Revenue by product/service
- Bug Bounty Platform: 70%
- Continuous Pentesting: 15%
- Autonomous & Agentic Pentest: 8%
- VDP (Vulnerability Disclosure Policy): 7%
Workforce by country
- France: 105
- Rest of EMEA: 25
- Singapore (APAC): 25
- North America: 10
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.