I Read HackerOne’s New Report So You Don’t Have To. Here’s the One Number That Matters.

Record payouts. Faster fixes. And a backlog that grew 131% anyway.

I read HackerOne's 10th annual Security Research Report on a Wednesday morning.

The headline was everything I wanted to hear. Organizations paid researchers a record $89 million between July 2025 and June 2026. An 18% increase over the previous year. The highest annual total in the platform's history.

The pie got bigger. The bounties got paid. The researchers got rewarded.

Then I scrolled to the second finding.

Exposure debt rose 131%.

I sat with that for a moment.

Because I'd been writing about record payouts all year. Celebrating them, even. Nobody told me about the debt.

What Exposure Debt Actually Is

I had to read the report twice to understand what the number was measuring.

Exposure debt isn't a financial metric. It's the accumulated gap between vulnerabilities discovered and vulnerabilities fixed. Every confirmed bug that doesn't get patched sits in that debt. Every report that gets triaged but never remediated. Every finding that enters a backlog and never leaves.

A 131% increase means the debt more than doubled in two years.

Here's the part that made me put my coffee down: average resolution time actually improved by 54% — from 135 days to 62 days. Organizations are fixing individual bugs faster than ever.

But the total number of vulnerabilities resolved each month fell by about 46% even as submissions grew by 76%.

Read that again. They're fixing each bug faster. They're fixing fewer bugs overall.

The backlog grew 21x. Unresolved criticals grew 25x.

Why This Matters to Me Specifically

I've found one confirmed bug. I'm waiting to be paid.

Reading the exposure debt number, I felt something shift.

The question I'd been asking was: How do I find bugs that AI can't find?

The better question — the one the data points to — is: How do I find bugs that someone can actually fix?

A report for a bug that enters a backlog and never leaves is a paycheck for me and a liability for everyone else. The vulnerability is still there. The data is still exposed. The system is still vulnerable.

I don't want to contribute to exposure debt. I want to contribute to remediation.

What the Report Says About Researchers Like Me

The HackerOne report includes data points that feel personal.

85% of surveyed researchers are actively developing their AI skills. Nearly three-quarters said AI meaningfully increased the number of valid findings they produce.

But 68% said they've shifted toward more complex bugs with higher bounties.

That's the signal. The easy bugs are gone. The researchers who are succeeding are going deeper, not wider. They're using AI to cover more ground, then focusing their human judgment on the bugs that require creativity and context.

A top-earning researcher put it plainly: "The most valuable skill in the age of AI will be the ability to be flexible and adapt".

What I'm Doing Differently

I can't fix the remediation crisis. I can't force organizations to patch faster. But I can change three things.

First, I'm looking at remediation history, not just bounty size. A program that pays well but never patches is accumulating debt. A program with lower payouts but active patching is contributing to actual security.

Second, I'm treating "reproducible" as a higher bar than "valid." A valid bug that takes an hour to reproduce is less useful than a valid bug with a one-line PoC. The easier I make it for a developer to fix the bug, the more likely it actually gets fixed.

Third, I'm remembering that the bottleneck isn't me. The report says nearly 70% of security leaders confirmed that validated findings are arriving faster than teams can fix them. My job isn't just to find bugs. It's to make the fix as easy as possible.

The Uncomfortable Truth

Bug bounty just paid a record $89 million. That's genuinely good news. It means the work is valued. It means companies are still investing in finding bugs before attackers do.

But the 131% exposure debt increase tells a different story. It says the system is finding faster than it's fixing. It says the gap is growing. It says the record payouts are a symptom of a deeper problem, not a solution.

The bugs I find aren't just entries in my report history. They're entries in someone's backlog. And if that backlog keeps growing, the whole system becomes unsustainable.

I don't have a CVE. I've found one confirmed bug. I'm still learning.

But I know what exposure debt means now. And I don't want to add to it.

If you're also learning bug bounty in a system where discovery outruns remediation, I write about what I'm actually figuring out — numbers included. Follow for more field notes from the bottom of the learning curve.