YesWeHack is a global security company headquartered in Paris, France. Founded in 2015, it operates a crowdsourced platform for bug bounty programs through which organisations invite ethical hackers to identify and report security vulnerabilities. The company has subsequently expanded its activities into vulnerability management, exposure management and AI-assisted penetration testing.
History YesWeHack was founded in 2015. Its co-founders are Guillaume Vassault-Houlière, Manuel Dorne and Romain Lecoeuvre.
In 2019, the company raised €4 million from Open CNP, the corporate venture program of CNP Assurances, and Normandie Participations. In 2021, YesWeHack raised €16 million in Series B funding. The second round was led by the Series A investors as well as Banque des Territoires and Eiffel Investment Group.
In June 2024, it raised €26 million ($28 million) in a Series C funding round, led by Wendel, with participation from Adelie, Seventure Partners, Bpifrance, Open CNP and Eiffel Investment Group. The round brought the company's total funding to €46 million ($52 million).
In September 2025, YesWeHack made its first acquisition, purchasing French cybersecurity auditing company Sekost.
Later that month, YesWeHack became a CVE Numbering Authority (CNA), allowing it to assign CVE identifiers and publish CVE records for vulnerabilities within its defined scope. It became the eight CNA based in France.
In October 2025, the company was selected as the first-ranked provider under a European Commission framework agreement for bug bounty services. The four-year framework contract has a maximum potential value of approximately €7,6 million.
In June 2026, YesWeHack launched Agentic Pentest, an on-demand penetration-testing service using autonomous artificial intelligence agents. Dassault Systèmes and Sanofi were among the first companies reported to have deployed the service.
Operations YesWeHack initially focused on crowdsourced security testing through bug bounty programmes. It later expanded into a broader offensive security and exposure management platform, incorporating vulnerability management, exposure management and AI-based penetration testing.
Following the acquisition of Sekost in 2025, YesWeHack employed approximately 150 people across seven countries. The company said at the time that it served nearly 1,000 customers in around 50 countries and generated approximately half of its revenue outside France.
Among the organisations mentioned by the press as customers or users of YesWeHack's services are Louis Vuitton, Decathlon,Doctolib, Ferrero, Ooredoo, TeamViewer, Swiss Post, and the Quebec Ministry of Cybersecurity and Digital Affairs.
By 2026, the platform's community had grown to more than 150,000 registered ethical hackers.
References