HackerOne Transforms Secure Coding Training Into a Developer‑Led Culture

HackerOne is built on security — which meant its internal expectations for secure coding education were higher than simple compliance. Although the company had a training program in place, engagement lagged. Developers completed modules, but learning felt disconnected from real engineering work.

By partnering with Security Journey, HackerOne reframed training from a requirement into a visible, energizing part of engineering culture. The program now scales across ~100 engineers and anchors onboarding, team identity, and continuous learning.

Training technically met compliance requirements — but it wasn't driving real learning. Notifications triggered activity, but also frustration, and engineers became better at “managing the system” than learning from it.

HackerOne needed a program that strengthened skills, not just satisfied checkboxes.

Reframing security education. Instead of increasing pressure, HackerOne shifted the philosophy: focus on engagement, not enforcement; make learning visible, social, and meaningful; measure returning learners, not just completions; build a developer‑centered experience.

Structured foundations. Security Journey provided foundational paths across web security, API security, and AI/LLM security, creating a shared starting point for ~100 engineers.

The breakthrough: visibility. Using Security Journey's API, HackerOne built a Slack workflow that announced training completions. Progress became public, engineers congratulated each other, participation became social — even competitive — and training became part of team identity.

HackerOne saw clear, observable changes:

• Participation became steady instead of deadline‑driven

• Previously disengaged engineers returned to the platform

• Managers supported learning time more easily

• Security conversations increased across channels

• Training became part of onboarding and engineering culture