Let ethical hackers find your weak spots first.
Vikahaukka gives ethical hackers a safe, legal way to report vulnerabilities in your services. We review every report and filter out the noise. You confirm the real ones, and only then is the bounty paid.
Your data stays in the EU, we never access your systems, and only reviewed reports reach you.
Finnish companies rarely hear about their own holes
Someone outside your company will find your weak spots eventually, and the only question is who gets there first. The people who find them often have no safe, legal way to tell you, so they stay quiet. And when the wrong person gets there first, a data breach costs more than you think: fines, cleanup, lost customers and weeks of your team's time.
Three steps from launch to fixed
Verify and set the rules
You prove you own the domain, decide what may be tested and place your bounty budget in escrow. It stays yours until a finding is confirmed.
Hackers test and report
Registered researchers test within your rules and report what they find through the platform.
We review, you confirm
We review every incoming report and filter out the noise. You confirm the real findings, and bounties are paid from escrow only for those.
An easy decision for most companies
No security testing can guarantee you'll never be attacked. What it can do is find holes before attackers do, and Vikahaukka does it continuously, for less than a single penetration test.
Pilot programme, 10 companies
Free for 3 months
Then €49/month, locked for as long as you stay €149/month
You fund your own bounty budget, from €500. It stays yours until a finding is confirmed.
- Continuous testing by ethical hackers
- Every incoming report reviewed by our team
- Only reviewed reports reach you, and you confirm them
- Clear rules and safe harbour for every program
What's at stake
≈ €25,000 average cost of one cyberattack on an SME
Fines, lost customers and staff time can come on top.
GDPR fines
Up to €10 million or 2% of global annual turnover for failing to protect personal data.
NIS2 penalties
In covered sectors, up to €10 million or 2% of turnover, and management can be held responsible.
Lost customer trust
Customers who have to be told their data leaked don't always come back.
Cleanup and recovery
Forensics, restoring systems, notifying customers and authorities, and downtime while it all happens.
Your IT team's time
Incident work pushes everything else aside, often for weeks.
Your customers' safety
Leaked data can be used for fraud and phishing aimed at your customers.
Who finds it first?
- Platform fee
- Bounties paid
- Vikahaukka fee on bounties
- Platform fee
- €441
- Bounties paid
- €500
- Vikahaukka fee on bounties
- €50
Found by our ethical hackers
Example fine at 2% of turnover
€2M turnover, website and booking
Only the fine is shown. Internal costs and lost trust come on top.
Real fines vary. The legal ceiling is higher: up to €10 million or 2% of turnover, whichever is higher.
Same holes, two outcomes. With us you pay a known amount and the holes get fixed. With an attacker, the fine is only the part you can put a number on.
How we calculated this
Plans
- Pilot
- €49/month, 10% fee on bounties
- Standard
- €149/month, 15% fee on bounties
- Pro
- €249/month, 10% fee on bounties
- Medium finding, recommended reward
- €250
- Critical finding, recommended reward
- €1,000
Pilot, 2 medium
- Platform fee, 9 × €49 (first 3 months free)
- €441
- Bounties in this scenario
- €500
- Vikahaukka fee, 10% of bounties
- €50
- Your cost with Vikahaukka
- €991
- Example fine at 2% of turnover
- €40,000
The left bar shows your yearly cost in exact proportion to the right bar.
The right bar shows an example GDPR fine of 2% of the example company's turnover. It is illustrative, not a prediction: real fines vary, and the legal ceiling is higher, up to €10 million or 2% of turnover, whichever is higher. Internal costs and lost trust come on top.
Good for the hackers too
Skilled researchers get paid for doing the right thing. A legal way to earn keeps their skills on your side.
Fine amounts are the maximums under the GDPR and NIS2; actual fines depend on the case. Average cost of an attack: HDI Cyber Study 2026 (German SMEs). The bounty budget is an example.
Designed to be the safe choice
Data stays in the EU
Reports and contact details are stored on servers within the European Union.
Every report is reviewed
We review every report and filter out the noise, including AI-generated guesswork. You confirm the real findings before any bounty is paid.
Clear legal rules
Every program has written rules and safe harbour terms, so hackers know exactly what's allowed.
Want to be there from the start?
We're looking for a handful of Finnish companies as pilot customers. The platform fee is free for the first 3 months. You fund your own bounty budget, from €500, and it stays yours until a finding is confirmed.
- No platform fee for the first 3 months
- A bounty budget from €500, paid out only for confirmed vulnerabilities
- Shape the platform with direct feedback to the team
Before you apply
Do you need access to our systems?
No. We never ask for credentials or install anything. Hackers test only what you've put in scope, from the outside, under the rules you set.
What does it cost?
The platform fee is free during the 3-month pilot, and from €49 a month after that. It covers our team reviewing every incoming report and filtering out the noise. Bounties come from a budget you fund yourself, from €500, and are paid only for confirmed vulnerabilities.
Why not run a bounty program ourselves?
Two reasons: audience and noise. Without an established community, few skilled researchers ever look at your program. And once you offer money, you'll get a steady stream of AI-generated reports that sound convincing but aren't real. Sorting them takes your team's time. That's exactly the job we take over.
Who are the hackers?
Ethical security researchers who sign up on the platform and accept the program rules. We review every report they send before it reaches you.
Where is our data stored?
Within the EU. We don't use tracking cookies.