US launches “Hack the Army 3.0” bug bounty program
The program is open to military and civilian hackers

On Wednesday, the US Defense Digital Service (DDS) announced its third Hack the Army bug bounty program. Hack the Army 3.0 will focus on uncovering vulnerabilities in the US Army’s digital systems.
Launched in partnership with vulnerability coordination and bug bounty platform HackerOne, the invite-only program is open to participation from civilian hackers and US military personnel, but only civilian hackers will be eligible for the bounties.
According to Defense Digital Service (DDS), Hack the Army 3.0 will highlight digital vulnerabilities in the US Army’s assets before nefarious hackers discover and exploit them, allowing defense authorities to better plan for unforeseen cyber threats.
“Bug bounty programs are a unique and effective ‘force multiplier’ for safeguarding critical Army networks, systems and data, and build on the efforts of our Army and DoD security professionals,” said Brig. Gen. Adam C. Volant, US Army cyber-command director of operations.
“By ‘crowdsourcing’ solutions with the help of the world’s best military and civilian ethical hackers, we complement our existing security measures and provide an additional means to identify and fix vulnerabilities. Hack the Army 3.0 builds upon the successes and lessons of our prior bug bounty programs.”
That’s not all. DDS has used similar bug bounty challenges in the past to improve the US government’s security systems. For instance, since its launch in 2016, DDS’s Hack the Pentagon program executed 14 public bounties on exterior-facing websites and applications. The program also addressed 10 private bounties on the US Department of Defense’s sensitive internal systems.
“We are living in a different world today than even just a year ago. Amid disinformation and a global health crisis, citizens are increasingly wary of how, when and where their information is used. For years, the US Department of Defense and respective military branches have successfully strengthened their cybersecurity posture and protected precious data by enlisting the help of ethical hackers on HackerOne,” said Marten Mickos, CEO of HackerOne.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Marten continued, “Years later, hacker-powered security is not only a best practice in the US military, but it is now a mandated requirement among civilian federal agencies. There is only one way to secure our connected society, together, and the US Army is leading the charge with this latest challenge.”
You can apply to Hack the Army 3.0 online now. The program runs from January 6 through February 17.
-
Cleo attack victim list grows as Hertz confirms customer data stolen
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
Lateral moves in tech: Why leaders should support employee mobility
In-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
By Keri Allan
-
UK cyber experts on red alert after Salt Typhoon attacks on US telcos
Analysis The UK could be next in a spate of state-sponsored attacks on telecoms infrastructure
By Solomon Klappholz
-
Healthcare data breaches are out of control – here's how the US plans to beef up security standards
News Changes to HIPAA security rules will require organizations to implement MFA, network segmentation, and more
By Solomon Klappholz
-
The US could be set to ban TP-Link routers
News US authorities could be lining up the largest equipment proscription since the 2019 ban on Huawei networking infrastructure
By Solomon Klappholz
-
Why the Space Force wants white hats to attack a satellite
Case study Authorities hope the first-of-its-kind competition could bring benefits to the cyber sector
By James O'Malley
-
US government IT contractor could face death penalty over espionage charges
News The IT pro faces two espionage charges, each of which could lead to a death sentence or life imprisonment, prosecutors said
By Ross Kelly
-
US identifies and places $10 million bounty on LockBit, Hive ransomware kingpin
News Mikhail Pavlovich Matveev was linked to specific ransomware attacks, including a 2021 raid on the DC police department
By Rory Bathgate
-
Breach at US Transportation Department exposes 240,000 employee records
News An investigation is underway into the breach, which affected former and current employee data
By Rory Bathgate
-
OpenAI to pay up to $20k in rewards through new bug bounty program
News The move follows a period of unrest over data security concerns
By Ross Kelly