The Total Economic Impact™ Of Hack The Box

Enhanced Cyber Workforce Development

Evidence and data. HTB enabled organizations to scale and enhance cyber workforce development at lower cost and with fewer operational resources. It complemented external courses with reusable hands-on learning and certification paths that could be accessed by broader groups of security practitioners, developers, consultants, and new hires. Interviewees highlighted that HTB enabled:

• Organizations to reduce reliance on expensive external training while still upskilling the cyber workforce. Interviewees believe HTB provided their organizations an opportunity to upskill more employees that wasn’t possible in the prior learning set up. The technical program manager at a technology services company said, “In just over one and a half years of using Hack The Box, we have over 700 people who have signed up and used the platform, and we have a total of 10,000 plus employees who might be interested in using the product.”

• Lower-cost certification pathways and broader certification coverage. Interviewees said HTB certifications provided a hands-on and cost effective alternative to traditional certifications. The head of global cyber incident response at a professional services firm said, “I can get the whole team certified in Hack The Box certs with the same cost of 4 to 5 [traditional certifications]. The Hack The Box certs are very good. I think they will get there and we like the technical depth that they require people to have.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• It has not replaced any existing learning platforms with HTB.

• It has 90 employees in Year 1 working in functions that require security training, including blue, red, and consulting teams; the teams expand to 92 employees in Year 2, and 96 employees in Year 3.

• 10% of the group attends a traditional certification training course on-site every year.

• With HTB, an additional 20% are certified without going to on-site training.

Risks. The factors listed below affected the modeling confidence.

• The workforce development budget varies depending on the industry.

• The cost for onsite, traditional certification training courses varies by geography and specific types of training.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $426K.

Improved Onboarding Efficiency

Evidence and data. Customers reported that HTB improved onboarding speed and post-onboarding skill quality by helping employees connect individual tools, techniques, and concepts into realistic workflows. Interviewees shared the following experiences:

• Reduced onboarding timeline for junior new hires. Interviewees were able to shorten onboarding timeline for new hires. The head of global cyber incident response at a professional services firm said, “Especially with fundamental knowledge… they will grasp different things they have to analyze sooner or they don’t need to ask a more senior team member about things.”

• Accelerated new-hire readiness and improved practical skills quality. Interviewees appreciated that HTB provided hands-on instead of theoretical training. The technical program manager at a technology services company said, “It’s not just a slide deck, it’s not just an overview of some terminology or whatever. We’re actually getting people to learn how to use different tools…”
  The Head of cyber protection at a federal government agency shared, “At the end of these missions, you see the analysts being like, ‘I get it now! This is fun!’… they understand the context for all the training they’re doing, which is really hard to get in just a simple training course.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The average time for cyber workforce onboarding training takes about 10 hours a week in the first 6 months.

• The productivity recapture rate is 75% as the new hires are able to work independently sooner.

Risks. The financial model considered the following modeling risks:

• The skill level and expectation of the cyber workforce varies by organization.

• The onboarding timeline depends on the size, industry, and geographical coverage of the organization.

Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $77K.

Improved Cyber Workforce Retention

Evidence and data. HTB contributed to cyber workforce retention by shaping a more engaging technical culture for high-performing cyber talent. It provided employees continuous access to hands-on, role-relevant training, creating team-building opportunities through CTFs and collaborative lab environments, and supporting a culture where practitioners could keep developing technical skills throughout the year. Interviewees have shared with us their experiences:

• Improved team connection and morale. Companies we interviewed have described as the HTB experience as a fun activity to do as a team. The global head of ethical hacking at a financial services firm noted, “Those sessions have brought the team much closer and they’re training in the process but it doesn’t feel like training. At that point, it’s just fun. You’re hacking into things with your teammates. You’re talking to people you usually only email occasionally.”

• Contributed to talent retention. Several interviewees commented on the effectiveness of HTB training in building team culture. The technical program manager at a technology services company, “It aids in skill enhancement and talent retention because people see this as a differentiator for the company and their job.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The attrition rate in the cybersecurity team have reduced by 4% with HTB

• We attribute 30% of this improvement to HTB, as team culture, compensation, and management style are also important factors that contributed to an improved retention rate.

Risks. The financial model considered the following modeling risks:

• Retention varies by industry, geography, and wider company culture.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $250K.

Efficiency Improvement In Incident Response

Evidence and data. Rather than relying only on documentation or theoretical training, teams used HTB labs and challenges to understand how attacks unfold, what evidence attackers left behind, and where detections should be implemented in their own environments. Practitioners gained hands-on exposure to attacker techniques, realistic environments, and repeatable practice scenarios. HTB contributed to an improvement in IR efficiency, due to:

• Improved response effectiveness by understanding attacker behavior and where to investigate. The hands-on exposure made the IR team more confident in incident detection. The head of global cyber incident response at a professional services company said, “I think it makes us faster to our response. It makes us better at looking at what the attacker’s doing. We’re fast. We know the right places to look because we know what an attacker would be looking to do. So I’d say we’re better at our job, we’re faster at our job, we’re more efficient.”

• Improved detection engineering through safer experimentation with production-like technologies. The head of IT security at a financial services company explained, “Because we’ve learned stuff we hadn’t thought about [through cloud labs], we didn’t know until then how Azure is actually working in the background, we were able to then set up detections with this new knowledge for our SIEM.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• 50% of IR analyst time is spent on the active incident response, the rest of time is split between post-incident reports, research and learning, detection improvement, stakeholder coordination.

• Mean time to acknowledge (MTTA) has improved by 50%, and Mean time to resolution (MTTR) has improved by 30%.

• 30% of the improvement can be attributed to HTB among other factors, such as improved detection strategy and security environment.

Risks. The financial model considered the following modeling risks:

• Time spent on incident is highly dependent on each organization’s security environment, which is affected by region, industry, and size of the organization.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $164K.

Risk Avoidance From MTTR Reduction

Evidence and data. Besides improving the efficiency of defensive security teams, interviewees also observed the improvement of the quality of threat detection. As responders know where to investigate, the operational risks have reduced. HTB eventually contributed reduction in cybersecurity risk by:

• Reducing breach exposure through shorter attacker dwell time. By improving detection quality and enabling analysts to identify malicious activity earlier, HTB reduced attacker dwell time, a key driver of breach cost and incident severity. The head of IT security at a financial services company commented further, “Dwell time directly correlates with breach cost, and even marginal improvements can prevent high‑six‑figure impacts in regulated environments.”

• Improving the incident report granularity. The head of global cyber incident response at a professional services firm said, “I’ve seen a lot more good technical details from our team as they resolve stuff… I need to know what the root cause was. I know how it happened. I need to know… a lot of technical details.”

• Enabling better detection decisions. The head of IT security at a financial services company explained, “We definitely had more detections implemented… Better detections in regards to understanding what is happening on a technology level and then being able to pinpoint where actually the detection in our environment would be best suited.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Among all cases handled by the IR team, 5% are at risk for further investigation. Within that, the escalation probability prior to HTB is 15%, which has reduced by 50% with the reduction in dwell time.

• The escalation probability is at 8% with HTB.

• Cost per escalated case for the composite organization is $200,000.

• 20% of the risk reduction can be attributed to HTB, reflecting it’s critical role in improving analyst skill, detection engineering quality, and attacker-behavior understanding, while recognizing that reduced dwell time also depends on broader investments in security tooling, processes, staffing, and governance.

Risks. The financial model considered the following modeling risks:

• The number of incidents is highly dependent on the organization’s broader investments in security tooling, processes, staffing, and governance.

• Cost per escalated case varies depending on the nature of the business and their exposed risks.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $90K.

Efficiency Improvement In Penetration Testing

Evidence and data. For red teams, HTB improved penetration testing efficiency by helping testers enter assessments with more hands-on experience. The testers could complete baseline discovery faster, avoid unproductive investigation paths, and apply tested techniques more consistently. The efficiency improvement in penetration testing includes:

• Reduced engagement-level research and improved tester evidence. The director of red teams at a cybersecurity consultancy said, “We can do them much faster and more consistently. So, it saved us two to three hours per engagement and then the added confidence of the team, understanding the tooling, knowing how it worked, and being confident in how to perform the test.”

• Better triage and less wasted effort. HTB improved tester judgment and prioritization, reducing wasted effort during assessments and helping them focus on more fruitful attack paths. The head of ethical hacking at a financial services company shared, “They’re also able to triage better and to prioritize and by having run the images and going down rabbit holes to find that this meant nothing, you start becoming better at realizing, ‘Okay, this isn’t fruitful’ or, ‘I’ve been doing this for too long, let me pause, take a note, go try something else and come back to it with fresh eyes.’”

Interviewees also found HTB improved managers’ visibility into practitioner readiness, enabling them to assign the right people to the right engagements and reduce their level of involvement in day-to-day practitioner activity.

• Reduced quality review time with improved practitioner readiness. The director of red teams at a cybersecurity consultancy said, “In the past, a manager would have to be a lot more hands on and be engaged with it and they would have to be on one engagement at a time or oversee one engagement or two. And now a manager can oversee maybe three or four just because they don’t have to spend as much time on QA and making sure the team is able to perform.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The average time a tester spends on initial scanning is 8 hours prior to HTB, as it requires more time on engagement level research, learning, and triage.

• The average time a consulting manager spends on quality control is 2 hours prior to HTB.

• Productivity recapture rate accounts for the fact that employees typically do not repurpose all time gains into work activity.

Risks. The financial model considered the following modeling risks:

• The time spent for pen testing and quality assurance are related to cyber workforce skill level and the operating environment.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $197K.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Development of an attacker mindset among defenders and testers. All customers have acknowledged HTB shifts security teams from a reactive posture to a proactive mindset. This cognitive shift empowers teams to anticipate adversarial behavior and neutralize threats before they impact the business. “The reason we got it initially… is because we wanted to get our team to be able to think like an attacker and understand what an attacker will be looking for… because we think that makes a better defender,” shared by the head of global cyber incident response at a professional services firm.

• Improved cyber workforce development visibility and targeted skill development. HTB provides leaders with data-driven visibility into cyber workforce capabilities, allowing them to precisely map skill gaps, optimize resource allocation, and design targeted development pathways that align security team capabilities with evolving business risks. The global head of ethical hacking at a financial services firm said, “With the actual platform and with the solution, we can gauge where somebody is at versus where they were six months ago and that’s very impactful.”

• Created an engaging, collaborative and fun team culture. By leveraging the CTF Platform as well as Dedicated, Professional, and Cloud Labs, HTB customers bridge the gap between distributed teams, boost morale, and create a culture of collective problem-solving. The head of global cyber incident response at a professional services firm said, “I can’t brag enough about the morale boosting and the team building that we achieved using the CTF.”

• Enhanced employee career development and personal branding. HTB certifications and hands-on learning gives cyber practitioners technical confidence to tackle complex threats while also demonstrating how personal development translates into workplace pride and organizational trust. The director of red teams at a cybersecurity consultancy shared, “An added benefit especially to each of the team members is for their personal brand. They now have a certification to go with their name to show what they’re capable of doing.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Hack The Box and later realize additional uses and business opportunities, including:

• Improve technical hiring efficiency and candidate quality. Customers could expand HTB usage into talent acquisition by using platform progress, hands-on challenges, and interview labs to validate candidates’ technical capabilities and collaboration style before hiring.

• Extend hands-on training into realistic defensive cyber range exercises. Organizations could use Threat Range to run blue-team and purple-team simulations, and expect more activities that are full-scenario and team-based. It will provide analysts safe practice as a team with incident response, threat hunting, and detection workflows without exposing production environments to risk.

• Improve cyber workforce enablement in response to AI-driven threats. As AI expands the speed, sophistication, and reach of cyberattacks, organizations may extend HTB beyond specialist security teams to a wider set of employees who influence cyber risk, including software engineers, cloud teams, AI/ML teams, product security teams, and security-adjacent business users. By scaling practical, hands-on security education across a broader workforce, organizations could improve baseline security knowledge, strengthen secure-by-design practices, and better prepare employees to recognize and respond to emerging AI-enabled threats.