November 5, 2026
Updated: November 5, 2026
What makes hacking legal, the main types and phases, which certifications mean what, and how to hire or become an ethical hacker.
Mohammed Khalil
What is ethical hacking? It is the authorized use of attacker techniques to find and fix security weaknesses before criminals exploit them. What separates it from a crime is permission, not skill: written authorization from whoever controls the systems, an agreed scope, rules of engagement and confidential reporting. Ethical hacking takes several forms, including penetration testing, red teaming, bug bounty programs and vulnerability assessments. In the United States, testing without authorization can violate the Computer Fraud and Abuse Act even when the motive is good, so the paperwork matters as much as the technique.
This guide is written for two readers: the buyer who has to commission and judge ethical hacking work, and the practitioner who wants to do it legally and well.
Ethical hacking means using the same methods a real attacker would use, such as reconnaissance, scanning, exploiting weaknesses and moving between systems, against systems you have been given permission to test. The goal is not to cause damage. It is to show the owner what an attacker could do so they can fix it.
NIST's glossary describes penetration testing, the most common form, as security testing in which evaluators "mimic real-world attacks" to find ways around the security features of an application, system or network. It defines a red team as a group "authorized and organized to emulate a potential adversary." Both definitions put authorization at the center, and so does every legitimate form of ethical hacking.
An ethical hacker, also called a white hat hacker, is the person doing that work. They may be an in-house security engineer, a consultant at a testing firm or an independent researcher reporting through a bug bounty program.
| Label | Permission | Intent | Legal position (U.S.) |
|---|---|---|---|
| White hat (ethical hacker) | Written authorization from the asset owner, or a published program that grants it | Find and fix weaknesses | Lawful when the work stays within the authorization |
| Gray hat | None, or exceeds what was granted | Often says it wants to help, may disclose publicly or ask for payment | Unauthorized access can still violate the CFAA and state laws |
| Black hat | None | Theft, extortion, disruption or espionage | Criminal |
The gray hat row is the one practitioners need to understand. Good intentions do not create permission. A researcher who probes a company's systems without an invitation and then asks for a reward can look a lot like extortion, and the U.S. Department of Justice has said that claiming to do research is "not a free pass" for bad-faith conduct.
Ethical hacking is the umbrella term. Penetration testing is one type of ethical hacking: a scoped, time-boxed assessment that tries to exploit weaknesses in specific systems and reports the results. Red teaming, bug bounty work, social engineering tests and vulnerability assessments are other types. Every penetration test is ethical hacking, but not every ethical hacking activity is a penetration test. For the full process, deliverables and test types, see our guide to what penetration testing is.
The technical steps of an ethical hack and a criminal intrusion can look the same in the logs. What makes one legal is a set of conditions agreed in advance. A practical test is whether all four of the conditions below are met.
Authorization has to come from someone with the authority to grant it, and it should be written. That sounds obvious, but the system owner is not always the person who signs the contract. A business unit may not control the building it sits in, a customer does not control its cloud provider's infrastructure, and a parent company may not control a subsidiary's network.
Third parties set their own rules. AWS lets customers test their own resources on a list of permitted services without prior approval, but prohibits testing AWS's own infrastructure and requires prior approval for some activities, according to its penetration testing policy. Microsoft publishes unified rules of engagement that apply to resource owners and to the consultancies they hire. A test plan that touches cloud, SaaS or hosting providers should check each provider's terms before testing starts.
Scope lists the exact targets: domains, IP ranges, applications, environments, physical sites and people. It also lists what is excluded, such as production databases, third-party services or executives' personal accounts. Anything not in scope is not authorized. Our penetration testing scope guide covers how to write one.
Rules of engagement (RoE) set the conditions for the work. A solid RoE document covers:
Ethical hackers report what they find to the system owner, not to the public, and they give the owner time to fix it. Public bug bounty and vulnerability disclosure programs set their own disclosure rules, and testers follow them.
In the United States, the main federal anti-hacking law is the Computer Fraud and Abuse Act (18 U.S.C. 1030). It makes it a crime to access a protected computer "without authorization" or to "exceed authorized access." In Van Buren v. United States, decided June 3, 2021, the Supreme Court read "exceeds authorized access" narrowly: it covers someone who enters parts of a system, such as files or databases, that are off-limits to them, not someone who misuses information they were entitled to access.
For ethical hackers, the practical meaning is simple. Written authorization and a clear scope are what keep the work on the right side of the CFAA. Testing a system you were not invited to test, or wandering outside the agreed scope, is where the legal risk begins. State computer crime laws and civil claims apply on top of the federal law.
On May 19, 2022, the Department of Justice announced a new CFAA charging policy that, for the first time, directs that good-faith security research should not be charged. The policy is now part of the Justice Manual at 9-48.000.
| What the policy does | What it does not do |
|---|---|
| Tells federal prosecutors not to charge good-faith security research under the CFAA | Change the CFAA itself or give researchers a legal right to test |
| Defines good faith as access solely to test, investigate or correct a flaw, done to avoid harm, with results used mainly to improve security | Bind state prosecutors or stop civil lawsuits from the system owner |
| Requires federal prosecutors to consult the Criminal Division's computer crime section before charging a CFAA case | Protect someone who finds flaws in order to extort the owner, which the DOJ calls bad faith |
| Replaces the earlier 2014 policy | Replace a contract, a scope document or a program's safe harbor terms |
The policy lowers the risk for researchers acting in good faith, but it is a statement of prosecutorial discretion. For commissioned work, the authorization letter, scope and rules of engagement remain the real protection.
Other countries have their own laws. In the United Kingdom, the Computer Misuse Act 1990 makes unauthorized access to computer material an offense, and it has no general exception for security research. Any engagement that crosses borders should confirm that the authorization is valid where the systems and the testers are located. This is general information, not legal advice.
In September 2019, two penetration testers from the security firm Coalfire were arrested inside the Dallas County Courthouse in Iowa after midnight. They had a contract with Iowa's State Court Administration to test the judicial branch's security. According to the Iowa Legislative Services Agency's summary of an October 4, 2019 Senate oversight hearing, county officials were not told about the test, and the courthouse building was under county control, not the judicial branch's. The contract was based on 2015 documents, excluded areas in the Judicial Building but not in county courthouses, and was not legally reviewed by the judicial branch.
The testers were held on felony burglary charges, later reduced to misdemeanor trespass, as Ars Technica reported. Prosecutors dropped the charges on January 30, 2020. The lessons apply to every engagement:
Ethical hacking comes in several forms. Each one answers a different question, so the right choice depends on what you need to know.
| Type | Main question it answers | Who tests | Scope and timing | Best when |
|---|---|---|---|---|
| Penetration test | Which weaknesses in these systems can be exploited, and how badly? | Contracted or in-house testers | Defined systems, fixed window, usually days to weeks | You need validated findings, a report and evidence for customers or auditors |
| Red team assessment | Could a realistic adversary reach a business objective, and would we detect and respond? | Specialist red team | Objective-based, broad attack surface, weeks; defenders are often not told | Your security program is mature and you want to test detection and response |
| Bug bounty program | What can a large pool of outside researchers find over time? | Independent researchers paid per valid finding | Published scope, continuous or time-limited | You have a stable internet-facing attack surface and a team to triage reports |
| Vulnerability disclosure program (VDP) | How can anyone who finds a flaw report it safely? | Anyone, usually unpaid | Published policy, always open | Every organization with internet-facing services |
| Vulnerability assessment (the "VA" in VAPT) | Which known weaknesses exist across our assets? | Scanners plus analysts | Wide coverage, little or no exploitation | You need broad, frequent coverage between deeper tests |
| Purple team exercise | Do our detections work against specific attack techniques? | Red and blue teams together | Technique by technique, collaborative, days | You want to tune detections with direct feedback |
For depth on each type, see what red teaming is, our decision guide to penetration testing vs bug bounty, the VAPT guide and how to run a purple team exercise.
Within those types, testing is usually organized by target: web applications, APIs, external and internal networks, cloud environments, mobile apps, wireless networks, and people and buildings. Tests on people, such as phishing or phone pretexting, need extra approvals and care, as covered in our guide to social engineering penetration testing. Testers can also start with different levels of knowledge, from none to full source code. Our comparison of black box vs white box testing explains the trade-offs.
The U.S. Department of Defense ran the first federal bug bounty, Hack the Pentagon, from April 18 to May 12, 2016. According to the DoD's results release, it covered five public-facing websites and no critical networks. More than 1,400 researchers registered, more than 250 submitted at least one report, and 138 reports were judged legitimate, unique and eligible for a reward. The whole pilot cost $150,000, about half of it paid to the researchers.
The example shows both sides of the model. A bug bounty brings many testers to a narrow, well-defined public scope, but it is not designed to test internal networks, detection or business processes. The federal government later made vulnerability disclosure a baseline: CISA's Binding Operational Directive 20-01, issued September 2, 2020, requires federal civilian agencies to publish a vulnerability disclosure policy.
Most structured engagements follow the same arc. NIST SP 800-115 groups penetration testing into four phases: planning, discovery, attack and reporting. In practice, buyers see seven steps, because authorization and remediation sit on either side of the technical work.
| Phase | What happens | Question for the buyer | Output |
|---|---|---|---|
| 1. Authorization and planning | Goals, scope, rules of engagement, contacts and the stop procedure are agreed and signed | Is every in-scope asset authorized by its controlling party? | Signed authorization, scope and RoE |
| 2. Reconnaissance | Testers collect public and supplied information about in-scope assets: domains, services, technologies, staff roles if allowed | Does recon stay within the agreed sources and targets? | Asset and attack surface map |
| 3. Scanning and enumeration | Automated and manual discovery of services, versions, configurations and likely weaknesses | Are scans throttled and timed to avoid disruption? | Candidate weaknesses |
| 4. Exploitation and validation | Testers try to exploit weaknesses to prove real impact, using the least invasive method that shows it | Is impact proven with test data and minimal access to real data? | Validated findings with evidence |
| 5. Post-exploitation within scope | If allowed, testers check how far access goes: privilege escalation, lateral movement, access to sensitive systems | Are persistence and data handling limits written down? | Attack paths and business impact |
| 6. Reporting | Findings are rated (often with CVSS), explained, reproduced and paired with fixes; an executive summary explains risk | Can your engineers reproduce and fix each finding from the report? | Report, debrief and, if needed, an attestation letter |
| 7. Remediation and retest | The client fixes findings and the testers confirm the fixes work | Is a retest included, and on what terms? | Retest results |
Training material often lists "covering tracks" as the last hacking phase, because criminals hide their activity. In an authorized engagement that step is replaced by the opposite: testers keep detailed activity logs, remove any tools or test accounts they created, and tell the client exactly what they changed. If you want to test whether your team would detect a stealthy attacker, that belongs in a red team or purple team exercise with explicit approval, not in a routine penetration test.
For a phase-by-phase walkthrough with frameworks such as the OWASP Web Security Testing Guide, see our penetration testing methodology guide.
Certifications are how most buyers and employers judge an ethical hacker's training. They measure different things, so it helps to know what each exam actually requires. The details below come from each issuer's own pages as checked in November 2026.
| Certification | Issuer | Exam format | What it shows | Validity |
|---|---|---|---|---|
| OSCP and OSCP+ | OffSec | Proctored hands-on exam of 23 hours 45 minutes against a private lab network (three standalone machines and an Active Directory set of three), then 24 hours to submit a professional report; scaled scoring for exams from December 1, 2026 | Can exploit and escalate privileges on unknown systems under time pressure and document it | OSCP+ expires after three years unless maintained; the base OSCP does not expire |
| CEH (v13) | EC-Council | Knowledge exam of 125 multiple-choice questions in 4 hours; optional CEH Practical of 20 challenges in 6 hours; passing both earns CEH Master | Broad knowledge of attack techniques and tools; the practical adds hands-on proof | Per issuer terms |
| PNPT | TCM Security | Five full days to perform a network penetration test, including OSINT and Active Directory compromise, two more days to write a report, then a live 15-minute debrief with assessors | Can run an end-to-end external-to-internal test and present the results | Per issuer terms |
Sources: OffSec's OSCP+ exam guide and changes to the OSCP, which introduced OSCP+ on November 1, 2024; EC-Council's CEH program page; and TCM Security's PNPT certification page (certifications.tcm-sec.com/pnpt).
Other common credentials include CompTIA PenTest+, GIAC GPEN, OffSec's OSWE for web applications and OSEP for advanced evasion work, and CREST exams in the UK and other markets. Our list of top cybersecurity certifications covers the wider field.
Two cautions for buyers. First, certifications belong to people, not companies. Ask which certified testers will work on your engagement, not how many certificates the firm holds in total. Second, a certificate shows that someone passed an exam. It does not show that they can scope a test safely, communicate clearly or write a report your engineers can act on. Ask for a sample report as well.
Most organizations do not need to hire a "hacker." They need a specific question answered, such as whether an application is safe to launch, whether they meet a customer's or auditor's testing requirement, or whether a real attacker could reach their crown jewels. Start from that question and choose the sourcing model that fits.
| Model | Strengths | Limits | Fits |
|---|---|---|---|
| In-house security team | Deep context, continuous availability | Hard to hire and retain; testers may be too close to the systems | Large organizations with frequent releases |
| Penetration testing firm | Independent view, broad skills, formal report and attestation | Point-in-time unless contracted for ongoing work | Launches, compliance evidence, annual testing, major changes |
| Bug bounty platform or private program | Many testers and pay per valid finding | Needs internal triage capacity; limited to the published scope | Mature internet-facing products |
| Vulnerability disclosure policy | Safe reporting route for anyone | Not a test; findings arrive by chance | Every organization, alongside the other models |
Our guide on how to choose a penetration testing company goes deeper into vendor evaluation. For the legal side, check each item in the "What Makes Hacking Ethical" section against the proposal before you sign.
Ethical hacking is a real career, and most of it is less dramatic than the movies suggest. A typical week involves reading documentation, testing carefully, writing up findings and explaining them to engineers and managers. For job growth and hiring data, see our answer to whether cybersecurity is in demand.
The U.S. Bureau of Labor Statistics does not track penetration testers separately; it counts them within information security analysts. For that group, BLS reports a median annual wage of $129,180 in May 2025 and projects employment to grow 21% from 2025 to 2035, with about 14,100 openings a year. Pay for offensive security roles varies widely by experience, location and specialty.
Common roles include penetration tester, application security engineer, red team operator, security consultant and vulnerability researcher. A practical path looks like this:
Yes, when it is authorized. Ethical hacking is legal when the owner of the systems gives written permission and the tester stays within the agreed scope and rules. Testing without permission can violate the CFAA and state laws in the U.S., and similar laws elsewhere, even when the intent is good.
Ethical hacking is the broad practice of authorized hacking to improve security. Penetration testing is one type of it: a scoped, time-limited test that tries to exploit specific systems and reports the results. Red teaming, bug bounty work and vulnerability assessments are other types.
An ethical hacker agrees on scope and rules with the system owner, gathers information, looks for weaknesses, safely proves which ones can be exploited, and writes a report with evidence and fixes. They then help confirm the fixes work.
It depends on the goal. OSCP and PNPT are hands-on exams that show practical testing ability. CEH covers a broad range of techniques and has an optional practical exam. Many testers hold more than one, and buyers should look at the specific testers' credentials and sample reports.
Not always. BLS says information security analysts typically need a bachelor's degree in a computer-related field, but many penetration testers are hired on hands-on skills, certifications and demonstrated work in legal practice environments.
Training courses often list reconnaissance, scanning, gaining access, maintaining access and covering tracks. In an authorized engagement, the process starts with written authorization and planning, ends with reporting and retesting, and replaces covering tracks with full activity logs and cleanup.
Ethical hacking is only as useful as the questions it answers and the fixes that follow. Use the four conditions and the hiring checklist in this guide to define what you need tested and who must authorize it.
When you are ready, DeepStrike's penetration testing services start with a planning meeting to agree goals and scope, use manual testing with OSINT-based reconnaissance, validate each finding and rate its severity with CVSS, and deliver a report with reproduction steps, root causes and remediation guidance, plus an attestation letter. To discuss a specific scope, contact our team.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
