What is ethical hacking? How white-hat hackers work, and how to start legally

What ethical hacking is

Ethical hacking, also called penetration testing or white-hat hacking, is the practice of testing computers, networks, apps or people for weaknesses, with the owner’s permission, so the weaknesses can be fixed before a real attacker finds them. The idea is simple: if you want to know whether your defences work, ask someone with attacker skills to try to get past them, then listen carefully to the results.

What makes it ethical is not the technique, which can be the same as a criminal’s. It is the authorisation, the agreed limits, the honesty about what was found, and the focus on helping the owner improve. Our article on the types of hackers shows where white hats sit among the others.

What ethical hackers actually do

The popular picture is someone typing furiously. The real job has a lot more structure and a lot more writing. Typical work includes:

• Penetration tests. Authorised attempts to break into a network, application or device to show what a real attacker could reach.
• Vulnerability assessments. Systematically looking for known weaknesses, such as missing updates or default passwords.
• Code and configuration reviews. Checking software and settings for mistakes.
• Social engineering tests. With permission, checking whether staff can be tricked by a fake email or phone call, so training can improve. See our AI scam message quiz for the staff-side version.
• Reporting and advice. Writing clear reports that explain what was found, how serious it is and how to fix it. This is often the most valuable part.
• Responsible disclosure. If they find a flaw in someone’s product, reporting it privately to the maker so it can be fixed before it is made public.

How a legitimate test is organised

A professional test follows a clear process, in plain terms:

1. Agree the scope in writing. What systems may be tested, what is off limits, when testing happens and who to contact if something breaks. This document is the permission.
2. Gather information about the target using allowed methods.
3. Look for weaknesses within the agreed scope.
4. Test them carefully, without damaging systems or reading data the test does not need.
5. Report the findings clearly, ranked by how serious they are, with advice on fixes.
6. Re-test after the fixes to confirm the problems are gone.
7. Keep everything confidential, including any sensitive data seen along the way.

You will notice that nothing in this list happens before permission. That is the line.

The legal side: permission is everything

In most countries, including the United States and New Zealand, getting into a computer system without authorisation is a criminal offence. Good intentions do not change that. Curious people sometimes “just have a look” at a website, a school network or a company’s systems, and discover that the law does not care about their motives.

• Test only what you own or have clear, written permission to test.
• Stay inside the scope. If a bug bounty programme or client says a system is off limits, it is off limits.
• Do not access, copy or keep other people’s data, even if you can.
• Report problems you stumble on through the organisation’s official channel, and do not publish them or demand payment.
• If in doubt, ask, or leave it alone.

This guide is general information, not legal advice. Laws differ by country, so check the rules where you live.

How to start learning, legally

You can build real skills without ever touching a system that is not yours:

1. Learn the basics first. How computers, networks and the web work, how operating systems such as Windows and Linux are set up, and the basics of a programming or scripting language. Python is a common starting point.
2. Build your own practice lab. Run test machines on your own computer using virtualisation software, on an isolated network that is not connected to anything you care about. Keep it separate from your everyday devices.
3. Use legal practice platforms. Several online services provide deliberately vulnerable machines and challenges to practise on safely. Capture-the-flag (CTF) competitions are another popular way to learn.
4. Try approved bug bounty programmes once you have skills. These are programmes in which companies publish the rules and what they will pay for, so testing is allowed within those rules. Read the scope carefully every time.
5. Learn defence too. The best security people understand how to detect and fix problems, not only how to find them. Start with the basics we cover in our safety guides.
6. Write things up. Keep notes on what you learn and what you tried. Clear writing is a core job skill.

Skills and certifications

Useful skills include networking basics (TCP/IP), operating systems, web technologies, scripting, and the ability to think like an attacker and explain things clearly. Just as important are curiosity, patience and honesty.

Certifications are one way to show what you know, and employers often list them. Commonly mentioned examples include CompTIA Security+ (a broad entry-level qualification), Certified Ethical Hacker (CEH), GIAC Penetration Tester (GPEN), Offensive Security Certified Professional (OSCP) and, for more experienced people, CISSP. The right one depends on the job you want, so look at real job advertisements in your area and see what they ask for.

Many people also get started through a tech or cyber security course, or by moving from another IT job such as support or networking.

Common myths

• “It is mostly typing code very fast.” Much of it is planning, patience, documentation and explaining findings in clear language.
• “I can try a little on my school or work network.” No. Without written permission it is unauthorised access, and that includes school and work systems.
• “I need to be a genius.” You need curiosity, persistence and good basics. The field is built by people who kept learning.
• “Finding a bug means I can demand payment.” No. Unauthorised testing followed by a demand for money can lead to serious legal trouble, including extortion allegations. Use the official reporting route.
• “It is all offence.” Defensive work (detecting, investigating and fixing) is a large part of the industry and a common way in.

A realistic first 90 days

This is a sample plan for someone starting from scratch. Adjust it to your time and background.

1. Weeks 1–3: learn how networks and the web work (IP addresses, DNS, HTTP and HTTPS). Set up a Linux virtual machine on your own computer.
2. Weeks 4–6: learn basic scripting in Python or a similar language. Practise reading logs and simple security tools in your own lab.
3. Weeks 7–9: start on beginner-level challenges on a legal practice platform. Write notes on each one.
4. Weeks 10–12: try a beginner capture-the-flag event, read a few published penetration test reports, and decide whether to aim at a certification such as CompTIA Security+ first.

Keep your lab isolated, never test anything that is not yours, and keep notes. They become your portfolio.

Careers in the field

Ethical hacking skills lead into several roles:

• Penetration tester. Carries out authorised tests, either for a consultancy that serves many clients or as an in-house team member.
• Security analyst. Watches systems for signs of attack and responds to incidents, often as a first step into the industry.
• Red team and blue team members. A red team plays the attacker. A blue team defends. Many people move between them.
• Vulnerability researcher or bug bounty hunter. Finds flaws in products and reports them responsibly.
• Security consultant or auditor. Helps organisations understand their risk and meet their obligations.

It is competitive, and it rewards people who keep learning, because attack methods and defences change constantly. It is also a field where being trustworthy matters as much as being technical.

Sources

• Akamai: What is a white hat hacker?Accessed October 13, 2026
• Mitnick Security: Types of hackersAccessed October 13, 2026

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.