What is ethical hacking?
What is ethical hacking? It is breaking into a computer system the way a criminal would, with one difference that changes everything: the owner asked you to. An ethical hacker hunts for weak spots in websites, apps, networks and AI systems, then hands the findings to the people who can fix them, before anyone with worse intentions finds the same holes.
The skills are the same on both sides. The same tools that map a network, guess at a login or slip odd input into a form can be used to steal or to protect. What separates the two is permission, limits and what happens to the findings afterward. whitehatstoic, a software, security and AI safety practice, sums up its own work in three words: "Software · Security · AI safety".
If you build or run software, knowing how ethical hacking works helps you ask for it, read its results and set up a way for outsiders to report what they find.
White hats, black hats and grey hats
Security people often sort hackers by hat colour. Wikipedia's page on the white hat hacker describes one as a hacker who obeys the law and follows professional ethics, and who, with the owner's consent, deliberately hacks a system to find its weaknesses so it can be made stronger against malicious attackers. The same page traces the labels to old Western films, where the hero and the villain were told apart by a white or a black hat.
- White hat: has permission, stays inside the agreed limits, reports privately.
- Black hat: breaks in for gain or damage, with no permission at all.
- Grey hat: means well but sometimes hacks without permission or proper consent, then tells the owner, or the public, afterward.
The grey hat is where most real arguments happen. Good intentions do not turn an unauthorized break-in into a lawful one. In many countries, getting into a system you were not allowed into is a crime whatever you did next. That is why ethical hacking starts with paperwork, not with a scanner.
Permission and scope come before any probing
An ethical hacking job begins with a written agreement. It answers a few plain questions:
- Which systems? Named domains, IP ranges, apps or AI models. Anything not listed is off limits, even if it looks connected.
- Which methods? Some owners allow phishing emails to staff; many forbid anything that could take a live service down.
- When? A start date, an end date, sometimes only certain hours, so the owner's own security team can tell an approved probe from a real attack.
- Who signs? Someone who actually has the right to approve access to those systems.
Scope protects both sides. The owner knows nothing outside the list will be touched. The hacker has a document showing that what they did was asked for. When a finding leads somewhere outside the scope, say a shared login server run by another company, the ethical move is to stop and ask, not to follow the trail.
Wikipedia calls an authorized simulated attack of this kind a pentest: an approved, simulated cyberattack meant to find weaknesses that could let an outsider reach a system's features and data, and to note its strengths too, so the owner gets a full picture of the risk.
What ethical hackers actually do on a job
The work is less dramatic than films suggest. Most of it is careful reading, small experiments and notes.
- Map what is there. List the pages, endpoints, sign-in flows and third-party pieces inside the scope.
- Think like the attacker. Ask what someone would want here: other people's data, admin rights, heavy use of an AI feature on someone else's bill.
- Probe the likely weak spots. Change an ID in a URL, send input the form does not expect, replay an old session, hide instructions in a document an AI assistant will read.
- Prove it without harm. Show that the hole is real using a dummy account or a harmless marker, not by pulling real customer records.
- Write it up. For each finding: what it is, the exact steps to repeat it, how serious it is and what would fix it.
The checklist many web teams start from is the OWASP Top 10, a list of the most common kinds of web app risk. For AI systems, ethical hackers add newer questions: can a hidden instruction steer the model, can it be talked out of its safety rules, can it leak data it was given?
A worked example: one small shop, one order page
Take a small online shop. Its owner signs an agreement with an ethical hacker covering the shop's website and its order API for two weeks. The payment provider's own pages are left out, because the shop does not own them and cannot give permission for them.
The hacker makes two ordinary customer accounts, A and B. Signed in as A, they open an order and see an address ending in /orders/1043. They change the number to 1042, an order placed by account B. The page loads, showing B's name, address and items.
That one change is the whole finding. The server checks that someone is signed in, but never checks that the order belongs to them. The hacker stops there. They do not walk through thousands of order numbers to see how many real customers are exposed, because proving the flaw with their own two accounts is enough, and reading real customers' data would cross the line the agreement draws.
The report says:
- Finding: any signed-in customer can read any other customer's order by changing the number in the address.
- Steps to repeat: sign in as A, open order 1043, change it to 1042.
- Severity: high, since names and home addresses are exposed.
- Fix: on every order request, refuse unless the order's owner matches the signed-in account.
The shop's developer adds the check. The hacker repeats the same steps, gets a refusal, and marks the finding closed. Nothing about it is published while the hole is open.
Bug bounties and disclosure deadlines
Not every ethical hacker works under a contract. Many organizations let anyone report flaws through a public program. Wikipedia describes a bug bounty program as a deal in which people get recognition and money for reporting bugs, especially security ones; with no money involved, the same setup is called a vulnerability disclosure program. The program's rules act as the permission and the scope: which sites count, which methods are banned and how to report.
Then comes the question of when the world hears about a flaw. Wikipedia's page on vulnerability disclosure describes coordinated vulnerability disclosure, once called responsible disclosure, as reporting a flaw to the vendor or a coordinator, who tracks the fix and agrees on when details are shared. To stop vendors from stalling forever, a common practice is to publish after a deadline, usually 90 or 120 days, cut to 7 days when the flaw is already being exploited. Google's Project Zero, the same page notes, uses a 90-day deadline that starts when the vendor is told.
The other camp, full disclosure, publishes details as early as possible so that possible victims know as much as attackers do. Most ethical hackers sit in the coordinated camp, with a deadline to keep the pressure on.
Frequently asked questions
Is ethical hacking legal?
It is legal when the owner of the system gave clear permission and you stay inside the agreed scope. Without that permission, the same actions can be a crime even if you meant to help.
What is the difference between ethical hacking and a pentest?
A pentest is one kind of ethical hacking: a planned, time-boxed, authorized attack on named systems with a written report at the end. Ethical hacking also covers bug bounty work, research and ongoing checks.
What should you do if you find a flaw by accident?
Stop, do not dig further, and look for the owner's security contact or disclosure policy. Report what you saw and how, and do not share it publicly until it is fixed or a deadline has passed.
Can AI systems be hacked ethically too?
Yes. The same rules apply: permission, scope and private reports. The weak spots differ, such as hidden instructions in content a model reads or prompts that talk it out of its safety rules.
Why ethical hacking keeps software honest
Every system has flaws its builders did not see. The only open question is who finds them first and what they do next. Ethical hacking is a deliberate answer to that question: invite skilled people to attack, fence the attack with written limits, and route every finding to the people who can close it.
The three habits that define it are simple to state and hard to fake. Ask before you touch. Stay inside the lines you were given. Tell the owner first, and the public only once there is a fix or the agreed time is up. A hacker who keeps all three is doing security work. One who drops any of them is doing something else, whatever they call it.
whitehatstoic
Build it right. Test it thoroughly. Keep it safe. Visit whitehatstoic.com
