Ethical Hacker: Not so ethical after all?

Why good intentions, signed contracts, and “just doing my job” cannot tell us who the good guys are.

Created by Author

Imagine hiring someone to break into your business. You invite them to attack your systems, bypass your security, and discover how far an intruder could get. If they succeed, you thank them and pay the bill. That is the basic idea behind a penetration test: an authorised attempt to identify weaknesses before someone with ill intent discovers them.

Now imagine that, during the test, the hacker finds something nobody asked them to look for. Perhaps it is evidence of wrongdoing, private employee information, or a legal but deeply troubling business practice. What happens next? Should they follow the contract, protect the people affected, alert someone, or refuse to continue? Suddenly, “ethical hacker” stops sounding like a clear description and starts sounding like a question.

The distinction at the heart of this article is permission. It matters enormously, but it cannot carry the entire weight of ethics. Being allowed to do something does not automatically make doing it right. That is the central problem explored: what happens when professional authorisation, personal conscience, and the consequences of an action pull in different directions?

Forget the hoodie. Look at the decision.