1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
What is an ethical hacker? Definition, white, grey and black hat, the legal basis, and how to hire one
An ethical hacker uses the same techniques as a criminal attacker, with one difference that changes everything: permission. This guide explains what the term covers, what makes the work legal in the Netherlands and abroad, what ethical hackers actually do for organisations, and what to arrange before you hire one.
What an ethical hacker is
An ethical hacker is a person who deliberately looks for security weaknesses in computer systems, networks, applications or organisations, with the knowledge and consent of the owner, so that those weaknesses are fixed rather than exploited. The skills are identical to those of a criminal hacker: reconnaissance, finding vulnerabilities, exploiting them, escalating access. The intent, the authorisation and the outcome are the opposite. The term is sometimes written as white hat hacker; ethical hacking describes the activity.
Ethical hacking is an umbrella. It covers professional penetration testers working under contract, red teamers simulating a specific adversary, security researchers who find and report flaws in widely used products, bug bounty hunters working within a published programme, and in-house security engineers attacking their own systems. What unites them is a lawful basis for every action: a contract, a published disclosure policy, or the owner's explicit permission.
The word hacker itself is older and more neutral than its newsroom use. In the technical community it still means someone who understands systems deeply enough to make them do things they were not designed to do. Ethical hackers are hackers in that sense who have chosen to work on the defending side, and who accept the paperwork that comes with it.
White hat, grey hat and black hat
The hat colours describe intent and authorisation, not skill. The same person can hold different positions on different days, which is exactly why written permission matters.
White hat
Works with explicit authorisation and reports everything to the owner. Penetration testers under contract, red teamers with a signed mandate, bug bounty participants inside a published scope, internal security teams. Every action is documented and traceable. This is what people mean when they say ethical hacker.
Grey hat
Finds vulnerabilities without prior permission and usually reports them, sometimes asking for a reward, sometimes publishing. The intentions may be good; the legal position is not. In the Netherlands, unauthorised access remains computervredebreuk even when the finder reports it, although the public prosecutor weighs good faith and proportionality under the coordinated vulnerability disclosure framework.
Black hat
Attacks for personal gain, sabotage, espionage or ideology, without permission and without reporting. Ransomware operators, data brokers, state-sponsored intrusion teams. These are the adversaries that ethical hackers model, which is why ethical hackers study their tooling and tradecraft so closely.
The legal basis: what makes ethical hacking legal
Nothing about the technique is legal or illegal in itself. The paperwork is. Five elements decide whether an action is a service or an offence.
1. The offence: computervredebreuk (Article 138ab Sr)
In the Netherlands, intentionally and unlawfully entering a computer system, or part of one, is computervredebreuk under Article 138ab of the Wetboek van Strafrecht (Sr). It is punishable by imprisonment or a fine, with higher maximums when data is copied or the access is used to break into further systems. Related provisions criminalise disrupting access to systems and destroying or altering data. Unlawfully is the operative word: access with the owner's consent is not unlawful.
2. Written authorisation: the mandate
What makes a penetration test legal is the owner's prior written permission, usually a signed authorisation or mandate letter attached to the contract, naming the systems in scope, the time window, the permitted techniques and the people allowed to test. The person signing must actually be entitled to consent: your own servers, yes; a vendor's shared SaaS platform, only with that vendor's agreement. Testers carry this document during the engagement, which is why it is sometimes called the get-out-of-jail letter.
3. Coordinated Vulnerability Disclosure (the NCSC guideline)
For vulnerabilities found without a contract, the Netherlands has had a national framework since the NCSC published its responsible disclosure guideline in 2013, revised in 2018 as the Coordinated Vulnerability Disclosure (CVD) guideline. Organisations publish a CVD policy stating how to report, what a reporter may and may not do, and that they will not pursue charges if the reporter stays within it. The Openbaar Ministerie has stated that it weighs whether a reporter acted in the general interest, proportionately and no further than necessary. A CVD policy is not a licence to attack; it is a published invitation with limits.
4. Other jurisdictions for cross-border work
If systems or testers sit outside the Netherlands, other laws apply at the same time. In the EU, Directive 2013/40/EU harmonises the offences of illegal access, system interference and data interference. In the United States the Computer Fraud and Abuse Act (18 U.S.C. § 1030) applies, and the Department of Justice stated in 2022 that good-faith security research should not be charged under it. In the United Kingdom the Computer Misuse Act 1990 applies and contains no general research exemption. Written authorisation covering every jurisdiction involved remains the only reliable protection.
5. Privacy and contractual limits
Authorisation from the owner does not override the GDPR. A test that touches personal data needs a lawful basis, a data processing agreement where the tester acts as processor, and data minimisation in the report: screenshots redacted, no exfiltrated personal data retained. Contracts with cloud providers, payment processors and software vendors may require notification or forbid certain tests. Checking them is part of scoping, not an afterthought.
What ethical hackers do for organisations
Six services, from a one-off test to a standing programme. Most organisations start with the first and add the others as their defences mature.
Penetration testing
A scoped, time-boxed attack on specific systems (web applications, APIs, networks, cloud, mobile) following a methodology such as PTES, OWASP WSTG or NIST SP 800-115, ending in a report with severity-rated findings and fixes. The most common form of ethical hacking that organisations buy.
Red teaming
An objective-driven simulation of a real adversary over weeks or months, measuring whether the organisation detects and responds, not only whether it has vulnerabilities. Only a small control group knows it is happening. Regulated financial entities meet it as threat-led penetration testing under DORA.
Bug bounty and CVD programmes
A published policy inviting outside ethical hackers to report vulnerabilities in exchange for recognition or a reward, within stated rules. Mature organisations run one alongside contracted testing, because thousands of independent eyes find what a two-week test cannot.
Security research
Studying widely used products, protocols or platforms to find new classes of weakness, then disclosing them responsibly to the vendor so a patch exists before the flaw is public. Most CVE entries begin with an ethical hacker doing this work.
Social engineering and awareness testing
Phishing simulations, voice-based pretexting and, where scoped, physical access attempts, to measure how people and procedures hold up against manipulation. Always with authorisation, always with care for the staff involved, and with results reported at group level rather than used to blame individuals.
Purple teaming and training
Attackers and defenders working side by side, running specific attack techniques against the organisation's own monitoring to tune detection and response. The fastest way to turn an offensive finding into a defensive improvement.
Ethical hacker vs penetration tester vs red teamer vs bug bounty hunter
One is a description of intent; the others are specific disciplines. When you buy a service, you are buying one of the disciplines.
| Term | Nature | Legal basis | What you receive |
|---|---|---|---|
| Ethical hacker | Umbrella description of anyone applying offensive skills lawfully | Whatever authorisation they operate under | Depends on the role |
| Penetration tester | Professional discipline: scoped, time-boxed test following a methodology | Contract plus signed authorisation | Report with findings, evidence, severity and fixes; retest |
| Red teamer | Professional discipline: objective-driven adversary simulation measuring detection and response | Contract plus authorisation known to a small control group | Attack narrative, detection timeline, response gaps |
| Bug bounty hunter / researcher | Independent; works within published programmes or through coordinated disclosure | Public programme policy or CVD policy | Individual vulnerability reports, usually rewarded per finding |
Hiring an ethical hacker: what to arrange
If you searched for how to hire an ethical hacker, what you need in practice is a penetration test or a red team engagement from a firm that can show you its people, its method and its paperwork. Our penetration testing service page covers scoping and what you receive; the essentials before anyone starts are these.
- A written scope naming systems, roles, environments, time window and explicit exclusions
- A signed authorisation (mandate letter) from someone entitled to consent for every system in scope, including third-party platforms where their consent is required
- A non-disclosure agreement and, where personal data may be touched, a data processing agreement
- Named testers with verifiable certifications (OSCP as a minimum; OSWE, OSEP or CREST for complex scopes) and a clean background
- Professional indemnity insurance that explicitly covers testing activity
- A documented methodology (PTES, OWASP WSTG or MASTG, NIST SP 800-115) and rules of engagement covering denial of service, social engineering and production data
- An escalation procedure for critical findings during the test, with names and response times
- A report format you have seen in advance, and a retest of fixed findings
What ethical hackers typically find
Across engagements the same categories return. In web applications: broken access control (one user reading or editing another's data), authentication weaknesses, injection and server-side request forgery, and business-logic flaws that no scanner can see. In internal networks: a flat network, legacy protocols still enabled, local administrator password reuse, over-privileged service accounts, and Active Directory misconfigurations that chain into domain administrator within days. In cloud environments: publicly readable storage, over-broad IAM roles, secrets committed to code, and unprotected metadata endpoints. In people and process: phishing that works on a meaningful share of staff, badge policies nobody enforces, and incident procedures that exist on paper only.
Few of these are exotic. Most are known weaknesses that nobody had connected into an attack path. That is the value an ethical hacker adds over a scanner: the path, the proof, and a prioritised list of what to close first. A finding rated medium on its own can be the first step of a chain that ends in your customer database, and only a human attacker reads it that way.
How HackersHub works
HackersHub is an Amsterdam-based offensive security firm with more than ten years of penetration testing and red teaming behind it. Every tester holds at least OSCP; the team includes OSWE and CREST-certified testers. Engagements are led by a named senior tester such as Michael van Mameren, Lead Penetration Tester (OSCP). No test starts without a written scope, a signed authorisation and agreed rules of engagement. Reports contain an executive summary, CVSS-scored findings with evidence, an attack narrative and a prioritised remediation plan, and a verification retest of medium and higher findings within 90 days is included. Clients rate the work 4.9/5 across 127 reviews.
If you need an ethical hacker, what you are really asking for is a scoped engagement with named, certified people and a defensible paper trail. That is what we provide, and we are happy to walk you through the authorisation documents before you commit to anything.
Frequently asked questions
Related guides
- What does a penetration tester do? Skills, certifications and how to judge one
- Penetration testing services by HackersHub
- How to choose a penetration testing company
- Penetration testing certifications and accreditations explained
- What is red teaming? Adversary simulation explained
- Social engineering testing services
- GDPR and penetration testing: Article 32 explained
Need an ethical hacker with the paperwork to match?
HackersHub delivers scoped penetration tests and red team engagements led by named, OSCP-certified testers, under a signed authorisation and a methodology you can read. Talk to an expert about your scope.