The term ethical hacking, also called white-hat hacking, refers to the use of hacking skills and techniques with good intentions and with the full consent and approval of the target. Ethical hackers use their tools and knowledge to probe an IT system, database, network, or application for security vulnerabilities. They then inform the target of any flaws they find and provide recommendations for patching them.

Both parts of the definition above—good intentions and the target’s consent—are necessary to be an ethical hacker. If one or both parts are missing, the individual is known as a black hat or a gray hat hacker, depending on the motivation:

• Black hat hackers are malicious, lacking both good intentions and the consent of their targets. These individuals are what the term hacker means in the popular imagination. They break into IT environments, steal confidential data, or install ransomware that charges a fee for users to regain access to their computers. These individuals often have self-serving motivations, such as money or fame, and may work for political activism or government entities as part of a cyber warfare team.
• Gray hat hackers occupy a morally gray area between black-hat and white-hat. Their activities are often technically illegal, probing systems for vulnerabilities without the consent of their targets. However, gray hat hackers are motivated by passion or curiosity rather than the intent to exploit their findings for financial gain.

For individuals to be ethical or white hat hackers, they must obey a few key concepts:

1. The activities of ethical hackers must be with the target’s full knowledge and consent and always remain within legal boundaries.
2. They should work with the target to define the scope of their activities and must not go beyond this scope unless otherwise agreed upon.
3. They must report all the vulnerabilities they discover during their work and offer their best advice for fixing them.
4. They must respect the target’s privacy and security, including any sensitive or confidential information.

Ethical hackers are useful because they help organizations identify vulnerabilities in their IT environments before black hat hackers can exploit them. Businesses usually employ ethical hackers on internal IT teams or external contractors. The designation of an ethical hacker is usually not an official job title; instead, ethical hackers occupy roles such as security analysts, security engineers, and penetration testers.