Ethical Hacking: 5 Phases, 7 Tools, Real Pay Data 2026

On November 13, 2025, Anthropic published something that changed how security teams talk about attackers. A state-linked group had pointed an AI coding agent at roughly thirty companies and government bodies, and the agent handled 80 to 90 percent of the intrusion work on its own. Humans stepped in at maybe four to six decision points per campaign. That is the world ethical hacking now operates in, and it is why companies pay people to attack their own systems on purpose. This guide covers what the job really is, where the legal line sits under US law, the five phases, the seven tools beginners actually start with, and what the Bureau of Labor Statistics says the pay looks like.

What Is Ethical Hacking?

Ethical hacking is the authorized practice of breaking into a computer system, network, or application to find security weaknesses before criminals do. The work uses the same tools and techniques as a real attack, but it runs with the owner's written permission, and it ends with a written report instead of stolen data.

That last part matters more than most people expect. An ethical hacker is not paid to prove they can get in. They are paid to document exactly how they got in, what they could reach afterward, and what the fix costs. The deliverable is a document, not a trophy.

The financial case for it is easy to make. IBM's Cost of a Data Breach Report for 2025 put the average American breach at a record $10.22 million, even while the global average dropped to $4.44 million. Paying a team to find the hole first is a rounding error against that number.

Ethical Hacking vs. Malicious Hacking: The One Word That Decides It

Authorization is the entire difference. Strip it away and the two activities are technically identical. A port scan is a port scan whether a criminal or a consultant runs it.

What separates them:

• A criminal picks the target. An ethical hacker is given the target in writing.
• A criminal keeps what they find. An ethical hacker reports it and destroys their copy.
• A criminal hides the entry point so they can return. An ethical hacker hands over the exact steps so it gets closed.
• A criminal has no scope. An ethical hacker has a signed document listing which IP ranges, apps, and hours are fair game.

If you want the defensive half of this picture first, our guide to cyber security fundamentals walks through the threats and controls that ethical hackers spend their days testing.

Ethical Hacking vs. Penetration Testing vs. Red Teaming

People use these three terms as if they mean the same thing. They do not, and interviewers notice.

Ethical hacking is the umbrella. Any authorized security testing sits under it, including code review and configuration audits.

Penetration testing is a scoped, time-boxed engagement against a defined target. Two weeks, this web application, these credentials, here is the report. Most paid work in the field looks like this.

Red teaming simulates a specific adversary against the whole organization, and the defenders usually are not told it is happening. The goal is not a list of bugs. The goal is answering one question: would our security team have caught this? Red team engagements run for months and often include phishing and physical access attempts.

A vulnerability assessment is the cheapest cousin of all three. It scans and lists weaknesses without exploiting them. Useful, but it tells you nothing about whether an attacker could actually chain those weaknesses together.

Is Ethical Hacking Legal in the United States?

Yes, when you have written authorization from the system owner. Without it, the same actions are a federal crime under the Computer Fraud and Abuse Act, which covers accessing a protected computer without authorization or beyond what you were permitted to do. Good intentions are not a legal defense. Permission is.

Here is the part almost no beginner guide mentions. On May 19, 2022, the Department of Justice revised its charging policy for the CFAA and stated for the first time in policy that good faith security research should not be charged. The department defined that as accessing a computer purely to test, investigate, or fix a security flaw, done in a way that avoids harm, where the findings are used to improve security.

Read the limits carefully, because they are real:

The federal government also actively invites this work now. Under CISA's Binding Operational Directive 20-01, federal civilian agencies are required to publish a vulnerability disclosure policy telling researchers how to report flaws in their public systems without fear of legal action.

Written scope and signed authorization come before any testing begins.

Authorization Checklist: 6 Things to Get in Writing Before You Touch Anything

Print this. Every professional engagement should have all six on paper before a single packet leaves your machine.

1. 1. Named scope. Exact domains, IP ranges, applications, and cloud accounts. Anything not listed is out of bounds, including that interesting subdomain you find on day two.
2. 2. Signed authorization from someone who can actually grant it. A developer saying "go ahead" is not authorization. It needs to come from the system owner or an officer who can bind the company.
3. 3. A testing window. Start date, end date, and permitted hours. Running a load-heavy scan during a retailer's Black Friday is how a legal engagement becomes a lawsuit.
4. 4. Explicitly forbidden techniques. Most contracts rule out denial of service, social engineering against staff personal accounts, and physical entry unless separately approved.
5. 5. Data handling rules. What happens if you pull real customer records. Where proof gets stored, how it is encrypted, and when it gets destroyed.
6. 6. An emergency contact and a stop clause. A phone number that answers at 2 a.m. and a written agreement on who can halt the test and how.

The 5 Phases of Ethical Hacking, Step by Step

Every structured engagement moves through the same five stages. Learn these in order, because the quality of phase one decides how well the other four go.

1. Reconnaissance. Gathering information about the target before touching it. Passive recon uses public sources only: DNS records, certificate transparency logs, job postings that reveal the tech stack, LinkedIn profiles that map the org chart. Active recon involves direct contact with the target's systems. Most beginners rush this phase, and most experienced testers say it is where engagements are won.

2. Scanning. Turning that information into a map. Which hosts are alive, which ports are open, which services and versions are running, which of those versions have known flaws. This is where a target stops being a domain name and becomes a specific attack surface.

3. Gaining Access. Exploiting a weakness to get a foothold. It might be an unpatched service, a SQL injection flaw, a default credential nobody rotated, or a misconfigured cloud storage bucket. Real engagements rarely turn on a single dramatic exploit. They usually chain three or four small mistakes together.

4. Maintaining Access. Establishing persistence to see how deep the problem goes. Could an attacker who got into a low-privilege web server reach the customer database from there? That question is the whole point. In an authorized test, every persistence mechanism gets documented and removed at the end.

Types of Hackers: White Hat, Black Hat, and Everyone in Between

The color-coded hat labels are old, but the industry still uses them, so learn the vocabulary.

Gray hats are worth pausing on. Finding a flaw in a stranger's website and emailing them about it feels helpful. Under the CFAA, it is still unauthorized access, and companies have prosecuted people for exactly that. If a site has no published vulnerability disclosure policy, you have no invitation.

How AI Changed Ethical Hacking in 2025 and 2026

This is the shift that most guides on this topic have not caught up with. In under two years, AI agents went from a research demo to a documented participant on both sides of real attacks.

AI agents now appear on both the attacking and defending side of documented incidents.

Where AI Actually Helps the Ethical Hacker

Reconnaissance and triage. Sorting thousands of scanner results, summarizing an unfamiliar codebase, drafting the boring half of the report, spotting patterns across log files. These are volume problems, and volume problems are what models are good at.

Where AI Still Fails

Anthropic's own write-up on the campaign it disrupted is unusually candid about this. Their agent occasionally hallucinated credentials and claimed to have extracted secret information that turned out to be publicly available.

AI Systems Are Now the Target, Not Just the Tool

Here is the second half of the story. Companies are shipping chatbots, agents, and model APIs into production faster than they are securing them, and that creates a brand new attack surface that did not exist five years ago.

What ethical hackers are being asked to test on AI systems:

• Prompt injection. Hostile instructions hidden in a document, a web page, or an email that the model reads and obeys. If an agent can browse and also send email, an injected instruction can turn it into an insider.
• Excessive agent permissions. An assistant given database write access to be helpful is a privilege escalation path waiting to be found.
• Training and retrieval data leakage. Getting a model to reveal records from documents it was never supposed to expose to that particular user.
• Unprotected model APIs. Endpoints shipped without rate limits, authentication, or logging, because they started as an internal prototype.

The demand signal is measurable. HackerOne's 2025 report found AI-related vulnerability reports rising sharply while more than a thousand programs added AI systems to their official scope. Anyone who can test both a traditional web app and an LLM-backed feature is currently rare, and rare is where the money is. If you are mapping out what to study, our guide to the skills employers actually ask for pairs well with this section.

7 Ethical Hacking Tools Beginners Actually Start With

Skip the giant tool lists. Seven tools cover the overwhelming majority of entry-level work, and knowing why you reach for each one matters more than memorizing flags.

1. 1. Nmap. Host discovery and port scanning. Your first look at what a target is running.
2. 2. Wireshark. Packet capture and analysis. The fastest way to build real intuition about how protocols behave.
3. 3. Burp Suite. Intercepting proxy for web applications. If you plan to test web apps, this becomes your daily driver.
4. 4. Metasploit Framework. Exploit development and delivery. Excellent for lab practice against deliberately vulnerable machines.
5. 5. Nikto. Quick web server misconfiguration scanner. Noisy, but fast at catching forgotten admin panels and stale files.
6. 6. John the Ripper or Hashcat. Password cracking, used to prove that a recovered hash represents a weak credential.
7. 7. OWASP ZAP. A free, open-source web application scanner. A practical starting point before paying for anything.

Is Ethical Hacking a Good Career? Real US Pay and Demand Data

Most articles on this topic quote salary figures scraped from job boards. Those numbers move constantly and nobody audits them. Here is the primary source instead.

The US Bureau of Labor Statistics reports a median annual wage of $124,910 for information security analysts as of May 2024. Employment in the occupation is projected to grow 29 percent between 2024 and 2034, which is dramatically faster than the average across all occupations, with roughly 16,000 openings expected each year over that decade.

Two honest caveats. Information security analyst is a broad category that includes defensive roles, not only penetration testers. And a 29 percent growth rate does not mean entry-level hiring is easy. Security is famously short on junior openings relative to mid-level ones, which is why documented practice work matters so much early on.

Bug Bounties: What Independent Hackers Actually Earn

The freelance path is real, and so is the gap between the headlines and the median. HackerOne's ninth annual report, covering July 2024 through June 2025, recorded $81 million paid out to researchers, a 13 percent increase over the prior year, alongside an estimated $3 billion in breach losses avoided.

Split that honestly. A handful of full-time hunters earn six figures. The average participant earns considerably less, because payouts concentrate heavily at the top of the leaderboard. Treat bug bounties as skill-building and portfolio material first, income second. Publicly disclosed reports with your name on them are the closest thing this industry has to a resume that hiring managers actually read.

How to Become an Ethical Hacker With No Experience

A Realistic 12-Month Learning Path

Months 1 to 3, foundations. Networking first: TCP/IP, DNS, HTTP, subnetting, how a request actually travels. Then Linux command line until it stops feeling foreign. Then one scripting language, and Python is the default for good reason.

Months 4 to 6, the web. Learn the OWASP Top 10 properly and understand why each flaw works, not just what it is called. Set up a home lab with deliberately vulnerable applications and break them repeatedly.

Months 7 to 9, offensive practice. Capture the flag competitions and legal practice platforms. Start writing up every box you solve, even the ones you needed a hint for. The writeups become your portfolio.

Months 10 to 12, real reports. Move to programs that invite testing, such as public bug bounty programs and the federal agency vulnerability disclosure programs published under BOD 20-01. Aim for one accepted, disclosed report. One real finding beats three certifications on a resume with no evidence behind it.

Timelines vary a lot depending on your starting point. Someone already working in IT support or development will move considerably faster than someone starting from zero.

A home lab with deliberately vulnerable machines is where the first nine months of practice happen.

CEH vs. OSCP vs. PenTest+: Which One First?

CEH, from EC-Council, is broad and multiple choice. It shows up most often in job postings from large enterprises and government contractors, largely because of compliance requirements rather than technical depth.

OSCP, from OffSec, is the hands-on one. The exam requires compromising live machines under time pressure and writing a professional report afterward, and that report requirement is exactly why hiring managers respect it.

CompTIA PenTest+ sits between the two, vendor-neutral and less demanding than OSCP.

Straight verdict: if you want a hands-on testing role, OSCP carries the most weight per dollar. If you are targeting a federal contractor or a large regulated enterprise, check the actual job listings in your area first, because compliance frameworks sometimes name CEH specifically. Certification pricing changes regularly, so confirm current costs on the official EC-Council, OffSec, and CompTIA sites rather than trusting any blog, including this one.

Where to Practice Legally

• Deliberately vulnerable applications you install on your own machine
• Capture the flag competitions, which are built for exactly this
• Public bug bounty programs, within their published scope only
• Federal agency vulnerability disclosure programs, which exist because CISA required agencies to publish them
• Your own hardware, your own router, your own cloud account

Anything outside that list needs written permission first. No gray area is worth the risk.

Frequently Asked Questions

The Bottom Line

Ethical hacking is not a mindset or a personality type. It is a documented profession defined by one thing: written permission, followed by an honest report. The BLS numbers say demand is strong, the DOJ's 2022 policy gives good faith researchers meaningful cover, and AI has genuinely changed both the tools and the targets. What has not changed is the foundation. Networking, Linux, and web fundamentals still decide who is good at this and who just owns the software.

Start with one deliberately vulnerable machine this week. Break it, then write down exactly how. That writeup is the first page of your portfolio.

Which part of the path are you on right now, foundations or your first bug bounty report? Drop a comment and tell us where you are stuck. If this helped, share it with someone who keeps saying they want to get into security but has not opened a terminal yet.