Guide
What a security hacker is, and where the legal line sits
A security hacker is someone who finds and exploits weaknesses in computer systems. The term covers both criminals and authorised professionals, so the useful question is always whether the owner gave permission.
- Signed written scope first
- Senior ethical hackers only
- Your NDA signed as standard
Where the term security hacker comes from
Early on, hacker simply meant someone who explored systems in clever ways. Later, security hacker came to mean someone focused on breaking defences. Therefore the word itself says nothing about whether the work is lawful.
Today the same skills appear on both sides. Only authorisation and intent decide which side someone is on.
Authorised and unauthorised security hackers
The law focuses on authorisation. For example, the US Computer Fraud and Abuse Act and the UK Computer Misuse Act both turn on whether access was permitted.
| Authorised | Unauthorised | |
|---|---|---|
| Permission | Written, from the owner. | None. |
| Scope | Agreed in advance. | Whatever they can reach. |
| Outcome | A report and fixes. | Damage, theft or extortion. |
Is the security hacker you are talking to legitimate?
Tick what they asked for. Legitimate firms ask for all of these.
Your result appears here as you tick, so you can see what is still open.
What an authorised security hacker does
An authorised tester simulates an attacker inside a defined scope. So the work follows a method, such as the Penetration Testing Execution Standard, and ends with a report that shows how each weakness can be fixed.
- Maps what an attacker could see
- Tests applications, networks and cloud
- Chains findings to show real impact
- Reports with reproducible steps and fixes
How to tell the difference when hiring
A legitimate firm asks you to prove ownership and sign a scope. By contrast, anyone offering to access systems you do not own is offering a crime. Therefore the paperwork is the clearest signal.
Working with Truevector
We are authorised ethical hackers. So we test only systems you own or are authorised to test, with a signed scope and an NDA first. Full engagements usually land between $35,000 and $120,000, with a floor of $25,000. The bounded External Exposure Review starts at $4,500, and its fee is credited in full against a full engagement commissioned within ninety days.
Security hacker questions
Is a security hacker always a criminal?
No. Authorised security hackers work for owners, with written permission.
What law covers hacking?
In the US, the Computer Fraud and Abuse Act; in the UK, the Computer Misuse Act.
Can a security hacker recover someone else's account for us?
Not lawfully, unless you own it. We decline those requests.
What do authorised testers deliver?
A report with findings, impact and fixes, plus a retest.
Related guides
Work with an authorised security hacker
Tell us what you own and what worries you. We reply with a written scope and a fixed fee.
Request a written scope