What governs ethical hacking and its practice?

• A. Authorized testing to identify vulnerabilities; governed by legal contracts and ethical guidelines
• B. Hacking for profit with no consent
• C. Penetration testing conducted only after a breach
• D. Testing systems without notifying stakeholders

Answer: (A)

The practice of ethical hacking is governed by explicit authorization, contracts, and ethical guidelines. Ethical hacking is performed only with written permission from the system owner and within a clearly defined scope. The agreement lays out what systems can be tested, which tools may be used, when testing can occur, and how findings are reported and handled. This governance protects the organization from legal risk, ensures testers don’t overstep boundaries, and keeps data handling and disclosure in check so sensitive information isn’t exposed or misused. By setting a rules-of-engagement framework, ethical hacking focuses on discovering vulnerabilities to improve security without causing harm or violating laws.

In contrast, hacking for profit without consent is illegal and unethical, because there’s no authorization to access or test systems. Conducting penetration testing only after a breach misses the preventive value of proactivity and could leave the organization exposed. Testing without notifying stakeholders or obtaining consent bypasses governance and can lead to unintended disruption, data loss, or privacy violations.