Ethical hacking: the assessment that looks at your whole organization, not one system

A pentest answers “is this system secure?”. Ethical hacking answers “how far would someone coming after us actually get?”: it chains OSINT, external perimeter, internal network and privilege escalation in one engagement, with your team informed and without bounding it to a single asset. If you want one application or API tested in depth, what you want is a pentest; if you also want to measure detection capability, a Red Team.

Scope your project · Request an ethical hacking assessment

Rather talk it through? Call us at +34 960 730 013

Why ethical hacking instead of an automated vulnerability scan?

Automated scanners detect known vulnerabilities. An ethical hacker thinks like a real adversary: chains together seemingly minor flaws, exploits business logic and finds paths no scanner has in its database. The result isn't a list of CVEs — it's a demonstration of the real impact an attacker would have in your specific environment.

Types of ethical hacking engagement

• External ethical hacking: attack surface exposed to the internet (websites, APIs, email, VPNs)
• Internal ethical hacking: corporate network, segmentation, Active Directory, lateral movement
• Review of leaked credentials on the dark web and OSINT reconnaissance
• Controlled privilege escalation and post-exploitation
• Verification of perimeter and internal security controls

How we run an ethical hacking assessment

1. Scope definition: We agree on the exact perimeter, the rules of engagement and the execution window to avoid any impact on your operations.
2. Reconnaissance (OSINT): We gather public information about your organization: domains, IPs, emails, technologies and potentially exposed credentials.
3. Controlled attack: We attempt to compromise the systems in scope using the same tactics, techniques and procedures (TTPs) as the real threat actors documented in MITRE ATT&CK.
4. Post-exploitation: We assess what can be done once initial access is obtained: privilege escalation, lateral movement, access to sensitive data.
5. Report and remediation: We deliver an executive and technical report with evidence (PoC), criticality classification and a remediation roadmap.

What the ethical hacking report includes

• Executive report: risk in business terms, no technical jargon
• Technical report: vulnerabilities with PoC, CVSS and step-by-step recommendations
• Diagram of the attack path followed by the audit team
• Closing meeting with the technical team to review each finding
• Support during remediation and an optional retest to verify fixes

When do you need an ethical hacking service?

• When you want to know how far a real attacker could get in your environment
• As part of a pre-investment or M&A cybersecurity due diligence process
• To meet NIS2, DORA, PCI-DSS requirements or enterprise client demands
• Before an external security audit or certification process
• When you suspect a breach but don't have clear evidence of the entry vector

Pentesting, ethical hacking and Red Team: where each one fits

All three are offensive security and we run all three. What changes is what gets looked at, how much ground it covers and whether the defence knows.

Compare with

• Pentesting by asset
• Red Team: real, covert adversary
• Red Team vs pentesting, in detail

Common finding patterns from our assessments

From a public contact form to database access

In a combined assessment for a professional services company, the entry point wasn't a single critical vulnerability but a chain: an unsanitized contact form allowed a low-impact-looking SQL injection, which exposed the credentials of a service account with read access to the customer database. That same password was reused on the corporate VPN, giving access to the internal network in under a working day — a path no automated scanner would have connected on its own.

OSINT before touching a single system

Before any technical testing began, the OSINT phase identified several employees' credentials exposed in public breaches unrelated to the company. One was still valid on the corporate email account due to password reuse, which would have let a real attacker launch a targeted phishing campaign with legitimate access to internal conversation threads — without exploiting a single technical vulnerability.

Frequently asked questions about ethical hacking

What's the difference between ethical hacking and pentesting?

Ethical hacking is a comprehensive assessment that combines multiple vectors — OSINT, external perimeter, internal network, privilege escalation — to simulate a full attack campaign against your organization. Penetration testing is a technical test scoped to one specific system or surface: a web app, an API, a network. If you need to assess a specific system, choose penetration testing; if you want to know how far a real attacker would get across your whole organization, choose ethical hacking.

Can ethical hacking affect my production systems?

The scope is defined precisely before starting. By default we avoid actions that could disrupt service (DoS, data deletion). If any test carries a potential risk of impact, we agree on it with you and run it during a maintenance window.

Do I need to sign anything before you start?

Yes. Before any activity we sign a scope agreement and an NDA. This protects both your organization and the audit team and defines exactly what's authorized.

How much does an ethical hacking service cost?

It depends on the scope: type of assessment (external, internal, or both), number of assets and test depth. We offer a free initial call to properly size the project and give you an accurate quote.

Do you work with companies outside Valencia?

Yes. We have clients across Spain. External ethical hacking is carried out fully remotely. Internal assessments may require physical presence or VPN access to the environment depending on the agreed scope.

What happens if you find something critical mid-engagement?

It gets reported immediately, not held back for the report. If a finding allows data to be compromised or operations to be halted, we alert your technical contact through the agreed channel the same day, with the minimum needed for you to contain the risk. The rest of the exercise continues afterwards. Sitting on a critical vulnerability for two weeks so it looks better in the deliverable is not a defensible practice.

What is the difference between external and internal ethical hacking?

The external exercise starts from what an attacker sees from the internet, with no credentials: exposed surface, reachable services and entry points. The internal one starts from a position already inside the network — an employee, a compromised workstation or a supplier — and measures how far privileges can be escalated from there. Plenty of companies have a reasonably closed perimeter and a flat internal network, and only the second exercise reveals it.

Specialised services

• External ethical hacking: perimeter assessment from the internet
• Internal ethical hacking: assessment from inside the network

Related resources

• Pentesting by asset: web, API, network, cloud
• How much does a pentest cost: real prices
• What is ethical hacking?
• What is a penetration test?
• What OSINT is and which tools it uses

Sources

• MITRE ATT&CK — the knowledge base of real-world adversary tactics and techniques
• OWASP Web Security Testing Guide — the reference methodology for the application layer

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Request an ethical hacking assessment