What is ethical hacking and what is it for in your company?

By the QuantumSec team

Ethical hacking —also called pentesting or penetration testing— is the process of attacking an organization's systems in a controlled and authorized way to identify their vulnerabilities before a real attacker does. It's not a theoretical exercise: it's a real attack, performed by certified professionals, with clear rules and the goal of protecting, not harming.

Ethical hacking vs malicious hacking: what's the difference?

Technically, the tools and techniques are the same. The difference lies in three elements:

1. Authorization: the ethical hacker has explicit, written permission from the system owner. Without that permission, any unauthorized access is a crime under article 197 bis of the Spanish Criminal Code.

2. Scope: the work is done within a perimeter defined in the contract. The ethical hacker can't go beyond that scope or attack systems not agreed upon.

3. Purpose: the goal is to document the vulnerabilities, explain their impact and provide the necessary fixes. The result is a report, not a data theft.

These differences make ethical hacking a fully legal professional service and a recommended —in some sectors, mandatory— risk management practice.

How ethical hacking works: the phases

A standard ethical hacking project follows these phases:

1. Reconnaissance: the team gathers public information about the target —domains, subdomains, technologies, employees, emails— to understand the attack surface before starting.

2. Analysis and scanning: identification of open ports, exposed services, software versions and potentially problematic configurations.

3. Exploitation: the pentester tries to leverage the vulnerabilities found to access systems, escalate privileges or extract information. It's the most technical phase and the one that sets a real pentest apart from a simple scan.

4. Post-exploitation: analysis of the real impact the obtained access would have (can you reach customer data? can you compromise other internal systems?).

5. Report: documentation of all findings with evidence, risk classification, reproduction steps and remediation recommendations.

Types of ethical hacking by prior knowledge

Depending on the information the pentester has at the start of the project, there are three modes:

• Black Box: the pentester starts with no prior knowledge of the system —like a real external attacker. It's the most realistic approach to simulate an attack from the internet.

• Grey Box: the pentester has partial information —normal user credentials, API documentation or access to the application as a registered client. It's the most common approach because it simulates the risk of an insider or an attacker who has gained basic access.

• White Box: the pentester has full access —source code, architecture documentation, admin credentials— and can review the system from the inside. It's the most exhaustive approach and the one with the best findings-per-hour ratio.

What is ethical hacking for in your company?

The benefits of a professional penetration test are concrete:

✓ Identify real vulnerabilities before an attacker does: not the theoretical ones a scanner reports, but the ones a professional can exploit in your specific environment.

✓ Understand the real impact of a breach: what information would be accessible? how long undetected? how far can an attacker get from the first vulnerability?

✓ Demonstrate your security level to clients, partners and investors: an independent pentest report is the strongest evidence that you take security seriously.

✓ Meet regulatory requirements: NIS2, DORA, PCI DSS, ISO 27001 and the ENS explicitly require or recommend periodic security assessments.

✓ Prioritize security investment: the report tells you what to fix first because the risk is highest, not because it worries the IT team most.

When do you need ethical hacking?

There's no wrong time for a penetration test, but there are times when it's especially critical:

→ Before launching a new application or digital product.
→ After a major change to your infrastructure or application.
→ When you must demonstrate regulatory compliance (NIS2, DORA, ISO 27001, PCI DSS).
→ When an enterprise client requires it as a condition to sign.
→ If you've had a security incident and want to assess the damage and close gaps.
→ At least once a year, as preventive maintenance of your security level.

FAQ

Is ethical hacking legal in Spain?

Yes, as long as there's written authorization from the system owner. The Spanish Criminal Code (article 197 bis) criminalizes unauthorized access to computer systems, but ethical hacking is done with explicit permission and a signed contract. Any serious ethical hacking firm works with service agreements and NDAs that define the scope and protect both client and provider.

Can ethical hacking take down my systems?

The risk exists but is very low in well-planned projects. An experienced pentester knows how to test without causing service interruptions. Before starting, the window for the most intrusive tests is defined (usually outside peak hours) and actions that could cause denial of service are explicitly excluded.

How long does ethical hacking take?

It depends on the scope. A web pentest of a standard application usually runs in 5-10 business days. A full Red Team can extend over several weeks. The report is normally delivered 3-5 days after the technical phase ends.

How does ethical hacking differ from a vulnerability assessment?

A vulnerability assessment (VA) uses automated tools to detect known vulnerabilities —it's fast and good for a snapshot. Ethical hacking goes further: the pentester actively exploits the vulnerabilities, chains them to simulate a real attacker's path and documents the real, not just potential, impact. The VA says there's a hole; ethical hacking says I went in through that hole, got this far and this is what I could have stolen.