Ethical hacking is the authorized practice of attacking a system the way an adversary would: finding vulnerabilities, exploiting them under controlled conditions, and proving what an attacker could actually reach. The owner approves the scope before any test starts and stays responsible for fixing what the test finds. Authorization is what separates ethical hacking from an attack.
In Fluid Attacks' benchmark of 36 third-party AppSec tools, run against a web application with 1,201 known vulnerabilities across 105 CWE categories, one pentester found 1,076 of them: 89.6% recall at 100% precision. The best third-party tool found 260 and reported 102 false positives. Weighted by severity, ethical hacking reached 98.9% of the risk exposure; the best tool reached 4.0%.
This page covers what ethical hacking is and is not, how it compares with a pentest and a red team exercise, the five phases of an assessment, the rules a real engagement runs under, what ethical hacking finds that a scanner cannot, and how findings get reported and disclosed.
What is ethical hacking?
Ethical hacking is a security testing methodology in which authorized specialists copy the tactics, techniques and procedures of real attackers against a defined target. The purpose is offensive, the intent is defensive. What separates it from a criminal intrusion is not the technique but consent, scope and accountability.
It rests on three conditions. The owner approves a target of evaluation, which may be part or all of the attack surface. Both parties agree on what the testers may and may not do. And every finding goes back to the owner with the evidence needed to fix it.
Malicious hackers and ethical hackers draw on the same aptitudes: curiosity, patience and the habit of asking what happens if. Fluid Attacks' writing on hacking ethics argues the difference shows up in the effects of each group's practice, not in their skill.
What ethical hacking is not
Running a scanner is not ethical hacking. Vulnerability scanning matches known patterns and reports candidates; an ethical hacker decides what to attack, attempts it, and shows the consequence.
Nor is it an open-ended attack. A test without a written target of evaluation, agreed rules and an escalation path is not ethical hacking with a wider scope. It is an incident waiting to be explained.
Why ethical hacking matters
Automated testing finds vulnerabilities that resemble something it has seen before. Ethical hacking finds the ones that depend on context: what the application is for, who may do what, and which two harmless-looking flaws become one serious problem when chained.
What automated scanning leaves on the table
Fluid Attacks' documentation puts a number on the ceiling. Vulnerability scanning alone "finds only 10% to 30% of the total risk exposure of a system," and only manual testing can confirm the rest, including "business flows that need an environment, authentication, or test data."
The benchmark agrees. 73.2% of the 1,201 vulnerabilities in the target application sat behind authentication, which is the territory a scanner reaches last and ethical hacking reaches first.
Severity, not volume
Volume is the wrong scoreboard for ethical hacking. In the State of Attacks 2026 report, covering 1,119,396 vulnerabilities reported between January 1 and December 31, 2025, automated tools identified 88.4% of all findings and manual work identified the remaining 11.6%.
But 87% of critical-severity vulnerabilities were identified through manual review. Findings from automated tools averaged 15.5 CVSSF units; findings from manual work averaged 93.2, six times as much. Those figures come from the Advanced plan only.
Ethical hacking, penetration testing and red teaming
Ethical hacking is the broad category; a pentest and a red team exercise are two ways of doing it. One asks what is broken in this target. The other asks whether the organization would notice an adversary at all.
Pentesting | Red teaming | |
|---|---|---|
Question it answers | What can be exploited in this target? | Would we detect and respond to a real adversary? |
Scope | A defined target of evaluation | A broader enterprise environment, usually in production |
Objective | Find, exploit and report everything the scope holds | Reach specific infiltration and impact objectives |
Who is tested | The system | The system and the people defending it |
Defenders' awareness | Usually informed | Usually not informed |
Main deliverable | Findings with evidence and remediation guidance | An account of the attack path and the response to it |
Both are ethical hacking, and both are executed by ethical hackers. The distinction worth keeping is the one above, not the one that sorts assessments by target type. Sorting by target — web apps, mobile apps, APIs, cloud infrastructure — describes types of pentesting, not types of ethical hacking.
Ethical hacking at Fluid Attacks
Fluid Attacks is an offensive security company whose ethical hacking runs continuously on client systems, under the Advanced plan, alongside proprietary scanners and AI. Here is how that work happens, including where it stops.
What we test, and under what rules
Every engagement starts from a target of evaluation the client approves, and runs under written controls for each risk that production testing carries. Fluid Attacks sets the intensity and pace of every test, uses no unauthorized brute-force techniques, and runs anything that could affect availability in a non-production environment first.
Two rules decide the rest. Fluid Attacks always tests from its own IP addresses, so a false alert on a WAF or SOC is resolved immediately. And, per the documentation, "if a pentester has any doubt during a test, the pentester stops the test." Endpoint and channel stay under total control, on a Zero Trust model.
How we decide where to attack next
Coverage is not the objective here. As the platform documentation puts it, "manual techniques and AI-SAST use statistical risk prioritization instead of file coverage as their operating objective." A method can test every file and still miss a critical vulnerability.
Statistical models pick which systems get attention, weighing how much and how recently a system changed, which files change most, how many authors touched them, and its vulnerability history against other systems.
Those models feed five independent attack teams — Systems, Criticals, Escapers, Deterministic and Reattack — and more than one can work the same system at once when the risk priority calls for it.
What one human found that 36 tools did not
Evaluator | True positives | False positives | Precision | Recall | Recall (CVSSF) |
|---|---|---|---|---|---|
Fluid Attacks pentester | 1,076 | 0 | 100% | 89.6% | 98.9% |
Fluid Attacks scanner | 273 | 3 | 99% | 22.7% | 8.8% |
Best third-party tool | 260 | 102 | 72% | 21.6% | 4.0% |
Other 34 third-party tools | — | — | — | 1.7% average | — |
Fluid Attacks' benchmark against a web application with 1,201 known vulnerabilities worth 461,500 CVSSF units.
The gap that matters is the last column. Ethical hacking found 743 vulnerabilities no tool found at all — 61.9% of the total, carrying 86.8% of the risk exposure. Manual penetration testing goes deeper into why.
Every finding is reviewed before a client sees it
A report does not go straight to the client. It enters as a draft and gets a peer review that can return it with any of nine observations: writing, evidence, scoring, consistency, omission, naming, false positive, duplicated, or other.
Three of those — naming, false positive and duplicated — end the cycle with a rejection; the rest go back for correction. Reviewers repeat the cycle "with as many review cycles as necessary," and only then does the client see it. This is the unglamorous half of ethical hacking, and what a 100% precision result is made of.
Nine observation types a reviewer can return before a finding reaches the client.
What we do not test
Four limits decide whether this kind of ethical hacking fits a system at all.
No source code, no test: an environment registered without its source code is out of scope.
No low-code platforms and no email servers: the methodology needs source code in a Git repository.
No version-by-version assessment: testing targets the latest version of each component, and each finding is tied to the commit, binary or environment where it appeared.
No formal SLA on detection time: there is a 90% accuracy SLA, measured with severity-weighted F-scores, but no promise about how fast something is found.
One more, about the benchmark above. The best automated performer in it was Fluid Attacks' own scanner, not a third-party product — and 22.7% recall still means missing three of every four vulnerabilities. The target was a controlled, vulnerable-by-default application, not a production system, so read those numbers as a comparison between methods, not a forecast.
The five phases of ethical hacking
Ethical hacking runs in five phases: reconnaissance, enumeration, analysis, exploitation and reporting. Before the first one, the owner defines and approves the scope and the target of evaluation, which can be web or mobile apps, APIs and microservices, thick clients, cloud infrastructure, networks and hosts, IoT devices or operational technology.
Phase | What the tester does | What it produces | Closest OWASP WSTG v4.2 category |
|---|---|---|---|
1. Reconnaissance | Collects open source intelligence without touching the target, then makes direct contact to map services, systems and people | An inventory of the surface and candidate attack vectors | 4.1 Information Gathering |
2. Enumeration | Sketches the target's security state and assembles tooling for its characteristics | A ranked list of weak points | 4.2 Configuration and Deployment Management Testing |
3. Analysis | Determines each vulnerability's impact on confidentiality, integrity and availability, and on neighboring systems | Attack scenarios ordered by impact and difficulty | 4.3–4.9 Identity, authentication, authorization, session, input and cryptography testing |
4. Exploitation | Exploits the vulnerabilities, chains them and pivots toward high-value objectives | Proof of what an attacker could actually reach | 4.10 Business Logic · 4.11 Client-side · 4.12 API Testing |
5. Reporting | Writes an executive summary for management and a technical summary for developers, scores severity and verifies fixes | Findings with evidence, severity and a remediation path | Reporting |
In ethical hacking, passive reconnaissance leaves almost no trace, while active reconnaissance raises the chance of detection considerably. The fourth phase is where, as Fluid Attacks' VP of Hacking Andres Roldan has put it, ethical hacking parts ways with an automated tool: the tool identifies, the human exploits.
These phases are not a private convention. Fluid Attacks maps its security requirements to recognized methodologies in its Database: 41 control definitions from PTES and 12 from NIST SP 800-115, mapped to 51 and 25 requirements.
Business logic: what ethical hacking reaches and scanners do not
Business logic vulnerabilities are flaws in what an application is allowed to do, not in how it is coded. The application works exactly as written; the rules it enforces are wrong. No pattern-matching tool recognizes them, because there is no pattern — only a process that ethical hacking shows should never have completed.
The OWASP Web Security Testing Guide v4.2 gives them a full category, section 4.10, whose nine tests read like things only a person can try: forging requests, breaking integrity checks, abusing process timing, and circumventing workflows altogether.
Fluid Attacks' catalog carries the concrete versions. Weakness 013, insecure object reference, describes an authorization mechanism that "does not prevent one user from accessing another users data by modifying the key value that identifies it," mapped to requirement 176. Weakness 005 covers privilege escalation and weakness 014 covers insecure functionality: a feature that is part of the system, which an attacker can use to harm it.
An authorization flaw in an application that otherwise works: weakness 013, requirement 176.
What turns these into findings is pivoting, which Fluid Attacks' comparison documentation defines as exploiting vulnerabilities "together or one after the other," to find attack paths with more severe impacts than exploiting each separately. In ethical hacking, a medium-severity flaw is often critical once it is shown to be the first step in a chain.
How ethical hacking reports and discloses vulnerabilities
Reporting closes the loop inside the client's organization; disclosure closes it with everyone else. Ethical hacking uses public frameworks for both: CVE identifiers to name a vulnerability unambiguously, and CVSS to communicate its severity.
Research into third-party software ends somewhere else. The CVE Program authorizes organizations it calls CNAs — "vendor, researcher, open source, CERT, hosted service, bug bounty provider, and consortium organizations" — to assign identifiers and publish records within their own scope. There are 564 CNAs from 43 countries today.
Fluid Attacks has been one of them since June 2, 2021, admitted by MITRE as a researcher CNA. As Andres Roldan, VP of Hacking, wrote when analyzing how researcher CNAs perform:
"Our scope is any software that is not within the scope of other CNAs."
In practice that is the public advisories listing, filterable by who found each vulnerability: the AI SAST scanner, Fluid Attacks' own pentesters, or external ones. Recent entries name the researcher — Andres Ramos on an OS command injection in PingTools Network Utilities 4.64, scored 8.6 High. That is what finding zero-day vulnerabilities and practicing responsible disclosure looks like when it is documented rather than claimed.
Each advisory names the researcher who found it and the CVE ID assigned to it.
The same discipline runs in reverse. Fluid Attacks tests its own technology with automated and manual techniques, runs pipelines that include exploits and strict linters, and operates a bug bounty program open to anyone, with awards based on impact. When an outside researcher reports something, the response team agrees a release date and asks whether they want credit.
Inside an engagement, ethical hacking ends with verification rather than a PDF: manual reattacks are unlimited, and a human re-tests each manual finding.
Ethical hacking tools, skills and certifications
Tools accelerate ethical hacking; they do not perform it. Fluid Attacks publishes the toolset its analysts use — 59 tools, last updated on November 3, 2026 — and describes their role precisely: "the security analysts of Fluid Attacks use the automation of these tools to make their security testing faster."
The toolset is published and dated: 59 tools, last updated November 3, 2026.
Purpose | Tools |
|---|---|
Attack surface discovery | Amass, DNSRecon, Nmap |
Web applications | Burp Suite Professional, ffuf, sqlmap, OWASP ZAP, Vega |
Mobile applications | Frida, MobSF, Objection, jadx, Apktool |
Networks and wireless | bettercap, Aircrack-ng, Wireshark, mitmproxy |
Active Directory | BloodHound, CrackMapExec, Rubeus, mimikatz |
Cloud environments | Pacu, enumerate-iam, AWS CLI |
Ghidra, Hopper, dnSpy, x64dbg, reFlutter | |
Credentials and secrets | hashcat, John the Ripper, Hydra, Gitleaks, TruffleHog |
Exploit development | Metasploit, BeEF, GDB-PEDA |
Skills decide more than any of them. Fluid Attacks' pentesters hold 202 certifications across 59 different types, and its accreditations include penetration testing by CREST alongside CNA status. They are employees, not contributors paid per finding.
Go deeper: how to become an ethical hacker covers the technical and non-technical ground behind ethical hacking as a career.
Who needs ethical hacking, and how to choose a provider
Where a standard or a regulator asks for a penetration test, ethical hacking stops being optional: Fluid Attacks' service validates requirements from 67 standards. The case is broader than compliance — any organization that develops its own software or exposes products on the internet is a target, and cyberattacks such as ransomware and phishing do not check company size first.
Choosing an ethical hacking provider is easier with concrete questions than with brochures:
Who does the testing? Employees under contract, or a rotating pool of independent researchers.
How many certifications, and of what types? Ask for the count, not adjectives.
Does the service exploit, or only report? Exploiting and pivoting are capabilities separate from detection.
Is there original research? Published advisories show whether a provider finds zero-day vulnerabilities or only reads about them.
How are fixes verified? Ask how many manual reattacks are included, and who performs them.
How is accuracy measured? Reporting your own false negatives against an SLA is a harder promise than reporting findings.
Conclusions
Ethical hacking earns its place in a security program for one reason: it produces evidence of exploitability that no other method produces. A scanner tells you a door has no lock. Ethical hacking walks through it and tells you what is in the room.
That evidence costs time, and pretending otherwise helps nobody. People do not work at machine pace, which is why ethical hacking belongs beside automated testing rather than instead of it: automation for breadth and known patterns, people for business logic and anything behind authentication.
The providers worth hiring will show you their methodology, their accreditations and their published research before you sign anything.
Frequently asked questions
What can an ethical hacker find that a scanner cannot?
Business logic vulnerabilities, chained attack paths and almost everything behind authentication. In Fluid Attacks' benchmark against a web application with 1,201 known vulnerabilities, one pentester found 743 that no automated tool found at all — 61.9% of the total, carrying 86.8% of the risk exposure. Scanning alone covers 10% to 30% of a system's risk exposure.
Is ethical hacking the same as penetration testing?
No. A pentest is a form of ethical hacking, and so is a red team exercise; ethical hacking is the broader category covering both. A pentest asks what can be exploited in a defined target. A red team exercise asks whether the organization would detect and respond to a real adversary.
What are business logic vulnerabilities?
Flaws in what an application permits, rather than in how it is written. The code runs correctly and the rules it enforces are wrong: a user approving their own transaction, a workflow completed out of order, a function used more times than allowed. OWASP's Web Security Testing Guide v4.2 dedicates section 4.10 and nine distinct tests to them.
How does responsible disclosure work?
A researcher reports the flaw privately to whoever owns the software and agrees a publication date so a fix ships first. They gather evidence before reporting it. A CVE Numbering Authority assigns an identifier, and the advisory is published afterward. The program lists 564 CNAs from 43 countries.
Does Fluid Attacks do ethical hacking, and how is it verified?
Yes, continuously, on client systems under the Advanced plan, which includes Pentesting as a Service (PTaaS), secure code review and reverse engineering. Every finding passes a nine-point peer review before a client sees it, manual reattacks are unlimited, and the service carries a 90% accuracy SLA measured with severity-weighted F-scores.
Put a hacker on it before someone else does
Our PTaaS brings ethical hacking to your applications continuously, under rules you approve, and proves what a vulnerability is worth before it costs you anything. Start free trial · Contact us.
Get started with Fluid Attacks' PTaaS right now
