A white hat hacker (ethical hacker) is an IT security specialist who attacks a system with the written authorization of its owner, to find vulnerabilities before the real attackers do. They use the same tools and techniques as a pirate. The difference lies in one word: consent.
The term comes from American Westerns, where the hero wore a white hat and the villain a black hat. It gave rise to three categories: the white hat who protects, the black hat who attacks, and the grey hat who operates in between.
In this guide: the definition of a white hat hacker, what they concretely do during a mission, what separates them from black hats and grey hats, the legal framework in France, and when it's beneficial for a company to hire one.
Definition: What is a White Hat Hacker?
A white hat hacker has the skills of an attacker and the ethics of a defender. They break to fix, never to harm.
A white hat hacker is an expert who performs authorized penetration tests (pentests) and security audits. They search for vulnerabilities in a website, application, network, or organization, prove they are exploitable, and then explain how to fix them.
The Five Rules of a White Hat
- Authorization: Nothing begins without a signed contract and a defined scope (addresses, applications, dates, permitted techniques).
- Proportion: They prove the vulnerability without disrupting production or copying more data than necessary.
- Confidentiality: What they discover remains between them and their client.
- Traceability: Every action is logged and included in the final report.
- Utility: The deliverable is not just a list of vulnerabilities, but a prioritized plan for correction.
What a White Hat Hacker Does During a Mission
- Reconnaissance: Mapping what is exposed on the internet (subdomains, services, public leaks).
- Vulnerability Research: Injections, broken access control, weak passwords, forgotten configurations.
- Controlled Exploitation: Demonstrating the real impact, for example, gaining access to an administrator account or a customer database.
- Reporting: Each vulnerability with its proof, severity level, and recommended fix.
- Re-testing: Verifying after correction that the door is securely closed.
To see what this work looks like, we publish our own offensive challenge write-ups on the Writeups page: 8 at the time of writing, on HackTheBox and Root-Me, including Atlas and Store. The format is the same as the report delivered to a client.
White Hat, Black Hat, Grey Hat: What Are the Differences?
The three types of hats often have the same technical skill level. What separates them is authorization and intent.
White Hat Hacker: The Defender
- Scope: Mandated by the company, with a written contract and defined scope.
- Missions: Penetration testing, code audit, configuration audit, phishing simulation, red teaming.
- Legal Status: Legal, because authorized.
- Goal: For the company to fix vulnerabilities before being attacked.
Black Hat Hacker: The Attacker
- Scope: None, they act without authorization.
- Actions: Intrusion, data theft, ransomware, access resale, denial of service.
- Legal Status: Illegal. In France, fraudulent access to a system is punishable by articles 323-1 and following of the Penal Code.
- Goal: Money, sabotage, or espionage.
Grey Hat Hacker: In Between
- Scope: They search for vulnerabilities without being invited, then notify the target, sometimes requesting a reward.
- Legal Status: Ambiguous intent, but unauthorized access remains an offense, even with good intentions.
- Example: Someone accesses the customer portal of an e-commerce site and then writes to the site to report the vulnerability. The site can press charges.
There is a legal path for independent researchers: bug bounty programs, where companies publish their rules and scope. Hackers who comply with them are considered white hats.
Why Hire a White Hat Hacker for Your Company?
An attacker only needs one vulnerability. A white hat hacker searches for them on your behalf, at a chosen time, and provides a report at the end.
What You Gain
- Vulnerabilities found before attackers, with proof of their impact.
- A prioritized correction plan, understandable by your technical teams.
- Proof of audit for your clients, insurers, and compliance requirements (GDPR, NIS2, ISO 27001).
- Re-testing to confirm that the fixes are effective.
When to Bring in an Ethical Hacker?
- Before launch: new website, new application, new API.
- After an incident: to understand how the attacker gained entry. During an emergency: cyberattack or hacked website.
- Regularly: Once a year, or after any significant change.
- For compliance: For companies subject to NIS2, or large clients requiring an audit.
White Hat Services at White-Hat
- Penetration testing for websites, applications, or networks.
- Source code audits.
- Phishing simulations to measure your teams' response.
- Red teaming: a comprehensive attack simulation, from external access to sensitive data.
- NIS2 compliance audits.
Prefer to compare multiple independent ethical hackers? The marketplace Hackersdate allows you to post a need and receive proposals from verified experts.
Frequently Asked Questions About White Hat Hackers
Is a White Hat Hacker Legal?
Yes, under one condition: written authorization from the system owner, with a defined scope. Without it, the same action becomes fraudulent access, regardless of intent.
What's the Difference Between an Ethical Hacker and a Pentester?
A pentester is the most common role of a white hat hacker: they perform penetration tests. "Ethical hacker" is a broader term that also covers vulnerability research, bug bounty hunting, and red teaming.
What Certifications Does a White Hat Hacker Need?
The most recognized are OSCP (Offensive Security), CEH (EC-Council), and more advanced ones like OSEP, CRTO, or OSWE. Training platforms like HackTheBox and Root-Me serve as practice grounds, and published write-ups demonstrate real-world skill levels.
How Does the Initial Contact Work?
Through a 30-minute, no-obligation call to define the scope and budget. You can contact us here.
Request an Audit
Read more