White Hat Hacker.

A security professional who uses offensive skills only with explicit authorization, to find and report vulnerabilities so defenders can fix them. It belongs to the Defense & Operations category of cybersecurity.

A security professional who uses offensive skills only with explicit authorization, to find and report vulnerabilities so defenders can fix them.

A white hat hacker is an ethical security practitioner who operates strictly within the law and with permission from the owner of the system being tested. White hats work as penetration testers, application security engineers, red teamers, vulnerability researchers, and bug bounty hunters. They follow rules of engagement, coordinated disclosure timelines, and standards from organizations like OWASP, NIST, and CREST. Their goal is to improve security posture rather than cause harm, monetary loss, or unauthorized data access. Many also hold formal certifications such as OSCP, CRTO, CISSP, or CEH and operate under written contracts that scope targets and prohibit actions that would damage availability or violate privacy.

Defences for White Hat Hacker typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Ethical hacker, White-hat.