Ethical Hacking and Penetration Testing

Ethical hacking is entirely legal when conducted with written authorisation from the system owner and within the formally agreed scope of the engagement. In the UK, the Computer Misuse Act 1990 makes unauthorised access to computer systems a criminal offence regardless of the actor's stated intent. This is precisely why the scoping and authorisation phase is the non-negotiable first step of every professional engagement. Pen testers obtain a signed authorisation letter before any active testing begins and operate strictly within the defined scope throughout the engagement. Stepping outside agreed scope, even inadvertently, can have serious legal consequences. The authorisation document is sometimes informally called a “get out of jail free letter” within the industry.

There is no single mandatory qualification for entering the pen testing profession. Most employers expect a combination of foundational security knowledge, offensive security-specific certifications, and demonstrated practical experience. Common entry-level expectations include CompTIA Security+ for foundational knowledge, CEH or CompTIA PenTest+ for offensive security coverage, and documented hands-on work from platforms such as TryHackMe or Hack The Box. At a more senior level, CREST certifications and OSCP carry the greatest market weight. A relevant degree or online degree pathway in computing or cyber security supports career entry, particularly into structured programmes and public-sector roles. Portfolio evidence such as CTF results and write-ups is increasingly influential.

Entry-level penetration testers typically earn £30,000–£40,000 per year. Mid-level practitioners with two to five years of experience and certifications such as CREST CRT or OSCP can expect £40,000–£60,000. Senior testers, team leads, and specialists in high-value areas such as mobile application security, OT/ICS security, or red team operations can earn £60,000–£80,000 or above. Freelance and consultancy day rates for experienced professionals reach up to £900 depending on specialism, seniority, and client sector. London and the South East attract a salary premium, though remote working is widespread in pen testing and consulting roles, broadening geographical opportunity significantly.

A vulnerability assessment identifies and catalogues potential weaknesses in a system or network, typically using automated tools such as Nessus or OpenVAS. It produces a list of discovered vulnerabilities with severity ratings but does not attempt to exploit them. A penetration test goes further: it actively attempts to exploit identified vulnerabilities to demonstrate real-world impact, then documents findings in a structured report with prioritised remediation guidance. Penetration tests are more expensive and time-intensive than vulnerability assessments but provide far greater assurance that defences are genuinely effective under attack conditions. Many organisations conduct regular automated vulnerability assessments supplemented by scheduled annual penetration tests or additional tests following significant infrastructure changes.

Programming skills are an advantage but not a strict requirement for entry-level pen testing. Most pen testing tools have established interfaces and many engagements can be conducted using existing tooling without writing custom code. However, the ability to read and understand code, particularly Python, Bash, PowerShell, and JavaScript, is highly valuable. Writing custom scripts to automate reconnaissance tasks, modify existing exploits, or create bespoke payloads is what distinguishes strong pen testers from exceptional ones. Python is the most practically useful language to develop for security work, given its widespread use across the security community for tooling, automation, and exploit development.

Penetration tests are classified by target and approach. Network pen testing assesses the security of internal and external network infrastructure. Web application testing focuses on websites and web APIs, typically following the OWASP WSTG methodology. Mobile application testing examines iOS and Android applications for security weaknesses. Social engineering tests evaluate human susceptibility to phishing and impersonation attacks. Red team exercises simulate a comprehensive adversary campaign against an organisation over an extended period, testing people, processes, and technology simultaneously. Physical penetration testing assesses whether an attacker can gain physical entry to a facility. Most pen testing firms specialise in one or two areas, and senior professionals often develop deep expertise in a specific niche.

CREST (the Council of Registered Ethical Security Testers) is a UK-based not-for-profit that provides accreditation for penetration testing organisations and professional certifications for individual practitioners. In the UK market, CREST company accreditation is required for suppliers tendering for government, financial services, and critical national infrastructure work. The NCSC specifically recommends CREST-accredited providers for CHECK assessments, the mandated testing standard for public-sector networks in the UK. For individual practitioners, CREST certifications, particularly the CRT and CCT qualifications, are significant career differentiators that open access to client engagements and sectors that require this level of verified professional competence.

The CEH and the Cyber Security Online Degree Pathway (ODP 7733) complement each other but serve distinct purposes. The CEH is an industry certification validating specific offensive security knowledge within EC-Council's framework. The degree pathway, a Qualifi Level 5 Extended Diploma, provides broader academic coverage of cyber security including risk management, cryptography, digital forensics, and network security, positioned for progression to a university top-up year and a full honours degree. Many learners pursue both: the degree pathway for academic credentials and further education access, and the CEH for professional credentialling in the job market. They are complementary rather than competing, and studying the degree pathway content strengthens CEH examination preparation in the overlapping subject areas.