What is the difference between a penetration tester and an ethical hacker?
Key takeaways
- A penetration tester works to a signed scope, a report and a retest; the title ethical hacker carries no such guarantee.
- A penetration test is scoped and bounded, an ethical hacker label is unbounded and can cover intrusive work that no authorisation would permit, so hire against deliverables, not titles.
- Titles in this field are not regulated in India, so ask for 3 things instead: deliverables, methodology and named tester experience.
- Scanner-first work is an automated vulnerability assessment, not a penetration test, and it typically costs a fraction of the Rs 45,000 to Rs 1,20,000 a real web application test costs.
- Under sections 43 and 66 of the IT Act, 2000, the legal footing for both is the same thing: the owner's written consent.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Where does the difference actually sit?
Four places, and only one of them is the job title. Scope: a penetration test is bounded by a written scope, a fixed window, and a list of prohibited techniques. An ethical hacker label carries no boundary at all, and it can describe work that ranges from a fully authorised enterprise assessment to intrusive activity no client would ever sanction. Method: a tester works to a published methodology such as PTES or OWASP ASVS, with a defined tester-day count. Output: a test ends in a prioritised report with reproduction steps and a retest; a self-described ethical hacker may produce nothing you can hand to a developer. Legal footing: identical for both, because sections 43 and 66 of the IT Act, 2000 make unauthorised access an offence and the owner's written consent is the only thing that removes it.
Is a vulnerability assessment the same thing as a penetration test?
No, and the difference is what you are buying. A vulnerability assessment is largely automated: it identifies and ranks weaknesses across a defined estate, and it is good at breadth and bad at depth. A penetration test proves exploitability with human judgement, and it reports a working attack path rather than a list. Scanners find broken access control between roles, business-logic abuse and chains of small weaknesses poorly, and those are the findings that matter most in an Indian SME breach. If a quote is suspiciously low, ask how many tester-days are hands-on. A test performed almost entirely by a scanner is a vulnerability assessment, and it should be priced and labelled as one.
Why is the title not worth anything on its own?
Because there is no register of ethical hackers in India, no regulator, and no licence. Anyone can print the phrase on a card, and a certificate in the field is a screening signal rather than a capability. A vendor's real credentials are visible in things you can check: a redacted sample report, a named methodology, the tester-day allocation, the retest policy, and whether the tester has broken something real in an environment like yours. Verify any CERT-In empanelment claim on CERT-In's own published list, because the organisation is what is empanelled, not the individual. Ask which named person will be on your engagement, not just what the company calls itself.
Which one should an Indian business actually hire?
A penetration tester, every time, because a business needs a report, a remediation plan, a retest and an audit trail. The deliverables are what let you fix the problem and show a customer, an insurer or a regulator that you did something about it. The people who advertise as ethical hackers often deliver the same underlying work, and sometimes do it well, but they arrive with a brand instead of a scope document, and the missing artefact is usually the rules of engagement. A framed engagement for a web application or a mobile application, priced in the Rs 45,000 to Rs 1,20,000 band, gives you everything the label promises with none of the ambiguity.
| Dimension | Penetration tester | Self-described ethical hacker |
|---|---|---|
| Scope | Written, signed and bounded | Undefined, and sometimes intrusive |
| Method | Published methodology, allocated tester-days | Varies, often unreported |
| Output | Prioritised report, remediation plan, retest | Often nothing deliverable |
| Legal footing | Owner consent under the IT Act, 2000 | Same requirement, usually not documented |
| Cost band | Rs 45,000 - Rs 1,20,000 per web application | Unpredictable, and cheaper is rarely safer |
What are the frequently asked questions?
Get a straight answer on this
Send us your application and the roles you need tested, and we will return the scope, the tester-day count, the report format and a fixed price.
Send us the details See pricing