Inside the mind of an ethical hacker

First, let’s define ethical hacking as authorised testing within an agreed scope, designed to identify weaknesses and help an organisation address them.

In my experience, one of the biggest misconceptions about ethical hacking is that it starts with breaking into a system. The reality is that in many assessments, the first step is understanding the environment, analysing what's in front of you, and identifying where a realistic attack path might exist.

That's why I believe the one of the most underrated skills in cyber security isn't exploitation, but enumeration: systematically identifying services, accounts, permissions, and relationships within the agreed testing scope. This is usually where the attack path begins.

However, enumeration is not just a preliminary step. Each new finding can change what I investigate next, and each apparent weakness needs validation before it becomes a meaningful finding.

The most important part happens before the attack

Popular culture has convinced us that hacking is fast.

Someone sits in front of a screen, types a few commands, and suddenly they're inside a system. The reality is much less dramatic.

Much of penetration testing (authorised attack simulation) is patient, methodical investigation. You can spend hours analysing information before you attempt a single attack.

But before I'm even thinking about exploitation, I'm gathering information. I'm trying to understand the environment, identify the technologies in use, analyse services, map relationships between systems, and determine where a vulnerability might exist. 

A network can contain hundreds of devices. A major challenge is deciding which findings lead to further investigation. Understanding the environment improves decisions but doesn’t necessarily make exploitation easy. The challenge is identifying which of those devices, services, or configurations could potentially give you a foothold.

AI accelerates analysis but findings still need validation

One of the most interesting developments I've seen recently is the impact AI is having on ethical hacking. 
As part of my ongoing professional development, I’m currently studying for OffSec’s AI-300 Advanced Red Teaming for AI Environments certification, and there's no question that AI can dramatically accelerate certain tasks.

AI can help summarise unfamiliar code, suggest potential weaknesses, and connect findings more quickly. It can also provisionally prioritise those weaknesses. But those suggestions are starting points: I still need to check the evidence, establish whether a weakness is exploitable in the actual environment, and assess its impact.

One of the exercises used in offensive-security training involves what are effectively rabbit holes: things that look vulnerable but ultimately lead nowhere. An inexperienced tester can waste hours pursuing them. AI can do exactly the same thing.

That's why I don't subscribe to the idea that AI replaces expertise. It can make a skilled person much faster, but you still need the knowledge to recognise when something is wrong.

As an illustrative example, imagine an AI tool flags a function as potentially vulnerable because it handles user input. Further review shows that validation elsewhere prevents that input from reaching the sensitive operation in the way the tool assumed. The suggestion was worth investigating, but it was not a confirmed vulnerability. The value of the tester’s judgement is knowing what evidence is still needed.

Why overlooked systems matter

One thing ethical hacking teaches you is that attackers don't always think the way defenders expect them to.

Organisations may give their most visible or business-critical systems the greatest attention, but it’s important for them to examine the routes to important assets as well as the assets themselves. 
Attackers are often more interested in the systems that are easiest to exploit. That might be a forgotten service, a poorly maintained device, or a connected system that nobody considers part of their cyber security strategy.

As more organisations adopt connected devices, the attack surface continues to grow. Smart TVs, connected lighting, operational technology, industrial sensors, and medical devices all create new opportunities for attackers. And while a connected device does not automatically provide access to the wider network, its exposure, permissions, segmentation, and connections determine what an attacker could reach. Importantly, I would distinguish office devices from operational technology and medical systems, for which testing may affect availability or safety and which need an appropriate agreed approach.

The challenge is both securing the systems you care about most and understanding how other connected systems could provide a route to them.

For example, a forgotten management service on a low-profile device may matter if it is reachable and has access to a more sensitive system. If it’s properly isolated, the consequences may be much more limited. Enumeration helps establish which relationships actually exist, rather than assuming every connected device presents the same risk. The practical action here is to maintain an accurate asset inventory, review access relationships, and validate network segmentation.

Human judgement still matters

The more I work with AI, the more convinced I become that human judgement is becoming more important.

AI can speed up research, accelerate analysis, and automate repetitive tasks that once consumed hours of a tester's time. It can also miss organisational context, make incorrect assumptions, and produce plausible suggestions that are not supported by the evidence. Accountability for testing decisions remains with the people conducting and overseeing the assessment.

The future of ethical hacking will undoubtedly involve more AI. The same is true of cyber security.
AI will continue to change how ethical hackers work. The value of an assessment will still depend on whether its findings are validated, its risks are understood, and its recommendations help the organisation improve. For organisations, that means investing in skilled people alongside reliable processes and technical controls.

Get in touch with our experts to prepare your organisation against AI cyber security threats