Hands connecting a laptop to a network switch with a blue cable inside an open server cabinet
AI-generated image, not a photograph of a real person or place.
doodlehacks

WHAT UK GUIDANCE SAYS

Good hacks
need permission.

ASK FIRST then test

  • Permission before testing
  • Report, don't exploit
  • Thank the finder
  • Security, done in the open

Not every hacker is up to no good.

Organisations hire testers to try to break in, and people report flaws they come across. What separates help from harm is permission, and UK guidance sets out how both sides should behave.

Updated

Check a situation

THE SHORT ANSWER

Permission is
the whole difference.

The same skills can test a system or attack it.
Guidance and the law turn on who agreed to it.

PENETRATION TESTING

Breaking in, on request

The NCSC describes a penetration test as trying to breach a system’s security using the same tools and techniques as an adversary might, to check that the owner’s own processes work.

Check a situation

DISCLOSURE

Tell the owner

People find flaws all the time. The NCSC asks organisations to make reporting easy, with a clear contact, a policy and a security.txt file on their website.

Set it up

THE LAW

Unauthorised access is a crime

Under the Computer Misuse Act 1990, it is an offence to make a computer give you access to programs or data when you know that access is unauthorised.

See the numbers

A QUICK SITUATION CHECK

Who should do
what, and when?

Pick a situation to see what UK guidance or law says about it. The bar shows how much care the situation calls for.

Situation check

Choose a situation
A company hires a penetration testerAgreed scope

Targets, techniques and how much the testers are told can vary from test to test. The NCSC says a well-scoped test gives confidence in the systems tested, at the time of the test.

You notice a flaw on a site you useUse their reporting route

Look for a security contact or a security.txt file. A disclosure policy should say how to get in touch, what to include and what is in or out of scope for finders.

Your organisation receives a reportReply and thank

The NCSC says you are not under attack. Respond promptly, thank the finder, pass the report to whoever owns the system and avoid asking them to sign a non-disclosure agreement.

A smart product you own has a flawCheck the maker’s info

Since 29 April 2024, makers of UK consumer smart products must say how to report security issues to them, and how soon you can expect an acknowledgement and updates.

Testing a system without permissionPossible offence

Securing access to programs or data that you know is unauthorised is an offence under section 1 of the Computer Misuse Act 1990, even if you mean no harm.

Sources: NCSC Vulnerability Disclosure Toolkit and penetration testing guidance; Computer Misuse Act 1990, section 1; GOV.UK guidance on the PSTI product security regime.

General information from UK guidance and legislation. It is not legal advice about any particular case.

TWO NUMBERS WORTH KNOWING

Attacks are common,
testing is not.

One figure on how many businesses are hit,
one on how many pay someone to test them.

43%

Businesses reporting a breach or attack

Just over four in ten UK businesses, and around three in ten charities, reported a cyber security breach or attack in the last 12 months, according to the Cyber Security Breaches Survey 2025/2026.

BREACHES · DSIT SURVEY

13%

Businesses that ran a penetration test

The same survey found 13% of businesses and 7% of charities had carried out penetration testing in the last 12 months, and 18% of businesses a cyber security vulnerability audit.

PEN TESTS · DSIT SURVEY

Phishing remained the most common type of breach or attack, experienced by 38% of businesses. Large businesses were far more likely than small ones to take steps to identify cyber risks.

FOUR STEPS FOR AN ORGANISATION

Make it easy
to tell you.

A long aisle of server racks in a data centre with small green and blue status lights glowing in cool light
AI-generated image, not a photograph of a real person or place.

The NCSC’s toolkit boils vulnerability disclosure down to a contact, a policy and a small text file. None of it needs special software.

  1. Publish a security.txt file

    Put it at /.well-known/security.txt on every domain, with Contact, Policy and Expires fields. Keep the expiry less than a year ahead.

  2. Write a short disclosure policy

    Say how to contact you, secure ways to send details, what to include, what happens next and what finders may and may not do.

  3. Reply, thank and update

    Respond promptly, ask politely for anything missing, send updates while you fix it, and tell the finder when it is fixed.

  4. Use pen tests as a check

    The NCSC says a penetration test should confirm your own vulnerability management works, not be your main way of finding flaws.

SMART PRODUCTS

Makers must say
how to report.

A laptop with its screen turned away on a desk beside an open notebook, a pen and a mug, in soft daylight
AI-generated image, not a photograph of a real person or place.

The UK’s product security regime came into effect on 29 April 2024. Manufacturers of consumer smart products must tell people how to report security issues, and the timescales for acknowledging a report and giving status updates until it is resolved.

The same rules require passwords that are unique per product or set by the user, and require makers to publish a minimum period for security updates, with an end date. The Office for Product Safety and Standards enforces them.

Questions

Questions people ask

Is ethical hacking legal in the UK?

The Computer Misuse Act 1990 makes it an offence to secure access to programs or data when you know the access is unauthorised. Penetration testers work with the owner’s agreement and an agreed scope. For a specific case, take legal advice.

What is a security.txt file?

A small text file, described in RFC 9116, kept at /.well-known/security.txt on a website. It tells finders who to contact and links to the disclosure policy, with an Expires date so stale details are not used.

I found a security flaw. What should I do?

Use the organisation’s reporting route, such as its security contact or security.txt file, and follow its disclosure policy, which should say what to include and what is in or out of scope.

Is a vulnerability report a cyber attack?

No. The NCSC says an unsolicited report may sound scary but you are not under attack and it is not a cyber incident. It still advises following its phishing guidance with any unexpected message.

What is the penalty under the Computer Misuse Act?

For unauthorised access under section 1, conviction on indictment can bring up to two years in prison, a fine or both. Lower limits apply on summary conviction.

Sources

Where the facts come from

  1. NCSC: Vulnerability Disclosure Toolkit
  2. NCSC: Penetration testing guidance
  3. legislation.gov.uk: Computer Misuse Act 1990, section 1
  4. GOV.UK: The UK Product Security and Telecommunications Infrastructure (Product Security) regime
  5. GOV.UK: Cyber security breaches survey 2025/2026
  6. RFC 9116: A File Format to Aid in Security Vulnerability Disclosure

ABOUT THIS NAME

Interested in leasing doodlehacks.com?

doodlehacks.com is part of the DoodleSale portfolio. It isn't in an auction right now, but you can ask about leasing it.

Ask about this name