10 Questions to Ask Before Hiring a Hacker

Hiring a hacker is an exercise in trust. You are essentially handing someone the keys to your digital kingdom and asking them to find the weak locks. If you choose the right professional, you secure your business. If you choose wrong, you risk data theft, blackmail, or legal liability. Asking the right questions is the only way to hire a hacker safely.

In my 10 years in the cybersecurity industry, I've seen too many businesses get burned by "consultants" who were either incompetent or malicious. The difference between a successful engagement and a security disaster often comes down to the vetting process.

3. "Do You Perform Background Checks on Your Employees?"

You are giving these people access to your most sensitive data. You need to know they aren't criminals.

The Right Answer: "Yes, all our employees undergo rigorous criminal background checks and security clearance vetting."
The Red Flag: Hesitation or "We use freelancers from around the world."

4. "What Is Your Policy on Data Handling and Confidentiality?"

If they find a critical vulnerability (like a database of customer passwords), how do they handle that data?

The Right Answer: They should have a clear Data Handling Policy. They should use encrypted channels for communication (PGP, secure portals) and delete your data after the engagement.
The Red Flag: Sending sensitive reports via standard email or storing your data on public cloud drives.

5. "Do You Carry Professional Liability Insurance?"

Even with the best intentions, things can break during a penetration test. A server might crash; a database might get corrupted.

The Right Answer: "Yes, we carry Errors & Omissions (E&O) and Cyber Liability insurance."
The Red Flag: "We don't make mistakes." Everyone makes mistakes. Professionals are insured for them.

6. "Can You Provide References from Similar Industries?"

Testing a bank is different from testing a hospital. You want a partner who understands your specific compliance landscape (HIPAA, PCI-DSS, GDPR).

The Right Answer: They should be able to provide case studies or references (anonymized if necessary) from your sector.
The Red Flag: They claim to have hacked "NASA and the FBI" but can't provide a single verifiable business reference.

7. "What Does Your Final Report Look Like?"

The report is the product you are paying for. It needs to be actionable, not just a list of technical jargon.

The Right Answer: They should offer a sample report that includes an Executive Summary (for management) and a Technical Report (for developers) with clear remediation steps.
The Red Flag: A report that only lists "bugs" without explaining the business risk or how to fix them.

8. "Is Retesting Included in the Price?"

Once you fix the holes they found, you need them to verify the fix.

The Right Answer: Most reputable firms include one round of retesting for critical and high-severity findings within 30-60 days.
The Red Flag: Charging full price for a simple verification scan. (See our pricing guide for more on this).

9. "How Do You Handle 'Scope Creep' or Unexpected Findings?"

Sometimes a test reveals a rabbit hole that goes deeper than expected. How is that handled financially?

The Right Answer: "We will stop and notify you immediately if we find something critical that requires expanding the scope. We never exceed the budget without written approval."
The Red Flag: Surprise bills at the end of the engagement.

10. "Is This Legal?"

This is a trick question, but their reaction tells you everything.

The Right Answer: They should immediately discuss the Rules of Engagement (RoE) and the Letter of Authorization. They will refuse to touch any system you do not explicitly own or have written permission to test.
The Red Flag: "Don't worry about it," or willingness to hack a competitor, a spouse, or a generic Gmail account. If they say yes to this, you are hiring a criminal, not a professional. Read our legal guide to understand why this matters.

Red Flags: Signs You Are Talking to a Scam, Not a Professional

Rule out the worst operators before you compare quotes. Any single item below is a reason to end the conversation, not to start negotiating.

Guaranteed results. Real testing produces uncertainty. A claim that every vulnerability will be found is either dishonest or a promise to pad the findings.
"Recovery" offers for money already lost. Anyone who offers to claw back funds from a scammer for an upfront fee is usually running the second half of the same fraud.
Anonymous contact only. A named legal entity, a reachable business address and a phone number you can call are the minimum bar.
Crypto-only payment with no invoice. Untraceable payment plus no paperwork normally means no liability and no recourse for you.
Willingness to test assets you do not own. If they agree to "take a look at" a competitor's site or an account that is not yours, they have just told you they work outside authorisation.
Credentials demanded before scope is agreed. A legitimate tester asks for written authorisation and a scoping call first, never a password in a chat window.
Pressure and fake urgency. Countdown "discounts" and same-hour demands to pay are sales tactics, not security advice.

What a Legitimate Engagement Contract Must Contain

The signed contract, often paired with a Letter of Authorization, is what keeps the work lawful and gives you leverage if something goes wrong. At minimum it should define:

Parties and asset ownership. Full legal names of both organisations and a statement that you own or control every asset listed in scope.
Scope, in and out. Domains, IP ranges, applications and accounts that may be tested, plus an explicit out-of-scope list such as third-party cloud services or production databases.
Rules of engagement. Permitted techniques, testing windows, emergency contacts and a stop condition that ends the test at once if availability is at risk.
Data handling and retention. How evidence is encrypted, who may access it, and a deletion deadline after the final report is accepted.
Confidentiality and disclosure. How findings are disclosed, to whom, and what happens if the engagement uncovers an active breach.
Liability, insurance and payment. Liability caps, the insurance sitting behind them, fees, and a change-control clause so any extra work needs written approval.

If a vendor sends a one-page "agreement" with no ownership clause and no scope list, treat it as a proposal to do paid work with no legal cover.

How to Verify Credentials and Insurance Yourself

Claims on a website are not evidence. Verification takes roughly 30 to 45 minutes per candidate and is worth every one of them.

Certification IDs. Use the OffSec verification portal for OSCP and OSCE, EC-Council's lookup for CEH, and GIAC's badge search for GSEC or GCIH. Confirm the name on the credential matches the person signing your contract, because a firm can display a logo it cannot actually staff.
CVE and bug bounty history. Public CVE records and researcher profiles linked to HackerOne or Bugcrowd are checkable. Anonymous "we tested a Fortune 500" stories are not, so discount them entirely.
Insurance. Ask for a Certificate of Insurance showing professional indemnity (errors and omissions) and cyber liability, with limits that overlap your engagement dates. Mid-market firms commonly carry somewhere between $1M and $5M per claim. Request to be added as an additional insured, then phone the broker named on the certificate to confirm the policy is in force.
Company records. Match the legal entity name and registration number against a public business register before any funds move.

See our guide to verifying hacker credentials for the exact portals and badge links to use.

What a Defensible Deliverable Report Looks Like

The report is the only asset you keep after the engagement, and it is what your auditor, insurer or regulator will eventually read. A defensible report contains:

Executive summary. Business risk in plain language, ranked, with no unexplained jargon.
Scope and methodology. What was tested, when, by whom, and with which tools and techniques.
One entry per finding. A title, a severity rating with a CVSS base score and a one-line rationale, the affected asset, and numbered reproduction steps.
Raw evidence. Request and response pairs, command output and timestamped screenshots that a technical reader can replay later.
Remediation. A specific fix plus a reference such as the relevant CWE or OWASP category, rather than a vague instruction to "improve security."
Evidence integrity. Ask in advance whether logs are hashed and how large evidence files are transferred securely, so the chain of custody survives scrutiny.

If the deliverable is a raw scanner export with no reproduction steps and no severity reasoning, you have bought a vulnerability list, not an assessment.

A Simple Vetting Scorecard

Turn the questions above into a decision instead of an impression. Score each candidate out of 100:

Gates, where any failure is an automatic no. Written authorisation and ownership clause; valid insurance; willingness to refuse out-of-scope or unlawful work.
30 points - evidence quality. Certification IDs and references you verified yourself.
30 points - deliverable. A sample report with an executive summary, severity reasoning and reproducible steps.
25 points - process. Clear rules of engagement, data-retention terms and change control.
15 points - fit. Sector experience and a scope that matches your actual risk rather than a generic scanner run.

Use a 60-out-of-100 mark as your shortlist floor, and never let a discount override a failed gate. Once two providers clear it, a paid scoping call is cheaper than a re-test later, and a shortlist drawn from vetted places to hire ethical hackers is a sensible place to start comparing.

Conclusion: The Interview Is Your First Line of Defense

Hiring a hacker is a significant decision. By asking these 10 questions, you shift the power dynamic. You are no longer a confused client; you are an informed buyer.

Legitimate professionals love these questions because it allows them to demonstrate their expertise and value. Scammers hate them because they expose their lack of substance.

Don't skip the vetting process. Your security depends on it.

If you're ready to work with a team that has the right answers to all these questions, contact Cyberlord today. Let's discuss your security needs with transparency and expertise.

Frequently Asked Questions (FAQs)

1. How do I verify a hacker's certifications? Most certification bodies (like EC-Council for CEH or Offensive Security for OSCP) have online verification portals. Ask the potential hire for their certification ID or a digital badge link. Never accept a screenshot as proof, as these are easily forged.

2. Should I hire a freelancer or a company? For small, specific tasks, a vetted freelancer can be cost-effective. However, for comprehensive business security, a company offers more reliability, insurance, and a team of experts rather than a single point of failure. Companies also typically have better continuity and legal protections.

3. What if they refuse to sign a contract? Walk away immediately. A contract protects both parties. It defines the scope, confidentiality, payment terms, and legal authorization. Working without a contract in cybersecurity is legally dangerous and unprofessional.

questions to ask hiring hacker guide overview

Key decisions, risks, and implementation actions for questions to ask hiring hacker guide.