Indexof Ethical Hacking May 2026

| Component | Max Score | Calculation | |-----------|-----------|--------------| | External IPs | 30 | (tested IPs / total IPs) × 30 | | Internal IPs | 25 | (tested subnets / total subnets) × 25 | | Web apps | 25 | (tested apps / total critical apps) × 25 | | APIs | 10 | (tested endpoints / total documented endpoints) × 10 | | Mobile apps | 5 | (tested builds / total production builds) × 5 | | IoT/OT | 5 | (tested device types / total types) × 5 |

| Criterion | Points | |-----------|--------| | Formal scope document signed before each test | 20 | | Rules of engagement (ROE) with emergency stop | 15 | | Testers hold industry certs (OSCP, GPEN, CREST) | 20 | | Report includes reproducible steps and risk ratings (CVSS) | 15 | | Post-test debrief with remediation roadmap | 15 | | Tests are independently audited (external QA) | 15 | indexof ethical hacking

D = Average depth score across all tested asset categories A unique addition: ethical hacking is useless without fixing findings. | Component | Max Score | Calculation |