Indexof Ethical Hacking <Firefox>

If an org tests 80% of external IPs, 50% of internal subnets, 100% of web apps, 0% APIs, 100% mobile, 0% OT → C = (24 + 12.5 + 25 + 0 + 5 + 0) = 66.5 2.2 Frequency (F) – Weight 20% How often each asset type is tested. Continuous testing earns highest scores.

| Criterion | Points | |-----------|--------| | Formal scope document signed before each test | 20 | | Rules of engagement (ROE) with emergency stop | 15 | | Testers hold industry certs (OSCP, GPEN, CREST) | 20 | | Report includes reproducible steps and risk ratings (CVSS) | 15 | | Post-test debrief with remediation roadmap | 15 | | Tests are independently audited (external QA) | 15 | indexof ethical hacking

Formula: F = (Sum over all assets of [multiplier × asset_criticality_weight]) / Total criticality weight If an org tests 80% of external IPs,

D = Average depth score across all tested asset categories A unique addition: ethical hacking is useless without fixing findings. | Level | Description | Score | Example

| Level | Description | Score | Example Techniques | |-------|-------------|-------|--------------------| | 1 | Automated scanner only | 20 | Nessus, OpenVAS | | 2 | Manual authenticated scanning | 40 | Burp Pro with manual verification | | 3 | Hybrid (automated + manual) with business logic | 60 | OWASP top 10 + custom exploits | | 4 | Adversary simulation (TTP-based) | 80 | MITRE ATT&CK mapping, C2 frameworks | | 5 | Full red team + purple team + zero-day research | 100 | Custom implants, physical, social engineering |

IoEH = (C × 0.25) + (F × 0.20) + (D × 0.25) + (R × 0.15) + (M × 0.15) Each sub-index is normalized to a 0–100 scale. Weights can be adjusted based on industry risk profile (e.g., finance may increase R’s weight). Measures what percentage of the attack surface is tested within a given period (e.g., 12 months).