Security breaches can lead to damage to a business’s finances, operations and reputation. What many companies might fear most is the latter: damage to their reputation. This may explain why 65% of organizations want to be seen as infallible, as per a recent HackerOne survey. Meanwhile, 64% maintain a culture of security through obscurity, and 38% aren’t open about their cybersecurity practices at all.

The continued practice of security through obscurity is harmful. When a group denies vulnerability and does not seek help, it leaves the door open for damaging attacks. Still, it’s not easy to open up about your weaknesses. So, where does this leave the ethical hacker? They may become the target of a criminal investigation.

Psychology versus reality

The truth is that attackers could breach any company on earth. Still, business leaders are like any other human being. It’s hard for us to admit our weaknesses. In the corporate world, this refusal to admit vulnerability may be pathologic. Only 12% of those surveyed have departments (outside of security and IT) that make cyber awareness and training a core focus, according to the survey. And only 29% of boards get “deeply involved” in cybersecurity strategy.

None of this helps fix the problem of weak security. It’s key that business leaders know the risks. Also, teamwork through vulnerability reporting helps others to improve their security posture as well. But none of this happens if you don’t look under the hood.

Are ethical hackers the cure?

Ethical hacking involves an authorized attempt to gain unauthorized access to a computer system, app or data. This can mean copying the strategies and actions of malicious attackers. Ethical hacking helps find security vulnerabilities, which the team can then fix before a threat actor has the chance to exploit them.

On the surface, this sounds like a good thing. But many companies are reluctant to work with ethical hackers. Even if these hackers are part of an internal team, management might force them to work in obscurity. A full 67% of those surveyed said they prefer to accept software vulnerabilities rather than work with hackers.

Where resistance comes from

Why do companies resist this type of scrutiny? On one hand, many believe fixing security flaws hampers innovation or hurts operations. In fact, due to pressure to deliver products faster, 81% of developers at large organizations admit to knowingly releasing vulnerable applications.

So, are bug bounty programs worth it? It depends on the details. If the bounty hunters discover and remedy a major vulnerability, that’s a good thing. Still, a company should seek advice from legal when crafting a program. The last thing anyone wants is a weak set of terms and conditions through which a hired offensive security tester could stray (by mistake or on purpose) and target out-of-bounds systems.

Don’t do me any favors

Consider the case of the St. Louis Post-Dispatch exposing a problem at the Missouri Department of Elementary and Secondary Education. It turns out the agency’s website had displayed over 100,000 Social Security numbers for school teachers, administrators and counselors in its HTML source code. The reporters informed the agency of the blunder before releasing the story, which gave the school plenty of time to take the pages down.

The result? Missouri Governor Mike Parson launched a criminal investigation of the reporter behind the story. Was it ethical hacking to protect personal information? Or did the reporter launch a political hit job? As we said earlier, nobody likes to have their weakness exposed.

Remove security obscurity

Each organization must accept the level of risk involved on both ends: that is, the risk of security breach versus the risk of ethical hacking assistance. HackerOne believes the risk of undiscovered vulnerability is much higher.

Some of their suggestions include:

• Encourage regulators to provide liability protections that promote incident disclosure
• Provide third-party security researchers with clear guidelines for reporting weaknesses
• Reward / incentivize developers for fixing issues and involve them in security processes
• Require robust security checks on suppliers.

The worst thing a company can do is ignore the problem. Plus, it all starts at the top. The organizations that develop a comprehensive security strategy with executive buy-in have the best chance to come out with their reputations intact.