Hire a hacker the legal way, on a fixed price
Apex Offensive runs authorised penetration tests and red team engagements. You hire a hacker under a signed scope, you agree the fee before we start, and testing begins within 48 hours of authorisation.
Fixed fee, never hourly. Minimum engagement $25,000. Boston and London.
How to hire a hacker without breaking the law
One thing separates a penetration test from a criminal offence, and that is written authorisation from the system owner. Therefore we build every engagement on three documents, and we will not start without them.
Scope of work
Exactly which systems are in and out of scope, in writing. Anything outside that list stays untouched, although it may look interesting.
Written authorisation
Signed by the person who owns the systems. Because cloud and hosting providers often need to approve as well, we confirm that before day one.
Rules of engagement
Permitted techniques, testing windows, escalation contacts, and evidence handling. In short, the boundaries everyone agrees to in advance.
What it costs to hire a hacker
Most firms hide this behind a contact form, so here it is. These are the three shapes an engagement usually takes, with the fee band each one lands in. Therefore we confirm one fixed number after the scoping call.
Focused test
One application or a small external estate. Roughly two weeks.
- Manual testing to OWASP depth
- Business logic and authentication
- Report, debrief, and one retest
Full assessment
Internal and external infrastructure, cloud, and applications. Three to five weeks.
- Everything in the focused test
- Network, cloud roles, and segmentation
- Chained findings with proven impact
Red team
Objective-driven simulation against a defended estate. Six weeks or more.
- Full-scope adversary simulation
- Detection and response measured
- Purple team replay with your defenders
These bands are honest ranges, not a menu. The final number is fixed after the scoping call, so it never moves during the project. However, if your budget sits below $15,000 we are the wrong firm, and we will say so on the call rather than waste your week.
What we will not do
Roughly half the people searching this phrase want something illegal. So we would rather be blunt now than waste your time and ours.
- Access any account, device or system without the owner's documented consent.
- Monitor, track or surveil a private individual, whatever the relationship.
- Recover access to an account that is not yours, including a partner's or an employee's.
- Alter records, grades, balances or logs held by somebody else.
- Trace, identify or retaliate against whoever attacked you. Report that to law enforcement.
- Anything that would breach the Computer Fraud and Abuse Act or the Computer Misuse Act.
Unauthorised access is a criminal offence in the United States and the United Kingdom, and in the UK it is an offence regardless of intent. If your request involves any item above, we are not the right firm, and your message will not receive a reply.
What you receive when you hire a hacker
A test is only worth the fee if your engineers can act on it. Consequently every deliverable below is written to be handed straight to the people who will fix the problem.
- 01Findings reportReproducible attack chains with evidence, not a scanner export. That is, each finding carries the steps, the impact, and the fix.
- 02Business risk summaryTwo pages your board can read, because a severity rating alone tells an executive nothing.
- 03Prioritised remediation planOrdered by real risk and effort, so your team knows what to do first on Monday morning.
- 04Live debriefThe tester who ran the engagement walks your team through it and answers questions directly.
- 05Free retestOnce you have applied the fixes we verify them, so closure is evidenced rather than assumed.
Credentials and standards behind the work
Proof from a real engagement
Client names stay confidential, so here is the shape of the work instead. This extract comes from an authorised assessment, redacted for publication.
t+06h exposed build runner token found
t+19h lateral move to service account
t+33h secrets read from vault path
t+41h domain administrator obtained
t+48h client notified, chain documented
day 10 three fixes shipped, retest clean
A retail group asked us to prove whether an attacker could reach their production identity systems. No scanner flagged that path, because every step looked harmless on its own. Our principal chained them and reached domain administrator in 41 hours.
In short, the fix was three configuration changes with zero downtime. Moreover, the retest confirmed all three, so the client closed the finding with evidence rather than a promise.
Questions before you hire a hacker
Is it legal to hire a hacker?
Yes, provided the testing is authorised. The law turns on permission rather than technique, so a signed scope from the system owner is what makes the work lawful. Without that document the same actions become a criminal offence, which is why we will not start until it exists.
How do I hire a hacker for my company?
Send the form with what needs testing and roughly how large it is. We run a 45 minute scoping call, then return one fixed fee for the agreed scope. Once the authorisation is signed, testing usually starts within 48 hours.
How soon can you start?
Testing begins within 48 hours of signed authorisation, assuming a window is free. Red team engagements need longer to prepare, because objectives and rules of engagement take more work to agree.
Can an individual hire a hacker, or only companies?
We accept a small number of private mandates each year, usually founders, executives, or families with a genuine threat model. The same rules apply, that is, you must own the systems or hold written permission to have them tested.
What if my budget is smaller than $25,000?
Then we are the wrong firm, and we will tell you on the call instead of stretching the scope to fit. Where we can, we point you toward a provider whose model suits a smaller engagement better.
Do you keep our data afterwards?
No. Evidence and findings are destroyed once the project closes, and we sign your non-disclosure agreement before any technical discussion. We also do not publish client names without written permission.