Ask ten people what "ethical hacking" means and you'll get ten different answers, and most of them talk about it like it's some separate, cooler cousin of cyber security. It's not. Cyber security covers the whole job of protecting systems and data, and it's made up of a handful of specialisations working alongside each other: network defence, incident response, digital forensics, governance and compliance, AI security, and ethical hacking. Ethical hacking is just the offensive one on that list. People who do it get paid to find and document real vulnerabilities, under conditions the organisation actually signed off on. Jr Penetration Tester is where that skillset gets built here, and it leads to PT1, a certification that actually tests whether you can do the work, not just recite it.
The confusion mostly comes from treating offence and defence like two unrelated jobs. They're not. A penetration tester finds a flaw and writes it up, and someone else has to actually do something with that. That's the SOC side, trained through SOC Level 1 and certified through SAL1, checking whether the flaw was ever exploited for real and getting it fixed. Neither side's work means much without the other picking it up. PT1 and SAL1 even sit on the same certification ladder, which tells you how TryHackMe itself thinks about the relationship.
AI security is probably the clearest example of how blurry this has gotten. Attacking an AI system, prompt injection, jailbreaking it, poisoning the data it learned from, and defending one against those same attacks are taught together, as one thing, in AI Security. There's one certification at the end of it, AI1, not a separate offensive and defensive one. Nobody working in that field spends time wondering if they count as an ethical hacker or a cyber security professional. Both, presumably, and they've got better things to think about.
None of this means you have to pick a lane and stay there forever. A fair number of people end up doing both, purple teaming is basically built for exactly that, blending offence and defence into one job. If you want to see what that actually looks like rather than just hearing the term thrown around, Atomic Bird Goes Purple #1 is a decent place to start. And if you're not sure which direction appeals to you yet, that's fine too, Pre Security and Cyber Security 101, with their certifications SEC0 and SEC1, cover ground you'll need whichever way you end up going.
So no, ethical hacking was never cyber security's flashier rival sitting off to the side. It's one part of the same job, and the line between that part and everything else keeps getting harder to draw, not easier. You don't need to sort yourself into a category before you start. Pick a direction and let the work show you where you actually fit.
Nick O'Grady
