Why do companies pay people to break into them?

Companies pay people to break into them because it is a direct way to find out where they are weak before a real criminal does. The arrangement is called a penetration test, or pentest: an authorized, simulated cyberattack on a computer system, run live to evaluate how secure it really is. The testers try to get in using the same tools and techniques an adversary would use, and then they hand over a report listing what they found and how to fix it.

The key word is authorized. A white-hat hacker uses attacker-like techniques, but with permission, a defined scope and professional rules. That, rather than any special trick, is the difference between a security tester and a burglar. The company agrees in advance what may be tried.

The idea is old. In June 1965 a conference on computer security heard that one employee of a defense contractor had easily undermined the safeguards on the company's own time-sharing computer. By the 1970s, governments and companies were running tiger teams, groups of crackers whose job was to attack computer systems in order to uncover and eventually patch security holes.

Today the practice is routine. Some industries even require it: the standard for payment cards demands penetration testing on a regular schedule and after system changes. Testers might be told everything about the target, called white box, or only the company's name, called black box. Some firms go further and give outsiders permission to report holes in return for recognition or money, which can be seen as crowdsourced penetration testing. All of it rests on the same logic: you will learn about your weak points either from a friendly tester or from an enemy.