'We're protecting UK from paralysing attack - and our salaries can be limitless'

Each week, we talk to idiosyncratic from a antithetic assemblage to observe what it's truly like. This week we chat to ethical hacker and main merchandise serviceman astatine The Hacking Games, John Madelin.

A emblematic wage for a starter is... £35k to £55k. You're learning however systems break, and however to hole them. It rises rapidly erstwhile you tin constitute reports humans tin read, oregon if you bring demonstrable aptitudes into the job. For mid-level roles it's £65k to £100k+. With real-world scars from red-team ops (test scenarios) oregon unrecorded incidents, you're trusted to support things that matter. Add beardown connection and radical skills, and you're valuable. If you're advanced, you tin gain £125k+. These are heavy method and strategical thinkers - the ones who recognize however attackers truly run tin marque leadership-level money; and astatine this level determination are usually bonuses and incentives connected top. You get paid mostly wage positive bonus oregon day-rates (£600 - £2,500). The champion spell connected to physique businesses oregon counsel governments; that's wherever "sky's the limit" stops being a fig of speech.

Hackers ne'er sleep... and companies thin to inquire for assistance checking systems erstwhile they've been tickled from the acheronian side. Traditional reddish teaming tends to beryllium successful accepted enactment hours, but firefighting worldly means the hours tin plaything with the menace landscape: quiescent weeks erstwhile systems behave, past 2am firefights erstwhile they don't. Formally, it's astir 37-40 hours a week connected paper, with 20-25 days' holiday, positive slope holidays. In practice, you'll sometimes beryllium tempted to swap downtime for adrenaline, but astute teams marque definite it evens out.

Head to the Money blog for latest user concern tips

Many of america travel from profoundly method backgrounds, truthful translating analyzable risks into PowerPoint-friendly soundbites tin consciousness painful... You walk days unpicking a subtle concatenation of vulnerabilities, lone to beryllium asked "but are we harmless now?", arsenic if that's ever a yes/no question. If I could swap 1 gathering for a fewer quiescent hours with a packet sniffer (a bundle that analyses information successful a machine network) and coffee, I astir apt would.

The stereotype of a hacker being nerdy, socially awkward and operating unsocial utilized to beryllium reasonably true... Many of america preferred machines to meetings. But the satellite caught up. The alleged "geeks" erstwhile seen arsenic second-class citizens present locomotion the corridors with heads held high. We've learnt that creativity, absorption and curiosity substance much than tiny talk. Most ethical hackers I cognize are inactive introverted, but they're collaborative, inventive and driven by purpose. The modern hacker is portion engineer, portion detective, portion artist. The stereotype hasn't vanished, it's conscionable been upgraded.

Hackers are not portrayed precise accurately successful films... Hollywood loves the representation of a lone genius hammering a keyboard and shouting "I'm in!", but existent hacking is acold much nuanced and human. An ethical hacker's toolkit isn't conscionable code, it's psychology, persuasion, signifier recognition. You mightiness walk much clip analysing behaviour, crafting believable disinformation oregon charming entree done societal engineering than really typing exploits.

Businesses wage ransoms to atrocious hackers excessively often... When lives, proviso chains oregon nationalist information are astatine risk, the motivation reply becomes world successful the look of contiguous harm. Hospitals, manufacturers with cascading dependencies oregon operations holding defence-sensitive information look agonising choices. Law enforcement and insurers tin help, but the systems and capableness to resoluteness this cleanly aren't ever there. The existent measurement of occurrence isn't whether you'd garbage to pay, it's whether you ne'er person to marque that call.

The menace of cyber attacks are tremendous and increasing fast... The UK's ain cyber bureau reports a 50% emergence successful superior incidents this year, with 4 nationally important attacks each week. That's not hype; it's the caller normal. For businesses, cyber hazard present sits alongside ostentation and geopolitics arsenic a apical committee concern. Attacks are much automated, data-driven and commercially motivated, and galore exploit quality science arsenic overmuch arsenic code. For individuals, it's changeless low-level warfare: phishing, deepfake scams, individuality theft and information leaks. We unrecorded wrong integer systems that are nether continuous stress. The atrocious quality is the menace is systemic. The bully news? So is the defence, we're yet learning to detect, incorporate and retrieve arsenic portion of regular concern resilience, not afterthought.

Read much from Sky News:
What it's truly similar being a bodyguard
The backstage researcher - 'here's however overmuch we cost'
£200k salaries - secrets of a pilot

Here are my 3 apical tips to support your information safe...

1. Strong authentication.

Yes, passwords inactive matter, but brace them with multi-factor authentication and bully privilege management. Most breaches commencement with idiosyncratic logging successful who shouldn't. Devil successful the item suggests ethical hackers person a beardown investigating and checking relation here.

2. Hygiene, not heroics.

Keep bundle patched, conception networks and show for unusual behaviour. It's dull, repetitive and perfectly vital. Security is 90% housekeeping, 10% brilliance. Another large country for ethical hackers to continuously cheque and test!

3. Backup… Offline. Offline. Offline.

Back up your captious data, and past disconnect that backup from the network. Ransomware can't encrypt what it can't reach. It's astonishing however galore companies hide this until it's excessively late. In short: authenticate hard, support hygiene and ever person an air-gapped information net.

The astir communal mistake is... carelessness. Most breaches hint backmost to unpatched systems, anemic oregon reused passwords oregon entree that should've been revoked but wasn't. People unbend their subject due to the fact that "it worked yesterday". Security fails successful the details: an unfastened larboard near from testing, a missed patch, a idiosyncratic who disables MFA "just for now". Attackers unrecorded for those cracks. Another unsighted spot is proviso concatenation trust, organisations presume partners and bundle vendors are secure, erstwhile often they're not.

Usually, determination isn't a motion that you've been hacked... not astatine first. Attackers contiguous don't smash in; they settee in. They mightiness beryllium utilizing your systems to excavation crypto, to pivot toward a bigger people oregon simply watching and waiting. Early clues are subtle: unexplained outbound traffic, sluggish servers, caller admin accounts, unusual scheduled tasks oregon webshells, bits of hidden codification dropped into a web app truthful they tin gaffe backmost successful later. By the clip you spot bluish screens, Bitcoin demands oregon a flurry of unusual emails, you're already astatine the endgame. The instrumentality is catching the whispers, not the explosions, that's what bully detection and disciplined monitoring are for.

I've not been tempted to spell to the acheronian side... There's a wide motivation divide. You're either a transgression oregon you're not. Most radical are wired, neurologically and socially, to cognize the difference. But the scenery is shifting. The emergence of gaming cheats, exploit marketplaces and online rewards has blurred the lines for a caller generation. Many young, technically talented players descent into grey areas, penning oregon selling cheats, investigating exploits, without realising however adjacent they've drifted to criminality. That's precisely what The Hacking Games was created to address. The prime isn't astir temptation; it's astir direction.

Ethical hackers are truly the ones protecting the UK's nationalist security... though the existent dense hitters beryllium wrong elite agencies similar the National Cyber Force (UK), the US Cyber Command and NSA. Ethical hackers successful the wider assemblage play a captious supporting role, uncovering vulnerabilities earlier criminals do, hardening captious infrastructure and sharing intelligence. Together they signifier the ecosystem that keeps nationalist systems upright. The menace is wholly real. A well-timed onslaught connected powerfulness grids, transport oregon concern could paralyse regular beingness and ripple done the system successful hours. The quiescent world is that each day, hundreds of skilled defenders, galore from our ain ethical-hacker community, halt those scenarios earlier the nationalist ever hears astir them.

The strangest jobs are usually the ones you don't take... I've been asked much than erstwhile to usage my skills offensively, to excavation up accusation oregon interruption into a competitor's systems "just to spot what's possible". That's wherever the ethical enactment matters most, and I've ever refused.

On the lighter side... I erstwhile helped a large retailer way down a mysterious Wi-Fi awesome that was disrupting their tills, it turned retired to beryllium a astute fridge successful the unit room endlessly trying to update itself. So, yes, the weird jobs scope from the morally ambiguous to the mildly ridiculous.

I didn't spot the hacker wiring successful my encephalon until my aboriginal 20s... That's erstwhile a proper, palmy hack clicked for me. The feeling is addictive: a premix of intelligence travel and the quiescent restitution of having out-thought a system. We privation young gamer-hackers to get that buzz sooner, but safely.

Three speedy tips for anyone who's conscionable recovered the bug... larn the rules first, find bully mentors and vie successful harmless CTFs oregon bug-bounty programmes - signifier hard, but wrong the lines.

The aboriginal of hacking volition alteration dramatically but... it's not inevitable doom. The existent displacement isn't lone AIs moving riot; it's co-intelligence, humans moving with almighty AI assistants. That concern amplifies scope and speed. But there's a reflector side: defenders get the aforesaid amplification. AI volition massively amended detection, triage and automated containment, if organisations put successful data, playbooks and radical who tin usage these tools.

What to interest astir most...

• Rapid, automated adaption of attacks (polymorphic campaigns).
• Scale: cheap, effectual attacks disposable to much actors.
• Supply-chain and ML-poisoning risks.

What needs to beryllium done...

• Train humans successful co-intelligence usage (not conscionable tools).
• Automate detection + containment (playbooked SOAR).
• Invest successful resilient design: segment, air-gap backups, presume breach.
• Align argumentation and morals for accelerated liable disclosure, red-teaming and situation law.

So it is astir continuous vigilance, with pragmatism. The aboriginal is hard, accelerated and interesting. We request smarter radical moving with smarter tools. This is precisely the occupation The Hacking Games is built to solve.