Get to know the life of an ethical hacker at IBM

As an ethical hacker for IBM, Charles Henderson gets paid to think like a bad guy. His job is to break into networks, applications, or physical locations to find out how a real attacker would carry out their work, uncovering errors and the effect those errors might have on an organization’s security.

IBM says that there has been a continuous change in corporations appointing their own hackers to “pen-test” (penetration test) online systems, networks, and physical locations, considering the increase in cyber-attacks and the need to strengthen cybersecurity.


In a candid conversation with Business Insider, Henderson, 40, described what is like to be a hacker for IBM.

He said he has always been curious as a kid. He grew up in Austin, Texas where he still resides has now become a haven for young technologists with its lively computer security scene. Henderson attended the University of Texas and studied Computer Science.



By the age of 12, Henderson started taking interest in networks, which at that saw the emergence of phone system. After legally getting a phone booth in his room, he took it apart. Today, we have websites and videos that tell us how things work and how to take them apart and put them back together. However, while Henderson was growing up, none of it existed, which is what thrilled him. With inquisitiveness triggered by the unknown, he decided to take things apart so that he could learn how they operated. He says that he would have probably never done it, had there been a book on how these things worked.

“I’ve always been bound by ethics,” he says. “That is not to say that kids don’t do stupid things.”


Henderson says that his curiosity led him into security research and penetration testing over the last 20 years, which has helped him make his career.

About seven months ago, when he was looking to switch jobs, IBM offered him a very interesting and challenging position that he couldn’t resist. He was fascinated to the wealth of information and resources available here.

For him, it has been really exciting working for IBM from the time he joined the company in October of 2015, as he gets to work with some of the largest brands in the world.





While Henderson does a lot of research himself, he does like to look at consumer electronic devices that range from planes to trains to automobiles to mobile devices. He always find methods to break into or break apart these devices, to find new errors and susceptibilities. Also, he is always interested in knowing how devices connect to one another and what vulnerabilities might surface as a result. Thanks, to the growth of the Internet of Things (IoT).

Henderson travels the world to meet with clients when not in Texas, in order to help him better understand their security issues and the security landscape. During these meetings, he gets to work with some of the world’s biggest and most exciting companies that help him find out how their company handles security concerns. While the companies share their needs, requirements, and the trials they face, they work together to come up with solutions to fix them.

Sharing some examples of what Henderson and his team does, he says:





Henderson says that the best part of his job is to find and fix key security susceptibility before attackers get a chance to abuse it.

Explaining the excitement of the chase, it is one less possibility for a criminal to abuse every time they help a client fix major security vulnerability, which also extends to the customers’ customers, the people they do business with.

He says, “Every day I’m faced with a new brain teaser, a new challenge, and that’s really exciting. The worst part about my job is telling a client they have a major vulnerability.


Whenever Henderson tells people what he does for a living, he is often faced with one question which is “Can you hack into my bank account?”

To which his reply to the question would be, “It depends on what bank you use.”

He is also asked by people if he has ever done any ‘spy stuff”.

Henderson says that the biggest misconception that people have about hackers is that they are all criminals. Ironically, the word ‘hacker’ has been regarded as malicious computer hacking, which is why it very necessary to understand that the word is not a synonym for criminal.



Explaining the difference between good hackers and bad hackers, he says that a criminal hacker is someone who abuses susceptibility for monetary gain or hidden motives, and is not interested in helping to fix the flaw they used to gain access. Criminals take the path of least resistance, while non-criminal hackers choose their targets based on a challenge or the learning process.





Giving his piece of advice for aspiring hackers, Henderson says that the one thing they should always do is to question everything, be curious and never take anything at face value.

He further adds on to say that you should always keep sight of your ethical compass and practice responsible disclosure. It is easy to upset a promising career by doing something stupid. Ensure that you are guided by your values while you research vulnerabilities. Always keep in mind that a company cannot protect their users from a flaw found by a hacker unless they responsibly reveal it to the company, as a flaw cannot be fixed if the affected company has no knowledge about it.