A certified ethical hacker (CEH) completed a penetration test of the main headquarters of a company almost two months ago, but has yet to get paid. The customer is suffering from financial problems, a

Threatening to publish penetration test results is extortion and a direct violation of the non-disclosure agreement, constituting both a criminal act and a serious ethical breach.

A CEH who has completed contracted work is entitled to payment and has legitimate legal remedies available, such as filing a civil claim or engaging a collections attorney. Using legal procedures respects the law, maintains professional integrity, and does not expose the CEH to criminal liability. All other options involve actions that are illegal, unethical, or violations of the non-disclosure agreement signed at the start of the engagement.

Disclosing confidential client financial information to third parties violates the NDA and professional confidentiality obligations regardless of the payment dispute.

Exploiting vulnerabilities discovered during an authorized test for unauthorized purposes such as defacement is a criminal act under computer fraud laws, even if the hacker originally had legitimate access.