This Thesis explores the nature and practice of ‘Ethical Hacking’. Ethical Hackers are individuals who use hacking skills, knowledge and techniques within legitimate authorised practice; they are employed to Hack. A Critical Realist methodological approach is employed in order to gain a qualitative understanding of a real phenomenon through a range of key informants who provide personal narratives within semi-structured interviews, commenting upon their own realities, and their perceptions of the field in which they work. A Bounded Rational Model of decision making reveals that decisions relating to involvement in criminality and individual Hacking events are made through a process of reasoning, of approximating the net gains and losses of a particular course of action, and that these decisions are ‘bounded’ by social norms, ethical approaches and the personal motivations and social circumstances within which the decisions and behaviour are framed.