EC-Council
Professional services
UnclaimedAmerican cybersecurity education, certification, training, and professional-services organization.
Last updated November 4, 2026
AI crawler reads
No AI crawler has read this profile yet.
Overview
EC-Council is a cybersecurity education, certification, training, and professional-services organization headquartered in Albuquerque, New Mexico. Its formal name, International Council of Electronic Commerce Consultants, reflects its early focus on the security of electronic commerce and online systems. The organization was established in 2001 in the aftermath of the September 11 attacks, when demand increased for professionals able to protect digital infrastructure and investigate computer-enabled crime. Jay Bavisi is identified as the founder of EC-Council Holding Pte Ltd, the group structure that contains EC-Council and related businesses. The organization became best known for professional certification rather than for operating a conventional network of schools. Its model combines standardized examinations, authorized training providers, instructor-led and online courses, practical laboratories, and continuing professional-development materials. The Certified Ethical Hacker (CEH) credential, introduced in 2003, became its signature program. CEH is designed around the techniques used by authorized security testers, including reconnaissance, vulnerability analysis, exploitation concepts, network defense, and reporting. By 2007, CEH training was available in more than 60 countries, helping establish EC-Council as an international provider in the information-security training market. EC-Council's certification portfolio expanded beyond ethical hacking. It includes the Certified Network Defender (CND), which focuses on defensive operations and network protection; the Computer Hacking Forensic Investigator (CHFI), which addresses digital forensics and incident investigation; the EC-Council Certified Security Analyst (ECSA) and Licensed Penetration Tester pathway; and the Certified Chief Information Security Officer (CCISO), aimed at leadership and governance responsibilities. The wider portfolio also covers software security, disaster recovery, general information security, and related technical disciplines. The former dossier incorrectly listed CISSP as an EC-Council flagship offering; CISSP is not an EC-Council certification and is therefore excluded here. The group also operates or has operated adjacent education and services businesses. EC-Council University was licensed in Wyoming in 2006 and offers cybersecurity degree programs and graduate certificates. EC-Council CodeRed, launched in 2019, provides online technical instruction and short-form learning pathways described as microdegrees. EC-Council Aware is a mobile cybersecurity-awareness training application, while EC-Council CyberQ is a cloud-based cyber-range platform intended to automate the deployment of practice environments and targets. EC-Council Global Services provides consulting activities including penetration testing, vulnerability assessment, and cyber-incident response; the division obtained CREST membership for relevant services in 2020. EC-Council also organizes or supports cybersecurity events, including Hacker Halted, Global CyberLympics, TakeDownCon, and the Global CISO Forum. Its credentials have been used in public-sector and defense-related training contexts. In 2010, an EC-Council entity was selected to oversee training for United States Department of Defense personnel working in computer-security roles. By 2023, CEH was among the certifications that could satisfy certain cybersecurity-function requirements under the Department of Defense's Directive 8140 framework, subject to the applicable role and qualification rules. The organization's history has included security incidents and reputational controversies. Its website was defaced in 2006 and again in 2014; reports associated with the latter incident described exposure of applicant information, including passport images. Security researchers also reported cross-site-scripting weaknesses in 2011 and 2013, and the website served the Angler exploit kit in 2016 before the issue was resolved. EC-Council faced criticism over promotional comment spam in 2011, gender-related messaging in 2015 and 2021, and the removal of its blog in 2021 amid allegations of systematic copyright infringement and plagiarism by its marketing operation. These matters are relevant to the organization's public record but do not by themselves establish that its certification products are inactive. In September 2021, EQT Private Equity invested in EC-Council. The organization remains active in cybersecurity certification, education, training platforms, events, and services.
History
EC-Council emerged in 2001 as the International Council of Electronic Commerce Consultants. Its creation followed a period of heightened concern about attacks on online commerce and critical digital systems. Founder Jay Bavisi established the organization within the broader EC-Council Holding Pte Ltd group to help create a professional workforce capable of protecting networks, testing systems with authorization, and investigating computer-related incidents. The organization's central strategic choice was to operate primarily as a certification and training authority. Rather than building a large chain of proprietary classrooms, EC-Council developed examinations, curricula, instructor materials, and authorized-provider arrangements that could be delivered by training businesses in multiple countries. This approach allowed the organization to scale its credentials internationally. Its Certified Ethical Hacker program, introduced in 2003, became the best-known expression of this model. The program framed offensive security knowledge as a controlled and authorized professional practice and helped popularize the term ethical hacker in commercial training. By 2007, CEH training was available in more than 60 countries. EC-Council subsequently broadened its portfolio to include defensive network security, digital forensics, penetration testing, software security, disaster recovery, and executive security leadership. CND addressed defensive architecture and operations; CHFI focused on evidence handling and forensic investigation; ECSA and the LPT pathway emphasized assessment and penetration-testing capabilities; and CCISO targeted senior management, governance, and security-program leadership. The organization also developed academic and digital-learning activities. EC-Council University received a Wyoming license in 2006 and later offered bachelor's, master's, and graduate-certificate programs in cybersecurity. CodeRed, launched in 2019, extended the group into online video learning and narrowly focused microdegree-style programs. The group expanded into practical learning technology and services in 2020. EC-Council Aware provided mobile security-awareness training for iOS and Android devices, while CyberQ supplied a cloud-based cyber-range environment for deploying practice targets. EC-Council Global Services became the consulting arm, offering penetration testing, vulnerability assessment, and incident-response work; it received CREST membership for relevant services in 2020. EC-Council's event portfolio has included Hacker Halted, Global CyberLympics, TakeDownCon, and the Global CISO Forum, giving the brand visibility beyond examinations and courses. Government and defense relationships became another important part of its development. In 2010, an EC-Council entity was selected to oversee training for United States Department of Defense personnel in computer-security roles. CEH was later included among credentials that could be relevant to certain cybersecurity functions under the Department of Defense's Directive 8140 framework as of 2023. Such recognition increased the credential's institutional relevance, although applicability depends on the specific government role and qualification requirements. EC-Council's public history also contains repeated criticism involving website security, marketing conduct, gender representation, and content practices. Its website was defaced in 2006 and 2014, with reports about the 2014 incident describing the exposure of applicant data such as passport images. Researchers reported cross-site-scripting weaknesses in 2011 and 2013, and the site served the Angler exploit kit in 2016. In 2011, an employee was accused of using comment spam to promote CEH. The organization later faced criticism for gender-related statements and for a 2021 survey about women in cybersecurity. In the same year, EC-Council removed its blog following allegations of plagiarism and copyright infringement by its marketing team. These episodes created an apparent tension between the organization's cybersecurity mission and criticism of its own security, communications, and content-governance practices. In September 2021, EQT Private Equity invested in EC-Council. The organization continues to present itself as a global cybersecurity certification, training, education, and services group, with CEH as its most recognizable credential and a broader portfolio spanning technical practice, academic programs, executive education, cyber ranges, awareness training, consulting, and industry events.
- 2023
CEH appears within the Department of Defense 8140 qualification context
[1]CEH is listed among certifications that may apply to certain United States Department of Defense cybersecurity functions under Directive 8140.
- 2021
EQT Private Equity invests in EC-Council
[1]EQT Private Equity invests in the cybersecurity training and certification group.
- 2020
EC-Council expands into awareness training, cyber ranges, and services
[1]EC-Council launches Aware and CyberQ and its Global Services division receives CREST membership for selected security consulting activities.
- 2019
CodeRed launches
[1]EC-Council launches CodeRed, an online cybersecurity learning platform with a large video-lesson library and microdegree-style technical pathways.
- 2010
EC-Council supports Department of Defense cybersecurity training
[1]An EC-Council entity is selected to oversee training for United States Department of Defense employees working in computer-security roles.
- 2007
CEH training reaches more than 60 countries
[1]The CEH program expands through international training providers and is reported as available in more than 60 countries.
- 2006
EC-Council University receives a Wyoming license
[1]EC-Council University is licensed by the Wyoming Board of Education amid concerns raised by the state education department about its academic activity.
- 2003
Certified Ethical Hacker is introduced
[1]EC-Council launches the Certified Ethical Hacker credential, which becomes its signature certification for authorized offensive-security skills.
- 2001
EC-Council is founded
[1]The International Council of Electronic Commerce Consultants, later known as EC-Council, is established to develop professionals able to protect electronic commerce and digital systems.
Products and positioning
Professional cybersecurity education, certification, practical skills assessment, and related security services.
Professional certification · 2003
Certified Ethical Hacker (CEH)
EC-Council's best-known credential, introduced in 2003, covers authorized offensive-security methods such as reconnaissance, vulnerability analysis, exploitation concepts, defensive implications, and reporting. It is aimed at professionals who need to understand how attackers operate in order to assess and protect systems. Training has been delivered internationally through EC-Council's education and partner network.
Professional certification
Certified Network Defender (CND)
CND is a defensive-security credential focused on network protection, security architecture, monitoring, incident handling, and operational controls. It complements EC-Council's more offensive and investigative certifications by emphasizing the design and operation of defenses against attacks.
Professional certification
Computer Hacking Forensic Investigator (CHFI)
CHFI addresses digital-forensics and computer-investigation practices. Its subject matter includes the identification, preservation, examination, and interpretation of digital evidence in the context of security incidents and computer-related investigations.
Professional certification
ECSA and Licensed Penetration Tester
The EC-Council Certified Security Analyst and Licensed Penetration Tester pathway is oriented toward structured security assessment and penetration testing. It extends beyond introductory ethical-hacking concepts into assessment methodology, technical findings, validation, and professional reporting.
Executive certification
Certified Chief Information Security Officer (CCISO)
CCISO is designed for senior information-security leaders. Its scope includes governance, risk, compliance, security-program management, strategic planning, and the organizational responsibilities associated with leading an enterprise security function.
Higher education · 2006
EC-Council University
EC-Council University is the group's academic institution. It was licensed in Wyoming in 2006 and offers cybersecurity-oriented bachelor's and master's degrees together with graduate certificate programs. The university extends the brand from professional credentials into formal academic education.
Online learning platform · 2019
EC-Council CodeRed
CodeRed is an online cybersecurity learning platform launched in 2019. It provides a large library of video lessons and short, specialized learning pathways described by the organization as microdegrees, allowing learners to focus on particular technical subjects.
Cyber range · 2020
EC-Council CyberQ
CyberQ is a cloud-based cyber-range platform launched in 2020. It is intended to automate the creation and deployment of cloud-hosted targets and practice environments so learners can develop hands-on cybersecurity skills in controlled settings.
Security awareness application · 2020
EC-Council Aware
EC-Council Aware is a cybersecurity-awareness training application launched for iOS and Android devices in 2020. It represents the group's expansion from specialist certification into mobile-delivered security education and awareness content.
Cybersecurity consulting
EC-Council Global Services
EC-Council Global Services is the consulting division of the group. Its described activities include cyber-incident response, penetration testing, and vulnerability assessment. The division received CREST membership for relevant services in 2020.
Controversies
2021
Criticism of women's cybersecurity survey
A 2021 EC-Council survey about women's experiences in cybersecurity was criticized because its answer choices were seen as relying on sexist assumptions. The organization defended the survey by pointing to the involvement of women in its teams.
2021
Blog removed amid plagiarism allegations
EC-Council removed its blog after allegations of systematic copyright violations and plagiarism involving its marketing operation.
2016
Website served the Angler exploit kit
The EC-Council website was reported to be serving the Angler exploit kit in March 2016. The issue reportedly took several days to resolve.
2015
Criticism over gender-related guidance
EC-Council faced criticism after publishing gender-related guidance suggesting that women should use traditionally formal professional clothing to be viewed as credible during penetration testing.
2011
Reported cross-site-scripting vulnerabilities and promotional comment spam
Researchers reported cross-site-scripting issues affecting an EC-Council portal, while an employee was accused of using comment spam to promote CEH. The organization disputed the characterization of the promotional activity.
2006
Website defacement and later applicant-data exposure
EC-Council's website was defaced in 2006 and again in 2014. Reporting about the later incident described the exfiltration of sensitive applicant information, including passport images.
Brand decisions
2021
EQT Private Equity investmentM&ABackground
EC-Council had developed a global certification, training, education, and services portfolio.
Action taken
EQT Private Equity invested in EC-Council.
Aftermath
The investment placed the organization within EQT's private-equity portfolio; the cited material does not disclose transaction value or detailed ownership terms.
2020
Expansion into cyber ranges and mobile awareness trainingProduct launchBackground
Practical exercises and user-facing security awareness became increasingly important components of cybersecurity education.
Action taken
EC-Council launched CyberQ and EC-Council Aware.
Aftermath
The group's offering expanded into cloud-hosted practice environments and mobile security-awareness delivery.
2019
Launch of CodeRedProduct launchBackground
Demand for flexible, online, skills-focused cybersecurity education created an opportunity beyond examination-based certification.
Action taken
EC-Council launched CodeRed as a video-based learning platform with specialized microdegree-style pathways.
Aftermath
The group broadened its digital-learning offering beyond its core certification courses.
2003
Launch of Certified Ethical HackerProduct launchBackground
The organization sought to formalize offensive-security knowledge as a professional skill used with authorization.
Action taken
EC-Council introduced the CEH certification and associated training program.
Aftermath
CEH became the organization's most recognizable credential and expanded through international training providers.
Recent events
- Unconfirmed
Reported
EC-Council acquires Cyber Insurance Academy[3]
EC-Council acquired Cyber Insurance Academy (CIA), which will continue operating under its own brand and leadership as an EC-Council company.
Reported
Simplilearn named EC-Council’s South Asia Training Center of the Year[4]
EC-Council honored Simplilearn as its Accredited Training Center of the Year for the South Asia region for the third consecutive year.
Sources4 sources
Cite this profile: Cite the canonical profile. /brand-wiki/ec-council · Editorial policy · How profiles are compiled