In this contribution, the Dutch government’s acceptance of ethical hacking, by implementing a policy of responsible disclosure, is considered to be a beneficent development. Ethical hacking contributes to cybersecurity and is intrinsically desirable. The term positive incitement is proposed to describe the relatively new phenomenon of encouraging ethical hacking. Positive incitement will be analysed by making a comparison to the Dutch toleration policy regarding soft drugs, and to incitement by law enforcement. Positive incitement should not change into negative incitement, which would result in a serious breach of the rights of ethical hackers. Furthermore, it is argued that the intrinsic value of ethical hacking can justify searching for vulnerabilities in systems of organisations who do not approve of this in advance.