EC-Council is a cybersecurity certification, education, training, and services company based in Albuquerque, New Mexico.

Jay Bavisi is the Founder of EC-Council Holding Pte Ltd,^[1][2] the parent company of all of EC-Council Group of Companies. The first organization of the group, International Council of Electronic Commerce Consultants (EC-Council) was founded in 2001 in response to the September 11 attacks to certify professionals who could protect against attacks on electronic commerce.

EQT Private Equity invested in EC-Council in September 2021^[3] EC-Council is the creator of popular certification programs such as CEH,^[4][5] CHFI, ECSA/LPT and the Certified Ethical Hacker (CEH) program for white hat hackers in 2003. EC-Council became a certifier of training courses and exams instead of founding entirely new schools, mobilizing entrepreneurs in the information security training business. CEH courses were offered in more than 60 countries by 2007, and the program expanded rapidly.^[6]

As of 2023, the CEH certification is part of the possible certifications to some cyber-security functions within the United States Department of Defense, as part of its Directive 8140.^[7][8]

In 2010, the EC-Council part of the organisations selected by the Pentagon to oversee training of Department of Defense employees who work in computer security-related jobs.^[9]

In May 2006, the website of the EC-Council was defaced,^[10] and again in 2014, restored, then defaced, again, due to password reuse.^[11] The attacker managed to exfiltrate sensitive data like passport pictures from the applicants, including notably Edward Snowden's.^[12]

On at least two instances, the EC-Council's website has also been prone to Cross-site scripting vulnerabilities. In June of 2011, two vulnerabilities where discovered on, both on the "portal" subdomain.^[13][14] An additional vulnerability was found in May 2013.^[15]

During 2011, an EC-Council employee has been using comments spam to advertise the Certified Ethical Hacker certification. This was called a "fictional theory" by Jay Bavisi, President of EC-Council, despite evidences proving otherwise.^[16]

The EC-Council has also been holding sexist discourse on several occasions:

• In 2015, writing that "women should wear pants suit with heels" to be credible when doing pentesting.^[17]
• In 2021, publishing a survey about the challenges faced by women in cybersecurity, with "Only men can do this job" and "Women can't handle this job" and "women aren't encouraged enough" as sole possible answers, and explaining that "the post cannot be sexist coming from all women teams".^[17]

In March 2016, the website of the EC-Council was serving the Angler exploit kit. It took several days for the issue to be resolved.^[18][19]

In 2021, the EC-Council took its entire blog down due to apparent systematic copyright violations and plagiarism conducted by its marketing team.^{[20][21][16][22]}

EC-Council offers professional certifications for the IT security field, such as Certified Network Defender (CND), Certified Chief Information Security Officer (CCISO), and Computer Hacking Forensics Investigator (CHFI).^[23] It also offers certifications in fields related to IT security, including disaster recovery, software security, digital forensics, and general IT security knowledge.