If anything should be regulated it's ethical hacking and security research. Having a bug bounty program that is accountable to some government agency should be mandatory for every single enterprise that does some form of development and the prizes/awards should be some function of the revenue and the severity of the vulnerability.