Hackers: classifications, myths, and realities

Hackers, ethical hacking, security research and cybersecurity.

The word hacker has carried several meanings for decades. To some people it describes someone with deep technical curiosity who enjoys understanding systems and pushing them beyond their intended use. To others it has become almost synonymous with cybercriminal. Between those two extremes are security researchers, penetration testers, red-team professionals, bug-bounty participants, and of course people who break into systems without authorization.

Much of the confusion comes from mixing together three different things: technical skill, authorization, and intent. The ability to discover a vulnerability does not by itself tell us whether someone is acting professionally, irresponsibly, unlawfully, or in good faith.

This article separates those ideas, explains the familiar white-hat, gray-hat, and black-hat labels, looks at several common myths, and describes at a high level how an authorized penetration test is actually conducted.

What does “hacker” actually mean?

There is no single definition used consistently in every technical, legal, or cultural context. The IETF’s Internet Security Glossary preserves the older meaning of hacker: someone with a strong interest in computers who enjoys learning about, programming, and experimenting with them. The same glossary distinguishes that meaning from cracker, a term historically used for someone who attempts to break security and gain unauthorized access to another person’s system.

Language changed over time. In news reporting, institutional documentation, and ordinary conversation, hacker is also widely used for unauthorized intruders. NIST, for example, includes a definition centered on an unauthorized user and, in educational material, also distinguishes white-hat and black-hat hackers.

For that reason, context matters more than arguing that only one definition is valid. On Universo Digital, we use hacker broadly for people who explore computer systems deeply, and then specify whether we mean authorized security work, independent research, unauthorized activity, or cybercrime.

Ethical hacking is not simply “doing what an attacker does, but with good intentions”

The key distinction in ethical hacking and professional penetration testing is authorization. A penetration tester does not choose a company at random and begin probing its systems because they believe they can help. Professional testing takes place under an agreed scope, with defined targets, exclusions, schedules, points of contact, and rules of engagement.

The same principle applies to bug-bounty programs and vulnerability disclosure policies. Researchers need to understand which assets are in scope, which testing methods are allowed, which activities are prohibited, and how findings should be reported.

CISA encourages organizations to publish vulnerability disclosure policies so that good-faith researchers have clear rules for reporting security flaws. In the United States, Department of Justice policy also distinguishes good-faith security research from malicious intrusion. Laws vary by jurisdiction, however, and good intentions do not replace authorization or automatically make an activity lawful.

White hat, gray hat, and black hat: useful shorthand, not a formal taxonomy

The “hat” terminology is widely recognized and can be useful as an introduction, but it should not be mistaken for an official cybersecurity classification system. It is mainly a shorthand for discussing intent and authorization.

White hat

A white-hat hacker works to improve security within an authorized framework. That person may be a penetration tester, security researcher, consultant, red-team member, or participant in a bug-bounty program. NIST also uses the term for cybersecurity specialists who break into systems with the goal of evaluating and improving security.

What makes that work legitimate is not a hoodie, Linux, or any particular tool. It is the combination of technical competence, authorization, rules of engagement, and professional responsibility.

Black hat

The label black hat is commonly used for someone who compromises systems without authorization and with malicious intent or for illicit gain, including data theft, fraud, extortion, malware distribution, espionage, sabotage, or other forms of cybercrime.

In technical or legal writing, terms such as attacker, intruder, threat actor, or cybercriminal are often more precise. “Black hat” is useful shorthand, not a legal category.

Gray hat

Gray hat is the most ambiguous of the three labels. It usually refers to someone who discovers or tests vulnerabilities without intending to cause harm but also without prior authorization. The person may later notify the system owner or publish the issue.

The absence of malicious intent does not eliminate technical, ethical, or legal risk. Unauthorized testing can disrupt services, expose other people’s data, or fall outside a vulnerability disclosure policy. Responsible researchers should understand and respect the authorized scope before testing begins.

Other labels often mixed into “types of hackers”

Script kiddie

Script kiddie is a derogatory term for an inexperienced person who uses scripts, exploits, or tools created by others without fully understanding how they work. The IETF includes the term in its security glossary, but it is not a professional role or formal classification.

Everyone begins with limited experience, and using tools built by other people is normal in computing. The concern arises when someone runs offensive tools without understanding their impact, especially against systems they are not authorized to test.

Newbie or beginner

Newbie simply means beginner. It is not really a type of hacker. Someone may be learning networking, programming, Linux, vulnerability analysis, or any other technical discipline. Being a beginner describes experience, not ethics.

Hacktivist

A hacktivist uses computer-related techniques in support of a political, social, or ideological cause. The term primarily describes motivation, not technical skill or legal status.

Politically motivated digital activity can range from lawful publishing and advocacy to unauthorized actions against third-party systems. For that reason, “hacktivist” should not be treated as an automatic synonym for either ethical hacker or cybercriminal.

Penetration tester, red team, and security researcher

These terms are generally more useful when describing real cybersecurity work:

Penetration tester: performs authorized security testing to identify and demonstrate vulnerabilities within a defined scope.
Red team: simulates adversary behavior in an agreed exercise to evaluate detection, response, and resilience, not only isolated technical flaws.
Security researcher: studies vulnerabilities, products, technologies, and attack or defense techniques. Researchers may work in industry, academia, bug-bounty programs, or independently.
Blue team: focuses mainly on defense, monitoring, detection, and incident response. It is not a category of hacker, but it belongs to the same professional security ecosystem.

Hacker or cracker?

For many years, parts of the technical community preferred cracker for someone who breaks security to gain unauthorized access, while reserving hacker for the older meaning of a technically curious and creative person.

IETF RFC 4949 explicitly preserves that distinction. In current usage, however, cracker is much less common and hacker has acquired several meanings. When precision matters, terms such as attacker, threat actor, intruder, security researcher, or penetration tester are usually clearer.

Common myths about hackers

Myth: a hacker can break into any system in seconds

Movies need fast pacing. Real security research can take hours, days, or weeks of information gathering, configuration review, application analysis, and validation. Often a promising theory simply turns out to be wrong and the tester has to try another path.

Myth: hacking is mostly about typing commands quickly

A great deal of security work involves reading documentation, understanding protocols, reviewing code, analyzing traffic, studying architecture, automating repetitive work, writing reports, and communicating with other teams. Typing speed is one of the least important skills.

Myth: the tool makes the hacker

Kali Linux, Burp Suite, Nmap, Metasploit, and many other tools can be useful, but knowing how to launch them does not replace knowledge of networks, operating systems, programming, authentication, applied cryptography, or application architecture. The same tools can be used responsibly in a lab or abused against systems without permission.

Myth: finding a vulnerability gives you permission to prove its maximum impact

Not necessarily. A disclosure policy or bug-bounty program normally defines what testing is authorized. Discovering a flaw does not automatically grant permission to access sensitive data, pivot into additional systems, or demonstrate every possible consequence.

Myth: ethical hacking and cybercrime are technically the same thing

They may share some knowledge and tools, but the surrounding context changes the work completely. Professional security testing begins with agreed objectives, limits, data-handling rules, coordination, reproducible evidence, and reporting intended to help fix problems. A real attacker is pursuing their own objectives without authorization.

What does an authorized penetration test look like?

There is no single universal methodology, but frameworks referenced by OWASP and PTES provide a useful way to organize the work. At a high level, a professional engagement typically includes:

Pre-engagement and scope: define authorized systems, objectives, exclusions, schedules, contacts, and rules of engagement.
Information gathering: understand the authorized attack surface.
Threat modeling and vulnerability analysis: identify weaknesses that may matter and prioritize them.
Controlled validation or exploitation: demonstrate that a vulnerability is real while limiting unnecessary impact.
Controlled post-exploitation: where permitted, determine the consequences of access without expanding beyond what is required to demonstrate risk.
Reporting: document evidence, risk, reproducible findings, and mitigation recommendations for the responsible team.
Remediation and retesting: verify that identified vulnerabilities have been corrected.

Notice one important difference from many old “hacking steps” lists found online: a professional engagement does not end by erasing logs and hiding evidence. Documentation and reporting are central parts of the work.

If you want to learn ethical hacking

The strongest foundation is not downloading offensive tools first. It is understanding networks, operating systems, programming, web technologies, databases, and security fundamentals. From there, practice should take place in your own labs, virtual machines, purpose-built training platforms, or programs that explicitly authorize security research.

Learning to document a vulnerability is as important as finding one. A capable security professional should be able to explain what is wrong, why it matters, how it can be reproduced safely, and what should be done to fix it.

To place cybersecurity within the broader computing landscape, return to Computing: a global overview of its main fields.