Black hat, white hat, grey hat: who hackers really are

In everyday speech, a hacker is someone who breaks into computers. In the security world the word is older and broader: a hacker is someone who understands a system well enough to make it do things its designers did not expect. Whether that skill is used to protect people or to harm them is a separate question. The industry’s shorthand for that question borrows from old Western films, where the good guys wore white hats and the villains wore black ones.

Three hats

The single test that separates white from black and grey is authorisation. A penetration tester and a criminal may use the same tools and techniques. What makes one a professional and the other an offender is written permission, agreed in advance, that defines what may be tested and how.

Black hats: an industry, not a lone genius

The hooded loner of stock photos is mostly a myth. Serious criminal hacking today is organised like a business. Some groups write malware and rent it out; others specialise in getting initial access to networks and selling it; others handle negotiations and money laundering. Ransomware gangs, infostealer operators and fraud networks trade services with each other on criminal forums. Understanding this helps explain why attacks are so persistent: for the people behind them, it is work.

White hats: how legitimate security research works

• Penetration testing: a company hires experts to attack its own systems under a signed agreement, then fixes what they find.
• Bug bounty programmes: companies publish rules and a scope, invite researchers to look for flaws, and pay rewards for valid reports. Many run through platforms such as HackerOne and Bugcrowd, and Apple runs its own Apple Security Bounty.
• Coordinated vulnerability disclosure: a researcher who finds a flaw reports it privately to the vendor, gives them time to fix it, and publishes details only once users can protect themselves. CISA coordinates disclosures when a vendor is hard to reach.
• Defence: security teams, incident responders and people who write security tools.

Grey hats: good intentions, real legal risk

Grey hats often see themselves as the good guys: they found a flaw, broke in to prove it, and told the owner. The problem is that most computer crime laws focus on access without authorisation, not on intent. In the United States, the Computer Fraud and Abuse Act makes unauthorised access a crime; in the UK, the Computer Misuse Act does the same, and similar laws exist across Europe and elsewhere. Some prosecutors have become more cautious: in 2022 the US Department of Justice announced a policy that good-faith security research should not be charged under the Computer Fraud and Abuse Act. But that policy guides federal prosecutors only; it does not change the law itself, does not bind other countries, and does not stop a company from suing.

Learning hacking the legal way

Curiosity about how systems break is how most security professionals started, and there are plenty of places to satisfy it without breaking the law. Capture the Flag (CTF) competitions give you deliberately vulnerable challenges to solve, alone or in a team. Practice platforms and training labs provide machines built to be attacked, with clear rules. You can also build a small lab at home with old computers or virtual machines that you own. The common thread is simple: you only ever test systems that you own or that someone with the authority to do so has explicitly allowed you to test, in writing. That habit, practised from day one, is also exactly what employers and bug bounty programmes look for.

Other hats you may hear about

• Hacktivists: attackers motivated by a political or social cause.
• State-sponsored groups: hackers working for or with a government, often focused on espionage or disruption.
• Script kiddies: inexperienced attackers using ready-made tools they do not fully understand. Less skilled, but still able to cause real damage.
• Insiders: employees or contractors who misuse the access they legitimately have.

Why this matters to ordinary people

Knowing who is on the other side helps you judge risk. Most people are not targeted by state-sponsored groups; they meet organised black-hat crime through phishing, infostealers and ransomware, which is opportunistic and aimed at whoever falls for it. White-hat work, meanwhile, is why your apps receive security updates: many of the flaws fixed in an update were found by researchers and reported responsibly. Installing updates promptly is how you collect the benefit of their work. Tools like FireAI are part of the white-hat side: they show you what software on your computer is doing, on your own machine and with your consent.