You have met the word a thousand times, and almost always attached to the wrong face. In the movies, a hacker sits in a dark room, types for ten seconds and the bank opens like a door. In the news, «hacker» is just the name we hand to whoever stole the data. Neither picture survives an hour inside a real security team.
Here is the short version. The world holds two kinds of people with deep technical skill. Some of them want to understand how a system works. Others want to take what the system holds. Those groups are not the same, and mixing them up is what leaves good security departments short of good people.
What is a hacker?
A hacker, in the original sense of the word, is a person who enjoys understanding how a system works from the inside, computers and networks above all, and who uses that knowledge to find its flaws and its limits. That is not my definition. It is the one the IETF wrote into its internet glossary, RFC 1392, and the entry carries a detail most readers skip. When the word is meant as an insult, the correct term is cracker, the person who gets into systems without authorisation.
Look at what the definition leaves out. There is no intent in it, no crime and no hoodie. What marks a hacker is the method. Curiosity first. Patience second. The habit of opening the box to see what is inside, third. Tall or short, loud or quiet, none of that matters. Ingenuity and long hours of study are the entire entry ticket.
The word was born at MIT in the 1950s and 1960s, and back then it belonged to anyone who found a clever answer with almost no resources. Out of that habit came a culture of shared learning. Solve the problem, write down how you solved it, pass it on. The slide towards «criminal» arrived much later, when reporters began calling anyone who cracked a password a hacker.
Hacker culture: from a model railway club to today’s communities
The culture is older than the internet and older than any crime committed on a network. In 1959, a group of students at MIT who automated model trains, the Tech Model Railroad Club, started calling a clever technical fix a hack. The word travelled from their basement to the first computer labs and from there to the whole industry.
In 1984, the journalist Steven Levy set the principles in order in Hackers: Heroes of the Computer Revolution. Free access to information. Mistrust of authority. Merit measured by skill and not by title. The Jargon File, the informal dictionary that has collected that vocabulary since the 1970s, tells the same story from another angle. Hacker culture is a culture of shared documentation before it is anything else.
Now look at what grew out of that trunk. Free and open-source software. DEF CON, running every year since 1993. The Chaos Computer Club. And the capture the flag (CTF) competitions, where teams from every country attack and defend machines for the fun of it. None of that fits the picture of a criminal. All of it fits the picture of a community that teaches in public.
Types of hackers
The cleanest way to sort the map is by hats, and the sorting question is a simple one. What do they do with what they find?
| Type | What they do | Intent |
|---|---|---|
| White hat (ethical hacker) | Finds flaws and reports or fixes them, often under contract | Protect |
| Black hat | Exploits vulnerabilities for their own benefit | Profit or cause harm |
| Grey hat | Finds flaws without permission, then reports them, hoping to get hired | Ambition |
| Hacktivist | Attacks for political or social reasons | Visibility or protest |
| Script kiddie | Uses tools made by others without understanding them | Fun, notoriety |
The border between those rows is thinner than it looks, and the same person can cross it. The knowledge does not change. The tools do not change. What changes is where they point them.
Beyond the three classic hats, the community keeps other colours as loose labels, with no standard behind them. Blue for the person testing their own software before release. Red for the one who attacks the black hats. Green for the one still learning. In professional work those roles get clearer names, red team for the attack and blue team for the defence.
The ethical hacker: paid to do it right
The ethical hacker is a professional with a contract. A company pays them to try to break into its own systems, with permission in writing, so the holes turn up before someone else finds them. The work is called penetration testing, or pentesting, and it is one of the most in-demand jobs in computer security today. The method is not improvised. NIST lays out technical security assessment in its SP 800-115 guide.
The job looks nothing like the screen version. It is months of reading how a system was built, studying bugs others already reported and hunting for the single weak point. That weak point is almost always the same, and it is the person. One user with the password on a sticky note stuck to the monitor, a scene everyone has seen and will keep seeing, is enough to throw away the best configuration ever written.
Ethical hackers write code as well, and plenty of it. They build tools, automate tests and pull malicious software apart to see how it ticks. Before any of that starts, they fix the scope in writing. Which systems may be touched, during which hours, and what happens if a serious vulnerability turns up. Remove that permission and the very same test stops being an audit and becomes a crime.
Bug bounties: paid per finding
A bug bounty programme is a standing offer. An organisation publishes a set of rules and pays outside researchers for every valid vulnerability they report. There lies the difference with pentesting. A pentest hires a closed scope. A bounty opens the door to anyone who respects the rules and pays only for results.
The model is part of the furniture now. Google has paid for flaws since 2010 through its reward programme, and in the United States the CISA directive BOD 20-01 requires federal agencies to publish a vulnerability disclosure policy. A bounty does not replace a pentest. It adds many more eyes to the same wall.
Hacker and cybercriminal are not synonyms
This is the part that gets lost in the retelling. A cybercriminal is someone who commits a crime with technology for profit. Stealing your data, locking your files, selling access to a network. Many of them never reach the level of a real hacker. They buy software someone else wrote, like the script kiddie who feels dangerous after copying a command they do not understand.
A hacker can be the most valuable person on your team. It takes hackers to stop hackers. When ransomware like WannaCry encrypted machines across the world in 2017, the thing that slowed it down was not an antivirus. It was people who knew the system from the inside and could read what it was doing.
A few names are worth keeping in your head.
- Julian Assange (Australia), founder of WikiLeaks, known for the leaks of classified documents that began in 2010.
- Anonymous: not a person but a decentralised collective, active since the mid-2000s, behind actions of every kind, many of them hacktivist.
- Kevin Mitnick: went from one of the most wanted fugitives in the country to working as a security consultant. One career, two very different chapters.
- Chema Alonso: a hacker «on the good side», an executive at Telefónica and a reference in cybersecurity in Spain. The proof that the person you want on the payroll can be the person you once feared.
Movie myths versus reality
A Hollywood hacker is cheap for a script and expensive for your idea of the job. These are the differences that come up again and again.
| What you see on screen | What actually happens |
|---|---|
| Breaks into a system in ten seconds | Access comes after weeks of reconnaissance and dead ends |
| 3D interfaces, countdowns and alarms | Terminals, logs and spreadsheets. The least glamorous tool is patience |
| Guesses everything by typing | The usual way in is human: phishing, reused passwords, default configurations |
| Always in a hoodie | Professionals with a contract, office hours and a report to hand over |
| All hacking is a crime | With written permission, testing a system’s security is a legal and fully regulated job |
Frequently asked questions
What is a hacker?
Someone with deep computing knowledge who uses it to understand how systems work and find their flaws. A crime is not implied: the difference lies in what they do with what they discover.
How many types of hackers are there?
The most common classification uses hats. White for the ethical ones, who work to protect. Black for the criminals. Grey for those who act without permission and then report. Add to that the hacktivists and the script kiddies.
Are hacker and cybercriminal the same thing?
No. A cybercriminal commits a crime with technology. A hacker can be a professional hired to protect systems. Not knowing the difference is what turns «hacker» into an insult.
What is a bug bounty, and is it legal?
A programme in which an organisation pays outside researchers to report vulnerabilities under its rules. It is legal as long as that framework is respected. Probe only inside the published scope and report the flaw without exploiting it.
How are security flaws found?
With authorised testing (pentesting), code analysis and configuration reviews, plus user training. OWASP‘s testing guide is a common reference. People are usually the weakest link.
What does it take to be an ethical hacker?
A solid grounding in networks, systems and programming, curiosity, persistence and a clear legal framework, which means working with permission. Without it, the same thing stops being an audit and becomes a crime.
The bottom line
The hacker of the popular imagination is a mix of romance and fear. Someone who types fast and jumps systems «on the fly» in ten minutes. The real hacker studies a lot, programs quite a bit and spends hours reading about known flaws. There is no glamour in it. There is method.
That is why the distinction pays off. Knowledge is neutral. Intention is not. A country or a company needs as many hackers as it can afford, above all to defend itself. If you want the other side of that coin, here is what a computer virus is, how role-based access control works and the history of computing, where all of this began.