White Hat, Black Hat, and Grey Hat: Who They Are and What They Risk

White Hat, Black Hat and Gray Hat: the Differences #

White hat, black hat, and grey hat are the labels the cybersecurity industry uses to classify a hacker based on two variables: whether they have authorization to act, and what their objective is. They borrow from Western imagery, where the color of the protagonist's hat immediately tells the viewer whether they're a "good guy" or a "bad guy." Two people can find the exact same flaw in a website—one reports it and receives a transfer from a bug bounty program, the other uses it to steal data and resell it on the dark web—with polar opposite outcomes for the perpetrator, depending on which of these three hats they wear.

Where the Distinction Comes From: Hacker vs. Cracker #

Before the term "hat" became popular, the technical community used a clearer distinction: hacker refers to someone who explores and understands systems out of curiosity or to improve them, while cracker refers to someone who uses the same skills to violate other people's systems without authorization, causing damage or gaining illicit profit. The verb " craccare " (from the English to crack ) describes precisely this activity: forcing protection—a password, a software license, an authentication system—to circumvent it without permission. The distinction has been lost in common parlance, where "hacker" now covers both meanings; the term "hat" was born in part to recover that distinction with more nuance. For the complete history of the term "hacker," see the article Hacker: What It Is, Types of Hackers, and How to Become an Ethical Hacker . We inevitably start with the good guys' hat.

White Hat #

A white hat always operates with the explicit authorization of the system owner. Common examples of white hat activities include penetration testing, authorized red teaming, and vulnerability research as part of bug bounty programs like those run by platforms like HackerOne —for a complete overview of roles, see Ethical Hacker: What It Is and What It Does . The goal is to find vulnerabilities before anyone else does, document them, and help fix them. On the opposite end of the spectrum, without permission and without the same intentions, is the black hat.

Black Hat #

A black hat hacker is what the word "hacker" conjures up in the popular imagination: they operate in the shadows, often relying on dark web marketplaces to buy and sell exploits, stolen credentials, and compromised logins ready for use. The targets vary in scale but not in logic: individuals using phishing or SIM swapping to gain control of a phone, websites exploiting vulnerabilities to steal data or place fake payment pages, entire companies where the goal is almost always financial—a virus or ransomware that encrypts the infrastructure and blocks operations until a ransom is received, typically demanded in cryptocurrency to remain anonymous. In Italy, unauthorized access to a computer system can constitute the crime provided for by Article 615-ter of the Criminal Code; Depending on what is done once inside—data theft, fraud, damage, or the production and distribution of the malware used (Article 635-quater.1 of the Criminal Code)—other crimes may be added, regardless of the stated motivation. Between these two clear extremes, however, lies a gray area that the law struggles to define with the same clarity.

Gray Hat #

Grey hat is an ambiguous middle ground: it acts without explicit permission but without malicious intent, for example by reporting a vulnerability found while "exploring" a system that isn't its own. However, the absence of malicious intent doesn't equate to authorization, and legality depends on the jurisdiction and specific circumstances—good faith isn't an automatic excuse.

The correct way to handle this gray area has a name: responsible disclosure : find the vulnerability, don't exploit it beyond what's necessary to demonstrate it, contact the owner privately, and give them time to fix it before any public disclosure. Following this process without prior authorization is still gray hat; doing so within a bug bounty program that explicitly authorizes it moves the activity into the white hat realm. However, black, white, and gray don't exhaust the palette.

Other Categories: Not Just Three Colors #

These categories don't share the same criteria as the first three: script kiddie describes a level of expertise, hacktivist a motivation, state-sponsored an affiliation—not a position on the same authorization scale.

• Blue hat — the term does not have a universal definition: the most cited source uses it for an external researcher invited by a company (the name comes from Microsoft's BlueHat events) to test a product before release, but other sources use it differently.
• Script kiddie — uses tools and exploits written by others, without truly understanding their internal workings
• Hacktivist — acts for political or ideological reasons (e.g. Anonymous)
• State-sponsored —operates on behalf of a government, often in espionage or sabotage operations (APT groups)

Comparison Table #

FAQ #

Who is a white hat? What do they do? A white hat is a hacker who always operates with explicit authorization: they search for vulnerabilities in systems and applications to report them and have them fixed, not to exploit them for their own gain.

Who is a black hat? What do they do? A black hat is a hacker who accesses systems without authorization for profit or harm—stealing data, installing ransomware or viruses, or selling compromised logins on the dark web.

Who is a grey hat? What do they do? A grey hat searches for vulnerabilities without explicit authorization but without malicious intent, often to report them anyway. However, the absence of malicious intent is not the same as authorization, and legality depends on the jurisdiction and specific circumstances.

Can a grey hat hacker be prosecuted even if they report a vulnerability? Yes. Unauthorized access remains a crime in itself in many jurisdictions, regardless of what you do after discovering it or your stated intentions.

Does the tool or technique used determine whether a hacker is white hat or black hat? No. Nmap, Metasploit, or any other tool are neutral: the exact same technique can be used in an authorized penetration test or in an illicit attack. Authorization and intent alone determine the hat, never the tool.

Are white hat and ethical hackers the same thing? Almost: in common parlance, they're used synonymously, but "ethical hacker" more precisely describes a professional who uses hacking skills in an authorized manner, while "white hat" is the broader label tied to behavior and intentions. The complete picture is in Ethical Hacker: What It Is and What It Does.

What's the difference between white hat and black hat? Authorization and purpose: White hats operate with the owner's permission to improve security, while black hats access or act without authorization for profit or harm.

What are the main types of hackers? White hat, black hat, and grey hat are the three main categories, based on authorization and objective. Blue hat, script kiddie, hacktivist, and state-sponsored exist as additional terms, but they describe different criteria (invitation, expertise, motivation, affiliation) and do not fall under the same classification.

What is the practical difference between a hacker and a cracker today? In everyday language, the two terms have merged; in the original technical jargon, the distinction remains: a hacker explores and understands, while a cracker violates without permission to harm or profit.

Are there other "colors" besides white, black, and gray? Yes—blue hat is the most commonly cited, but informal terminology also includes less standardized variants, used with different meanings depending on the source.

What does "script kiddie" mean? It describes someone who uses tools and exploits written by others without truly understanding how they work—it's a classification based on skill level, not authorization or intent.

What does a hacktivist mean? Someone who uses hacking techniques for political or ideological motivations rather than personal gain—the legality of the action still depends on authorization, not the underlying cause.

What does state-sponsored hacker mean? An attacker who operates on behalf of or on behalf of a government, typically in espionage, sabotage, or influence operations—groups tracked as APTs almost always fall into this category.