Security hacker

A person who uses technical skills to find, exploit, or assess weaknesses in computer systems and networks, with or without authorization.

Connect

Vulnerability assessment: A systematic process for identifying, analyzing, and prioritizing security weaknesses. It turns a hacker’s technical observations into a ranked account of system weaknesses.
Black hat: A hacker who uses computer security skills for unauthorized or malicious purposes. This label identifies the unauthorized, harmful end of security hacking.
Bug bounty: A program that rewards people for reporting eligible security vulnerabilities under published rules. Bug bounties give independent hackers a defined, authorized route to report findings.
Hacker culture: A tradition of inventive, hands-on exploration of computing systems and tools. Security hackers inherit a culture that prizes understanding systems by experimenting with them.
Computer security: The protection of computer systems and data against unauthorized access, disruption, or alteration. Security hacking directly informs how systems are tested and protected.
Penetration testing: An authorized, scoped attempt to exploit security weaknesses and evaluate their consequences. It channels hacking techniques into a controlled test of defenses.
White hat: A hacker who tests or improves security with authorization and within agreed limits. This label identifies authorized security work using hacking techniques.
Responsible disclosure: A practice of privately reporting vulnerabilities and allowing time for remediation before public release. It guides how hackers can share findings while reducing risk to affected users.
MIT Tech Model Railroad Club: An MIT student club whose members developed an influential early computing and technical subculture. Its members helped popularize “hacker” as a term for ingenious technical problem-solving.
Computer Fraud and Abuse Act: A United States federal law criminalizing specified forms of unauthorized access to protected computers. Its interpretation can determine whether security testing crosses a legal boundary.