Grey Hat Hacker.

A hacker who operates between ethical and unethical extremes, often probing systems without explicit authorization but typically with the intent to disclose, not harm. It belongs to the Defense & Operations category of cybersecurity.

A hacker who operates between ethical and unethical extremes, often probing systems without explicit authorization but typically with the intent to disclose, not harm.

A grey hat hacker conducts security research or active probing without the prior, written consent that white hats require, yet usually without the malicious intent of a black hat. Grey hats might scan public-facing services, exploit a vulnerability to prove it is real, and then notify the owner expecting recognition, a bounty, or a quiet fix. Even when their motives are constructive, their actions frequently violate computer-misuse laws in jurisdictions that criminalize unauthorized access regardless of intent. Modern coordinated vulnerability disclosure frameworks, safe-harbor clauses in bug bounty programs, and laws like the EU CRA aim to give these researchers safer legal pathways.

Defences for Grey Hat Hacker typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Grey-hat, Gray hat.