That sounds right.

I've seriously questioned some of these "hackers". Interviewed them. There's lots of money to be made in destructive and penetrative testing. The amount of charlatans I've met...

The thing is I've always wanted to find good ones; the best ones hide their achievements on their CV.