Are white hat efforts not typical in IT security circles?