Indeed. It's all about what you do as a result of your shenanigans. If you, say, leave a discrete note behind that you have a gaping security hole the size of a hallway on your systems, that would be considered white hat, as opposed to say, stealing a bunch of internal emails, code, etc and selling it or putting it out on torrent sites.