I used to say there were only ... a few hundred (in the latter category). These are people who like to play with software and figure out how to find exploits into the software. That requires lots of good technical talent and knowing how to do software testing.