[nicce]

But their work is essentially penetration testing and exploit development. That usually counts as offensive side. They are not designing and building secure-by-design stuff, for example.

They are known for breaking stuff, and everyone wants to be the same.

Goal might be defensive in everything cyber security researchers do, but that was not my point.