Ok, I'll tell you how it goes in the real world. I worked for a somewhat HN-famous pentesting company several years ago.

"So, X has been infiltrating <company> for the past few days."

"Really? <company>? <famous company>?"

"Yep. We're keeping them looped in on everything, and they told us to try to get as far as possible. Apparently they were running <outdated version> of <software> on one of their boxes, and <scanner> picked it up."

"That actually happens?"

"He's <highly surprising claim> right now. You'd be surprised how far you can get, jumping from one box to another."

I can't give much more detail than that, for obvious reasons, but the reality is that it's very methodical, very "boring" work. It's basically a giant matrix of probabilities: there are hundreds of thousands of attack vectors, and your job is to tap as many as possible, sorted by probability of effectiveness, until something sticks. Then use your head to get further, adapting to the situation on the fly.

And ... writing reports. Jesus, if someone had told me that 70% of your day would be spent writing reports, I probably wouldn't have joined. But the 30% of other stuff made up for it.

That feeling you get when you break into somewhere you're not supposed to be, and that you were paid to do it, is amazing. The rules change from engagement to engagement, but usually it's "do whatever you want, but don't modify any data, i.e. no destructive actions, and all info you've collected will be deleted at the end of the engagement."

Must be interesting to be a spook in the NSA doing that kind of stuff offensively.

Also, it might seem absurd that I'm comparing this story to the most elite hackers in the developed world. And maybe it is. But if you knew which <company> it was, and exactly what <highly surprising claim> was, you'd be shocked that one or two smart developers poking at internals were able to compromise the entire corporate network of <famous company>, to the point of being able to... well. Let's just say, I wish I could say. It's a weird feeling, seeing it with my own eyes, knowing it's true, and never being able to talk fully about it. :)

So I imagine the NSA spooks are doing similarlly-methodical work, with some cheat codes like "we intercepted their computer before delivery and installed a backdoor that only activates when we send a specially malformed packet that would normally be dropped and is therefore invisible, which grants us access as needed."