An authorized attacker is someone who already has some valid access, credentials, or trusted position before exploiting a flaw. That access might be a local login, a managed device context, a privileged session, or another trust relationship the system is already willing to honor. The term does not mean the person is safe or legitimate; it means the exploit starts from inside an accepted boundary.
This matters in cyber security because many serious bugs are not reachable from the public internet. They require an attacker to be authenticated, on the local machine, or able to trigger a trusted code path. In practice, that turns the flaw into a post-compromise, insider, or lateral-movement risk. Defenders use this distinction to judge exposure, prioritize patches, and understand whether a weakness can be used after initial access. In memory-corruption cases, an authorized attacker may be able to feed crafted input into a trusted component and turn a bug into code execution.