I gotta say both of them because an attacker is nothing if they know nothing about how an defender does his defending and this also works the opposite way. Like the saying says, if you want to stop a hacker you have to be one.

This is close enough to be true