I am very familiar with White Hat. They use a combination of internally developed tools and real live thinking human beings really actively trying to exploit code and logic flaws in the environment.

In my experience, they are very sharp and very (exhaustively) comprehensive.

This is not a handful of "audit kiddies" who barely know how to install and run their tools let alone understand what those tools find.

.... you realize that he is not trying to convince you to hire him but rather trying to decide if he wants to work for you.

I work with people young and old and I find that there is different value in what each bring to the team. Young, bright kids tend to have more energy, enthusiasm and inspiration. Older usually means family which reduces their enthusiasm for long hours and travel. Young engineers will usually have the "hard skills" (as in technical ability, programming knowledge, etc) and they learn very quickly. On the other hand they often lack soft skills such as the ability apply systematic troubleshooting to an unusual problem, the experience to instill calmness and focus in a crisis, the ability to "stealth manage" a project with an inept PM or the ability to fix a really stupid customer's problem while managing to make that customer look like a hero to his management.

Yes, often older engineers will be instinctively guided toward solutions they have seen work--which is sort of the opposite of innovation. Some older guys do fall behind on current technology. Others realize their only job security is their ability to learn new skills and seek out new problems. You want to hire the latter.

Youthful enthusiasm vs age and experience? I think you need both for a well-rounded team.