Much of an attacker's power is not technical. It is psychological: the ominous name, the announced date, the warning that lands before anything happens. Fear is the cheapest tool attackers have. The data on how breaches actually happen shows that behind the mask are people following predictable economics, and people can be understood.
A Story Worth Retelling
Years ago, the collective that called itself Anonymous announced a coordinated campaign: a date on the calendar, a published list of targets, and the usual ceremony of intimidation. The expected response was to brace and wait. One defender I came to admire did something quieter. He studied them: how they worked, what they expected to find, how much they wanted to believe they had already won. Then he built them a convincing decoy, dressed as the critical systems they were hunting for.
When the day came, they spent every technique they had against a mirage. The campaign meant to frighten became a detailed demonstration of how they operate, and a training exercise for the people it had set out to rattle. The lesson was never to fight fire with fire. It was that an attacker is a person with habits and assumptions, and understanding them changes the balance.
What Attackers Actually Do
The 2025 Verizon Data Breach Investigations Report, drawn from more than 12,000 confirmed breaches, describes attackers who take the easiest available way in.
| The Pattern | What the Data Shows | What It Says About the Attacker |
|---|---|---|
| Using stolen credentials | The most common initial access vector, in 22 percent of breaches | Logging in is easier than breaking in |
| Exploiting known weaknesses | 20 percent of breaches, up 34 percent, focused on edge devices and VPNs | They wait for weaknesses to be published and move faster than patching |
| Coming through partners | Third-party involvement doubled to 30 percent of breaches | They choose the least defended door into a target |
| Relying on people | The human element is present in about 60 percent of breaches | Persuasion is cheaper than code |
None of this requires extraordinary skill. It requires patience and opportunity. Attackers do not invent new ways in when old ones still work. They use what was built and what was missed.
The Economics Behind the Mask
Chainalysis reports that the typical price of access to a victim's network on criminal markets fell from about $1,427 at the start of 2023 to $439 at the start of 2026, and that attackers are shifting toward smaller victims on the assumption that they pay faster. Its analysts describe ransomware actors as highly opportunistic, exploiting exposed services and misconfigurations as they appear rather than favoring any particular sector.
That is the most useful fact a defender can know. An opportunistic attacker is deterred by cost. Every common way in that is closed, every weakness patched quickly, every partner connection understood, raises the price of attacking you relative to the next organization. And the ability to recover without paying removes the return. In 2025, the share of ransomware victims who paid fell to a record low, according to Chainalysis.
Why Fear Works for Them and Against You
Fear helps attackers twice. Before an attack, it pushes organizations toward hurried purchases that add complexity without closing the common ways in. During an attack, it rushes decisions, including the decision to pay. Calm is not complacency. It is the condition under which a defender can see the attacker's choices clearly and make better ones.
Seeing Your Organization as an Attacker Does
- Which of your accounts could be used from the outside with only a password?
- Which internet-facing systems have known weaknesses, and how long do they stay open?
- Which partners can reach your systems or data, and what protects those connections?
- Which of your people could be persuaded to approve a payment or share a credential, and would they know how to report the attempt?
- If your data were encrypted tomorrow, could you recover without paying?
Conclusion
Behind the mask is a person running a business, choosing the cheapest way in. Understanding that is lighter than dread and far stronger. It is also the premise behind AQUILA C4I: seeing the organization as others see it, so the easy ways in are found and closed before someone else finds them.
Sources
- Verizon, 2025 Data Breach Investigations Report press release
- Verizon, 2025 DBIR summary of findings
- Keepnet Labs, summary of 2025 DBIR entry points
- Cointelegraph, on Chainalysis's 2025 ransomware analysis
- Infosecurity Magazine, on Chainalysis's view of opportunistic attackers
- BleepingComputer, on record-low ransomware payment rates