Why Most Breaches Are Not Sophisticated
The myth of the elite hacker obscures a more uncomfortable truth: organisations are compromised daily through basic oversights, not zero-days.
The myth of the elite hacker—armed with custom exploits and nation-state resources—makes for compelling news. But the daily reality of breach investigations tells a different story.
The Uncomfortable Truth
The majority of successful attacks exploit one of three things: misconfiguration, weak credentials, or unpatched known vulnerabilities. None of these require advanced tradecraft. They require patience and a checklist.
When an attacker finds an S3 bucket set to public, they did not bypass any security control. They found an absence of one.
When a phishing email succeeds because an employee was never trained to recognise social engineering, the attacker exploited a gap in awareness, not in your firewall.
Misconfiguration as Attack Surface
Cloud environments are particularly vulnerable here. Default permissions, overly permissive IAM policies, and exposed management interfaces account for a disproportionate share of cloud breaches. The attacker's job is increasingly about reconnaissance, not exploitation.
Tools that scan for publicly exposed services are freely available. An attacker does not need to write a single line of exploit code to map your external attack surface.
What This Means for Defence
If most attacks are not sophisticated, most defences should not be exotic either. The highest-return security investments are often the least glamorous:
These are not cutting-edge capabilities. They are operational discipline. And the gap between knowing this and actually doing it consistently is where most organisations lose.
The Sophistication Trap
Security teams sometimes chase advanced threats while ignoring foundational hygiene. The attacker knows this. Why develop a zero-day when default credentials work?
"Security is not broken by sophistication. It is broken by oversight."
The lesson is not to ignore advanced threats. It is to earn the right to worry about them by first solving the basics. Until then, the most dangerous actor in your threat model is probably not a nation-state. It is a bored attacker with a search engine and a list of default passwords.
Phishing Still Works Because We Let It
Despite decades of awareness campaigns, phishing remains the leading initial access vector. The problem is not the technology — it is the training.
Building Security Culture in Small Organisations
Large enterprises have dedicated security teams. Small organisations have to build culture instead. Here is how to make security everyone's responsibility without burning out your team.
Reconnaissance: The Phase Attackers Never Skip
Before any exploit is launched, attackers spend significant time learning about their target. Understanding this phase is essential for building better defences.