Cyber Risk Landscape and Threat Environment
Who attacks, and why
Cyber risk starts with actors and motives. Nation-state groups pursue espionage, pre-positioning for disruption, and intellectual property theft; organized criminal groups pursue monetization through ransomware, business email compromise, and invoice fraud; hacktivists pursue publicity and disruption; insiders-careless or malicious-bypass perimeter controls entirely. Attack surfaces grow with cloud migration, remote work, APIs, OT/IT convergence, and third-party dependencies.
How attacks actually unfold
Understand the kill chain and frameworks such as MITRE ATT&CK: reconnaissance, initial access, privilege escalation, lateral movement, exfiltration, and impact. Initial access is usually mundane-credential phishing, adversary-in-the-middle MFA bypass, unpatched public-facing systems, exposed remote access, or compromised vendors. Ransomware is now an affiliate economy: initial access brokers sell footholds, affiliates execute, and operators apply double or triple extortion (encryption plus data leak plus customer pressure).
Traps candidates fall for
- Treating “we are too small to be a target” as a control; most incidents are opportunistic, not bespoke.
- Conflating threat (actor capability and intent), vulnerability (a weakness), and risk (the combined likelihood and impact).
- Equating “incident” with “data breach.” Availability and integrity attacks-ransomware, wipers, payment fraud-often drive the largest losses.
- Overweighting headline threats (zero-days) while ignoring ubiquitous ones (phishing, reused credentials, unpatched edge devices).
Rule of thumb and worked example
Ask whether a threat requires a capability the actor must deliberately acquire. If yes, discount it; if the capability is publicly available, assume it is already in play. Example: a mid-market distributor learns of a critical VPN flaw with a public exploit and no MFA on the appliance. A ransomware affiliate needs no custom tooling, so near-term likelihood is high, not “possible.” Prioritize by likelihood multiplied by impact, and ask what control would break the chain at the cheapest point.