Cybersecurity
Attack, defence and human error
Description
In May 2021, a single stolen password brought a large part of the American East Coast to a standstill. A group calling itself DarkSide had slipped into the network of Colonial Pipeline, the company that carries close to half the fuel consumed on that side of the country. There was no dramatic hacking scene, no genius bent over green text at three in the morning. The credential belonged to an old virtual private network account that nobody had bothered to switch off, and it wasn't protected by a second factor. Within days, gas stations across the Southeast were papering their pumps with handwritten "no fuel" signs, and Colonial had wired roughly $4.4 million in Bitcoin to the attackers.
What makes the story ordinary rather than exceptional is precisely that it wasn't clever. Most of the breaches we read about don't begin with a novel exploit. They begin with something forgotten, reused, clicked, or trusted — a person, somewhere, doing a very human thing. The machines, for the most part, held. The seams opened where machines met the people operating them. That pattern repeats so reliably that it has become the quiet truth of an industry now worth hundreds of billions of dollars a year.
We tend to picture cybersecurity as a duel between two kinds of expertise, attacker and defender, each armed with sharper tools than the other. It's a satisfying image and mostly a misleading one. The tools matter, but they sit on top of an economy with incentives, budgets and deadlines, and underneath a layer of ordinary human attention that no amount of code has managed to replace. Following the money, and then following the mistakes, tells us more about why we keep getting breached than any account of the latest malware ever could.
The question we’re asking : Why do the most sophisticated defences keep failing at the most ordinary points, and what does that tell us about where the real vulnerability lives?What we’ll see : How intrusions actually happen, the economics that make attacking a profession, why defenders run permanently behind, and what it means that the last line of defence is a tired person at a keyboard.
Table of contents
01 Chapter 1 — The intruder who never breaks a window
The popular idea of a hack is a wall being broken through by force. The reality is closer to someone walking in the front door with a key they were handed. Verizon's annual analysis of tens of thousands of security incidents has found, year after year, that the large majority involve stolen credentials, phishing, or the exploitation of a mistake rather than some previously unknown flaw. Attackers are rational. Finding a brand-new vulnerability in well-defended software is expensive and slow. Convincing a distracted employee to type their password into a convincing fake page is cheap, fast, and works often enough to be a business model.
Phishing is the workhorse of the whole field. A message arrives that looks like it comes from a colleague, a bank, a delivery service, and it asks for one small action: click here, log in, approve this. The craft has grown far past the clumsy misspelled emails of fifteen years ago. Modern campaigns copy real branding, spoof real domains, and time themselves to moments when people are rushed — a Friday afternoon, the end of a quarter, the hour before a holiday. The attacker isn't defeating a firewall. They're borrowing the trust that lets an organisation function at all.
02 Chapter 2 — An economy with quarterly targets
It helps to stop thinking of attackers as individuals and start thinking of them as a supply chain. Serious cybercrime today looks less like a lone figure and more like a set of specialised firms trading with each other. One group writes the malware. Another rents access to compromised networks. A third handles the negotiation and laundering of ransom payments. This division of labour has a name in the trade — ransomware-as-a-service — and it works exactly the way legitimate software subscriptions do, with affiliates paying a cut of their takings to the developers whose tools they use.
The numbers behind this economy are large and genuinely hard to pin down, which is worth saying plainly rather than dressing up a guess as fact. Ransom payments tracked on public blockchains ran to hundreds of millions of dollars a year through the early 2020s, and the total cost of cybercrime, once you fold in downtime, recovery and lost business, is estimated in the trillions — figures that come with wide error bars and a strong incentive on all sides to inflate them. What isn't in doubt is the direction of travel. The activity is profitable enough, and low-risk enough, to keep attracting new entrants.
03 Chapter 3 — The defenders are always a step behind
Defence is reactive by nature, and no amount of investment fully changes that. A new vulnerability exists in software before anyone knows to look for it; the window between its discovery by an attacker and its patching by a vendor is the so-called zero-day, and during it the defender is guarding against something they can't yet name. Even after a fix exists, applying it across a real organisation — with legacy systems that can't be taken offline, and machines nobody remembers owning — takes time the attackers are happy to use.
The modern response has been to stop trusting the perimeter altogether. The old model imagined a hard shell around a soft interior: get past the firewall and you were inside, trusted. That fell apart the moment work moved to the cloud, laptops travelled home, and one stolen credential could waltz through the shell. The current fashion, "zero trust," assumes the attacker is already inside and insists that every request be verified regardless of where it comes from. It's a sensible shift, but it doesn't win the war so much as change the terrain on which it's fought.
04 Chapter 4 — The system was never only made of code
Run through enough of these stories and the same figure keeps appearing at the decisive moment: not a firewall, not an algorithm, but a person. The employee who clicked, the admin who reused a password, the manager who approved a wire transfer because the email sounded urgent and came, apparently, from the boss. The industry has a shorthand for this — the human is the weakest link — and it's repeated so often that it has hardened into something like a shrug. The trouble with the phrase is not that it's wrong. It's that it stops the thinking at the exact point where the thinking should begin.
Calling the person the weakest link quietly blames them for a failure that was designed around them. A system that can be undone by one tired click on a Friday afternoon is not a system with a bad user; it's a system that placed catastrophic consequences behind a single ordinary human moment. The attacker understands this better than the defender often does. Social engineering — the manipulation of people rather than machines — works because it targets attention, courtesy, fear and haste, the very traits that let humans cooperate at all. You cannot patch trust, and you wouldn't want to, because trust is what makes an organisation more than a pile of computers.
05 Conclusion
Colonial Pipeline restarted its flow after six days, having paid a ransom that the FBI later partly clawed back. The stolen password behind it all was never a technical marvel; it was a housekeeping oversight that any of us might have committed. That is the uncomfortable through-line of the whole field. The attackers are organised, the defenders are sophisticated, the tools on both sides are formidable — and the outcome still turns, again and again, on something a person did or failed to do in an unremarkable moment.
Related books
