2 · Threat Landscape

In the previous chapter we built a shared vocabulary; see Foundations if any of the core terms still feel slippery. This chapter answers a more visceral question: how does a real intrusion actually happen? Breaches are rarely a single dramatic moment. They are processes — sequences of small, often unremarkable steps that, taken together, hand an attacker control of something they should never have touched. Understanding that sequence is the first real advantage a defender has.

The attack lifecycle

An attacker almost never goes from “outside” to “owning your most sensitive data” in one move. They progress through stages, and the security community has developed two widely used models for naming those stages.

The first is the Cyber Kill Chain, introduced by Lockheed Martin. It describes an intrusion as a chain of phases: reconnaissance (researching the target), weaponization (building a malicious payload), delivery (getting it to the victim, often by email), exploitation (triggering the payload), installation (establishing a foothold), command-and-control (the attacker remotely steering the compromised machine), and finally actions on objectives (stealing data, encrypting files, or whatever the real goal was).

The second model is MITRE ATT&CK, and it deserves a careful definition because it is the working language of modern defense. ATT&CK is a large, continuously updated knowledge base — a matrix — that catalogs the real-world tactics (the attacker’s goals, such as “initial access” or “privilege escalation”) and techniques (the specific ways they achieve those goals). Each technique has an identifier, so when a defender says “we saw T1566,” every other defender knows they mean phishing. Defenders rely on ATT&CK because it turns vague intuition into a precise, shared map: you can mark which techniques your monitoring actually detects, find the gaps, and compare your coverage against the methods real adversaries are known to use.

The single most important insight from both models is that an attack is multi-stage, and that asymmetry favors the defender more than people expect. The attacker must succeed at every stage to win. The defender only has to break the chain at one stage to stop the whole operation. You do not need flawless email filtering, flawless patching, and flawless monitoring simultaneously — you need any one of them to fire in time.

The major attack classes

Most intrusions, despite endless variation, fall into a handful of recognizable classes. Knowing them lets you reason about an unfamiliar incident by analogy.

Phishing and social engineering target the human rather than the machine. The attacker crafts a message — an email, a text, a phone call — designed to make a person click a link, enter a password, or approve a payment. It endures as the number-one entry point because humans are predictable and trusting in ways software is not. The starkest real example is the business email compromise (BEC) fraud run by Evaldas Rimašauskas, who impersonated a hardware supplier and tricked employees at Google and Facebook into wiring roughly US$100 million to accounts he controlled — no malware required, just convincing invoices. Imagine a forty-person SaaS startup called Lumengrid whose accounts-payable clerk receives an email, apparently from the CEO, asking to urgently update a vendor’s bank details before a wire goes out that afternoon. Nothing is hacked in the technical sense; the company simply pays the wrong account.

Ransomware encrypts a victim’s files and demands payment for the decryption key. Modern operators have escalated to double extortion (they also steal the data and threaten to leak it, so backups alone won’t save you) and even triple extortion (adding threats like DDoS or directly harassing the victim’s customers). The model exploded because of cybercrime-as-a-service, which turned attacks into a turnkey product. The 2021 Colonial Pipeline incident, carried out by the DarkSide group, is the canonical case: the company precautionarily shut down its operational pipeline, triggering fuel shortages across the US East Coast. Four years earlier, WannaCry (2017) showed ransomware’s worm-like potential, spreading via the EternalBlue exploit against unpatched systems vulnerable to MS17-010 and crippling organizations including the UK’s NHS.

Web application attacks abuse the software we expose to the internet, and the industry-standard catalog of the most dangerous categories is the OWASP Top 10. Three are worth defining. Injection (classically SQL injection) occurs when user-supplied input is fed into a database query without being properly separated from the command, letting an attacker make the database do things it shouldn’t. Cross-site scripting (XSS) injects attacker-controlled script into a page so it runs in another user’s browser. Broken access control is simpler and more common than either: the application fails to check that the logged-in user is actually allowed to see or change the thing they requested. The dramatic real example is Log4Shell (CVE-2021-44228) in the ubiquitous Log4j logging library, which attackers began exploiting within hours of public disclosure because the vulnerable code was everywhere.

Supply-chain attacks compromise a trusted dependency or vendor so that breaching one target infects everyone downstream. SolarWinds/SUNBURST (2020) saw attackers plant a backdoor in a software update that thousands of organizations then installed themselves. The XZ Utils backdoor (2024) showed the same logic in open source, where a patient attacker spent months gaining maintainer trust before slipping malicious code into a widely used compression utility. MOVEit (2023) demonstrated the blast radius when the Cl0p group mass-exploited a single file-transfer product to breach hundreds of organizations at once.

Identity-based attacks treat stolen credentials and session tokens as the keys to the kingdom — because in cloud-centric environments, identity is the perimeter. Attackers phish passwords, steal authentication tokens, or wear down users with repeated MFA prompts (“MFA fatigue”). The Okta/Lapsus$ breach (2022) and the LastPass breach (2022) both turned on access to identity and secrets, and the MGM/Caesars incidents (2023) showed the Scattered Spider group simply phoning the IT help desk and talking their way past authentication.

Class	What it is	Why it still works
Phishing / social engineering	Trick a human into access or action	Humans are the most reliable exploit; the #1 entry point
Ransomware	Encrypt and extort, now double/triple extortion	Cybercrime-as-a-service made it turnkey
Web app attacks	Injection, XSS, broken access control (OWASP Top 10)	Code ships faster than it is secured
Supply chain	Compromise a dependency or vendor to hit everyone downstream	One breach, thousands of victims
Identity-based	Stolen credentials, token theft, MFA fatigue	Identity is the perimeter, and it is phishable

The 2026 frontier threats

Every class above is evergreen. What makes this moment different is that each one has acquired an accelerant.

AI-powered attacks

Artificial intelligence lowers the cost and raises the quality of attacks that once demanded skill and time. Deepfake-driven social engineering synthesizes an executive’s voice or face convincingly enough to fool colleagues in real time. In 2024, a finance worker at the engineering firm Arup in Hong Kong paid out roughly US$25 million after joining what appeared to be a video call with the CFO and other staff — every participant but the victim was a deepfake. AI also enables automated vulnerability discovery and exploit generation, compressing work that took experts days into minutes, and adaptive AI-written malware that rewrites itself to slip past detection. Imagine a regional credit union whose staff receive a flawless voice call from their “CISO” authorizing an emergency transfer — the tell-tale awkwardness that used to betray a scam is simply gone.

Securing AI itself

As organizations embed AI into their own products, the models become a new attack surface. Prompt injection hijacks an AI’s instructions through its inputs — for instance, a malicious web page that an AI assistant reads can contain hidden text telling the assistant to exfiltrate the user’s data. Model and data poisoning corrupts the training or retrieval data so the system behaves the attacker’s way. And agentic-AI risk is the sharpest of all: an autonomous agent equipped with tools and credentials is effectively a new, privileged, hard-to-audit insider that never sleeps. The implications are explored further in Autonomous SOC.

The unglamorous majority

For all the frontier drama, the dominant breach vectors remain mundane. Cloud and SaaS misconfiguration — a storage bucket left public, an over-permissive role — caused Capital One’s 2019 breach and quietly causes countless others. IoT and OT exposure grows as physical systems connect: the Mirai botnet (2016) hijacked insecure cameras and routers to take down much of the internet via the Dyn DNS provider, and Stuxnet showed malware reaching into industrial control systems to damage centrifuges. The boring stuff still wins more often than the exotic.

For a curated set of primary write-ups on these incidents, see Sources.

Every threat in this chapter just gained an AI accelerant — which raises the question the next chapter confronts head-on in Mythos: what happens when the attacker itself is a frontier AI?