The Attacks That Actually Get In

Security marketing is organised around novelty, because novelty is what gets attention. Actual incidents are organised around repetition. The same handful of routes account for most breaches year after year, and none of them are sophisticated.

That gap matters because budget follows attention. Teams buy detection for exotic techniques while the intrusion that reaches them arrives through a valid login on an account with no second factor.

Credentials, not exploits

The most common way into an organisation is a legitimate credential used by someone who should not have it — phished, reused from an unrelated breach, or found in a repository where it should never have been committed. No vulnerability is involved, which is why vulnerability-focused programmes miss it entirely.

Phishing-resistant multi-factor authentication is the single control with the best return here, and the distinction matters: SMS codes and push approvals are both bypassable, one through SIM swap and the other through fatigue prompting. Hardware keys and passkeys resist both because the credential is bound to the site's origin.

Complete coverage is what makes it work. An organisation with strong authentication on its main identity provider and a legacy application that still accepts a password is an organisation with a password problem, because attackers will find the legacy application. The gaps are usually service accounts, contractor access and one system nobody owns.

Edge devices are now a primary route

VPN concentrators, firewalls, file transfer appliances and remote access gateways have become a favoured target, for reasons that make sense from the attacker's side. They are internet-facing by design, they are often not covered by endpoint monitoring, they run vendor firmware that is difficult to inspect, and patching them requires a maintenance window that gets deferred.

The pattern is well established: a vulnerability is disclosed, exploitation begins within days, and organisations that patch in their normal monthly cycle are exposed for weeks. For this class of device, the normal cycle is not adequate — they need an out-of-band process with the authority to take a scheduled outage at short notice.

Worth knowing which of these you have before you need the list. Many organisations discover an unmanaged appliance during an incident rather than during an inventory.

The third party is inside your perimeter

Supply chain compromise covers several different things that get conflated. A malicious package in your build. A compromised software vendor pushing a backdoored update. A service provider with access to your systems being breached and that access being used.

The third is the most common and the least discussed. Managed service providers, support vendors and integration partners frequently hold standing privileged access, often through accounts that are shared, rarely rotated and outside your normal joiner-mover-leaver process.

The controls are unexciting. Time-bound rather than standing access. Separate accounts per vendor with per-account logging. An inventory of who holds what, reviewed on a schedule. Most organisations cannot currently answer the question of which external parties can reach production, which is itself the finding.

Misconfiguration outperforms exploitation

Cloud misconfiguration reliably exposes more data than software vulnerabilities do. A storage bucket set to public, a database with a permissive network rule, an over-broad role attached to a service — none of these require an attacker to do anything clever beyond looking.

This is a good problem to have, because it is preventable by construction rather than by vigilance. Policy enforced in the deployment pipeline stops a misconfiguration from reaching production. Scanning after the fact finds it eventually, which is considerably worse than not creating it.

The organisations that handle this well treat infrastructure changes like code changes: reviewed, tested against policy, and applied through a pipeline. The ones that struggle are those where production can still be changed by hand in a console.

Ransomware economics have changed

Encryption is no longer the main lever. Groups now exfiltrate first and extort on the threat of publication, which means good backups — while still essential — no longer resolve the incident. You can restore everything and still face the disclosure.

The defensive implication is that detecting bulk data movement matters as much as preventing encryption. Large volumes leaving over an unusual path, at an unusual hour, to a destination nobody has used before, is a detectable signal, and it is the one that gives you time to act.

It also changes incident planning. The decision about publication involves legal, communications and executive leadership rather than the security team alone, and it is a poor time to discover that the plan assumed a purely technical event.

AI has changed volume, not method

Generative models have made phishing cheaper and more fluent. The tell-tale grammatical errors that once helped users spot a fake are gone, and personalisation that used to require research is now inexpensive.

What has not changed is what the attack does once it succeeds, which is still to obtain a credential or run a payload. That means the countermeasures still work — phishing-resistant authentication does not care how convincing the message was. It does mean that user training as a primary control has become less reliable, because it relies on the message looking wrong.

Where to put the effort

Phishing-resistant multi-factor authentication everywhere, with the gaps found deliberately rather than assumed absent. An out-of-band patching route for internet-facing appliances. An inventory of third-party access, and time-bound rather than standing privileges. Policy enforced in the deployment pipeline. Detection tuned for bulk data movement.

None of it is novel, which is exactly the point. The threat landscape changes considerably less than the vendor landscape does, and defending against last year's incidents is a better use of budget than defending against next year's conference talk.