Insights
Who's trying to hack you, and why
Cyber security isn't a technology problem. It's a people problem.
Most successful attacks don't break technology. They break trust, habit and attention. That makes cyber security a societal issue: it depends on how people work, what they're rushed into, and who they believe.
Small businesses are the Achilles heel
Large organisations spend heavily on security. Attackers know that, so they often go around the front door. They look for the smaller businesses connected to it: the bookkeeper, the IT contractor, the air-conditioning servicer, the marketing agency.
Those small businesses hold email threads, invoices, logins and remote access into much bigger organisations. One of the best-known retail breaches (Target, 2013) started with stolen credentials from a heating and air-conditioning supplier.
So small businesses are often left out of security conversations, yet they're exactly where attackers start. Getting the basics right protects you and everyone you work with.
Why smart people click bad links
Daniel Kahneman's Thinking, Fast and Slow describes two modes of thinking:
- System 1 is fast, automatic and emotional. It's how we all get through a busy inbox.
- System 2 is slow, deliberate and sceptical. It's what you need to spot a fake.
Attackers write messages to keep you in System 1:
- Urgency: "Your account will be suspended in 2 hours."
- Authority: "Message from the CEO / the ATO / your bank."
- Fear or reward: an overdue invoice, a missed parcel, a refund.
Is bad spelling still a warning sign? Yes, but its absence proves nothing.
Sending a scam email costs almost nothing, so criminals send millions, misspelt or not. Some researchers have argued that the obviously dodgy ones are deliberate: a scam that sounds too strange to believe filters out sceptical people, so the only ones who reply are the most likely to go all the way. To the scammer, the clumsy email isn't a mistake; it's a sorting tool.
Meanwhile, AI now writes flawless, personalised messages for the targeted scams aimed at businesses, and can back them up with a cloned voice on the phone. So treat bad spelling as a red flag, but never treat good spelling as a green light. The better test is: is this pushing me to act fast, and can I check it another way?
And don't picture a lone hacker in a hoodie. Leaked internal chats from major ransomware groups showed salaries, managers, a HR department and bonuses, like a real company. They study what works, and the psychology of persuasion is freely published for anyone to use.
The one habit that beats most scams: when a message creates urgency, slow down. Check it using contact details you already have, not the ones in the message.
The six types of attacker
| Attacker | Motivation | How they usually operate | Effort to defend |
|---|---|---|---|
| Nation state | Espionage, strategic advantage, disruption | Patient, well funded, custom tools. Often reach big targets through smaller suppliers. | Very high to stop one that's determined. For most organisations the realistic goal is not being the easy stepping stone into a client or partner. |
| Cyber criminals | Money | Mostly opportunistic: phishing, invoice fraud, ransomware, stolen passwords. Run like businesses, and AI makes them faster. | Moderate. Most go after the easiest targets, so being harder to hit than average stops most of them. |
| Hacktivists | Ideology, publicity | Website defacements, data leaks, denial-of-service attacks timed to news events. | Low to moderate. Patched websites, DDoS protection, and not storing data you don't need. |
| Malicious insider | Revenge, money, coercion | Uses access they already have. Often around resignations or disputes. | High. Least-privilege access, logging, separation of duties, and prompt offboarding. |
| Accidental insider | None; it's a mistake | Mis-sent emails, weak or reused passwords, clicking the wrong link, oversharing files, plugging in unknown USB devices. | Moderate and ongoing. The biggest real-world risk for most organisations. It's about culture, guardrails and making the safe way the easy way, not blame. |
| Script kiddies | Curiosity, bragging rights | Run ready-made tools against anything exposed to the internet. | Low. Patching, MFA and no unnecessary internet-facing services stop nearly all of them. |
What stops most of them
A small set of basics defeats the bulk of attacks, whatever your size:
- MFA on email and anything that matters.
- Not re-using the same password across multiple sites.
- Patching on a schedule.
- Backups you've actually tested restoring.
- Least-privilege access: people get only what they need.
- A "verify before you pay or click" culture.
In Australia, the ASD's Essential Eight (cyber.gov.au) is the recognised baseline.
Sources
- Krebs on Security (2014): Target Hackers Broke in Via HVAC Company
- Microsoft Research (2012): Cormac Herley, Why do Nigerian Scammers Say They are from Nigeria?
- Check Point Research (2022): Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
- Australian Signals Directorate: Essential Eight
- Daniel Kahneman (2011): Thinking, Fast and Slow (book)