Modern cybercrime is run like a corporate business

A dark room, a glowing screen and a teenager in a grey hoodie. This image appears in almost every film about cybercrime. It is easy to see why this became the standard view of a hacker. In the early days of computing, many breakthroughs came from young people with too much time and a lot of curiosity. These individuals found holes in systems because they wanted to see if it was possible. They worked alone or in small, loose groups. To an outside observer, the threat felt like a prank or a nuisance rather than a coordinated attack on a bank.

A professional turn#

The world changed when people realised that stealing data is more profitable than showing off. Today, the most expensive breaches are not the work of a bored student. They are products of organised criminal groups. These organisations operate like any other modern business. They have budgets, targets and hierarchies.

Some members specialise in writing the software used for the attack. Others focus on finding ways into a network, which is known as initial access. There are even support desks to help users deploy their malicious tools. Some of these groups employ human resources managers to recruit new talent and accountants to handle the flow of money. It is less like a bedroom hobby and more like a corporate office with better encryption.

The danger of stereotypes#

Treating the adversary as a lone teenager leads to a flawed defence strategy. A student might stop when they hit a wall or get bored. A professional organisation does not. They have the patience and the capital to try different paths for months.

These groups often use affiliate schemes. In this model, a central group provides the tools and infrastructure in exchange for a cut of the profit from any successful theft. This means the person carrying out the attack has a strong financial incentive to be thorough. The lone prodigy is a useful stock photograph, but it is not a helpful threat model. A threat model is a structured way of identifying potential attackers and their methods to better protect a system.

When a company assumes the enemy is just one clever person, it tends to focus on stopping “clever” tricks. It ignores the fact that professional groups use a combination of social engineering, bought credentials and paid specialists to wear down a defence over time. A single genius can be stopped by a bit of luck or a patched server. A business with a payroll cannot be stopped so easily.

Shifting the focus#

Security needs to move away from the myth of the solitary hacker. The goal should not be to outsmart one person, but to make the cost of an attack too high for a business to justify. Criminal groups analyse their return on investment. If a target is too expensive or time-consuming to breach, they will often move to a softer target.

This requires a shift in how a company views its defences. It is no longer enough to have a strong perimeter. One must assume that a professional group will eventually find a way inside. The focus should then turn to detection and response. If an intruder enters the network, the goal is to spot them and remove them before they can reach the crown jewels of the organisation.

Review the current security budget and priorities. Ensure there is an emphasis on continuous monitoring and rapid incident response rather than just preventative tools. A professional attack team will eventually bypass a firewall; the only real defence is the ability to recognise their presence and act quickly to stop them.