CYBCybersecurity

Imaginary letter from a reformed attacker: how targets get chosen

An imaginary story told from the attacker’s side. Targets are not chosen, they are found. We look at the three signals that make an attacker move on, and at how they become concrete rules in a company.

Strategic editorial team 9 April 2026 7 min read

Cover: “Letter from a reformed attacker”, Cybersecurity

Attackers who are after money rarely choose a company by name. They run programs that probe thousands of systems every night, and they stop wherever a door gives way. That is why the defences that matter most are the ones that persuade them to move on. These are exposed systems patched quickly, logins protected by a second factor and someone who notices the attempts. The letter below is invented. The logic it describes is the one set out in the incident reports of recent years.

This article is part of the “Security stories” series. The story is imaginary, the advice is practical.

The letter

To the management of any company,

For ten years I broke into the systems of companies I could not have found on a map. I never chose one by name. I had programs that knocked on thousands of addresses every night. They tried remote access, mailboxes, admin panels and websites with a component two years out of date. I waited for a door to give way. That became the company of the week.

I didn’t need to be clever. I needed to be patient. I almost always got in by one of three routes. The first was a program exposed to the internet that nobody had updated for months, even though the fix existed. The second was a predictable password, such as the company name followed by the year, or the same password used on a website breached some time before. The third was a helpful person who handed me a code, over the phone or on a well-made web page.

Then there were the companies that made me take another road, and I could spot them within minutes. The flaw announced the week before was already patched. Logins asked for a second factor, and nobody approved it with a careless click. And someone was watching. After a string of failed attempts my address was blocked. After an odd login, a phone call followed.

I didn’t move on out of respect. I moved on because it paid. There were a thousand easier names on the list.

I’ve stopped. I’m writing because I understood something too late. Nobody was a special target, but everybody was on the list. I hope that on the night the program stops at your address, it finds the door locked.

A former attacker

Outside the fiction: why are attacks so automated?

Because it pays. Scanning programs constantly sweep public internet addresses, looking for exposed services and vulnerable versions. Whoever finds a way in often does not use it. They sell it on to whoever will launch the real attack, for example with ransomware, the program that encrypts data and demands a ransom.

Mandiant’s M-Trends 2026 report, published in March 2026 and based on investigations carried out in 2025, describes this chain well:

exploiting vulnerabilities was the most common way in, accounting for 32% of intrusions
voice phishing, meaning deceptive phone calls, rose to second place with 11%
the median time between initial access and its handover to another criminal group fell to 22 seconds.

In other words, the one who gets in is often not the one who strikes, and very little time passes between the two. The letter is right. Nobody chooses the target. A program finds it.

First signal: exposed systems are up to date

An attacker looking for a known vulnerability moves on if it has already been fixed. In practice, three things are needed.

Knowing what is exposed. That means an up-to-date list of everything reachable from the internet, such as remote access, firewalls, email, websites, management panels and cloud services. Whatever is not on the list usually does not get updated.
Prioritising what is actually being exploited. CISA, the US cybersecurity agency, publishes a catalogue of vulnerabilities known to be exploited. Any that appear on exposed systems should be fixed first, within deadlines set in advance.
Making postponements visible. If an update cannot be installed straight away, someone takes that decision in writing and puts a temporary measure in place.

For companies in Italy that fall under NIS2, the EU directive on network and information security, this is more than good practice. The basic measures issued by Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) require a vulnerability management plan approved by the company’s administrative and management bodies.

Second signal: logins don’t open with a password alone

Predictable and reused passwords remain an easy route. What current guidelines recommend, and why, is covered in our article on reused passwords.

A password alone, however, is not enough. The second authentication factor (a code, a notification or a physical key) should be switched on first for email, remote access, administrator accounts and cloud services. Two precautions make the difference.

Phishing-resistant factors for administrators, such as security keys or passkeys, which cannot be read out over the phone.
Attention to repeated notifications. CISA describes attacks in which the victim receives dozens of approval requests until, worn down, they accept one.

A company password manager completes the picture. So do administrator accounts kept separate from everyday ones, and the prompt closure of accounts belonging to people who leave the company.

Third signal: someone notices the attempts

A string of failed logins, a successful login from an unusual country or a new administrator account all leave traces. If someone notices them and reacts, the attacker loses the advantage of surprise. The same M-Trends report finds that 30% of ransomware cases start from an earlier compromise, meaning access obtained and sold on by others. Whoever spots the unusual login in time stops the attack before the people who would finish it arrive.

A few things need to be written down. They are which events trigger an alert, who receives it, what that person does and how quickly. That includes outside office hours, if the company has arranged for it. Logs are needed too, kept away from the systems they describe, as the article on Sherlock Holmes and the log files explains.

To pass on to staff

Staff are one of the three routes in the letter. Here are a few rules that are easy to remember:

no code and no login notification is ever approved on someone else’s behalf
every service gets a different password, stored in the company password manager
anyone calling “from support” is called back on a known number, as in the case of the fake Microsoft support call
doubts are reported straight away, because one report too many bothers nobody.

How can you tell whether your company makes attackers move on?

By looking at it through the attacker’s eyes. An external check shows what can be reached and which versions are running. A penetration test tries to exploit the weaknesses found, within a scope authorised in writing. Phishing and phone-call simulations, run with management’s consent, measure the third route. The results become a list of fixes ranked by severity.

In brief

Attacks for money are largely automated. Programs find the targets, not people.
Intrusions mostly start from known vulnerabilities, weak credentials and deceptive calls or web pages.
The first signal that makes attackers move on is exposed systems that are listed and up to date, starting with the vulnerabilities actually being exploited.
The second is a second factor on email, remote access and administrator accounts, with phishing-resistant factors where it matters.
The third is well-chosen alerts, someone responsible for reading them and logs kept elsewhere.
An external check and staff simulations tell you where the company stands.

Frequently asked questions

Can a little-known company be attacked?

Yes. Automated tools do not look at how well known a company is. They look for open doors. A little-known company with an unpatched remote access system is a more likely target than a large, well-protected one.

Are complex passwords enough?

No. A complex password that is reused, or that has turned up in a breach, offers no protection. You need long, unique passwords, a password manager and, on important logins, a second factor.

Can the second factor be bypassed?

Some forms can. A code can be read out to a fraudster, and a notification can be approved out of fatigue. Security keys and passkeys are more resistant, because they only work on the genuine site and cannot be passed on over the phone.

How often should exposed systems be updated?

There is no single timetable. Severity is what counts. Vulnerabilities already being exploited on internet-facing systems should be fixed first, within the deadlines set in the vulnerability management plan. The others follow a regular cycle.

Who should read security alerts?

A person or a team with a written assignment, inside or outside the company. What matters is that every alert has a recipient and a planned response.

The letter is imaginary. The three routes are not. Strategic’s Cybersecurity division helps you understand which doors attackers can see, through external checks and penetration tests. We then turn the results into fixes in order of priority and rules your staff know.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.