How Attacks Really Work

Movie hackers type furiously and break through firewalls; real attackers mostly log in with stolen passwords or trick someone into opening the door. Understanding the attacker's actual playbook — automated, industrial-scale, opportunistic — is the foundation of practical defence, because it tells you which defences matter and which are theatre.

Key Concepts

• Most breaches start with one of three things: a reused/stolen password, a phishing message, or unpatched software
• Attacks are automated and indiscriminate: bots test millions of leaked passwords against every popular service daily ('credential stuffing')
• The attacker economy is specialised: some steal credentials, others buy them in bulk to drain accounts
• 'I'm not important enough to hack' is the most dangerous myth — bots do not check how important you are
• Malware today is mostly delivered through email attachments, cracked software and fake download sites
• Ransomware encrypts your files and demands payment — backups are the only reliable antidote

In Practice

A useful mental shift: stop imagining a person targeting you, and start imagining millions of automated attempts spraying the whole internet, all day, every day. Your goal is not to be unhackable — it is to not be the easiest target on the street.

Try It Yourself

List your five most important accounts (email, banking, social, work). For each, write down what an attacker could do with it — email usually wins, because it resets every other password. That ranking is your defence priority list.