Know when they are
already inside.

The moment an attacker first gets inside: a mail attachment, a stolen credential, an unpatched VPN appliance, or a compromised supplier.

The attacker works out what the organisation looks like — shared folders, server lists, administrator accounts. This is where deception bites hardest.

Climbing from an ordinary user account to administrator rights. Once this happens, the blast radius widens fast.

Stealing IDs, passwords and access tokens left on machines. From then on the attacker’s activity looks like a legitimate login, which is what makes it so hard to spot.

Moving from the first compromised machine to the next PC, the file server, the core systems. The line between one laptop and the whole company.

The channel malware uses to reach its operator and take orders — usually disguised to blend into ordinary business traffic.

Sending designs, customer data or contracts out of the company. Modern ransomware almost always steals before it encrypts — double extortion.

Encrypting data and demanding payment to release it. Days or weeks of preparation usually precede the encryption — and whether you notice in that window decides the size of the loss.

How long an attacker sits inside before being found. The longer it runs, the further the reconnaissance, privilege theft and data theft have progressed.

Hitting the real target through a less-defended supplier, contractor or subsidiary. It is why hardening only your own perimeter is not enough.

An attack against a flaw with no patch available yet. “We would have been fine if we had updated” does not apply.

Theft or sabotage by someone who legitimately holds access — staff, ex-staff or contractors. Harder to detect than an outside attack precisely because the access is genuine.

Sits at the boundary and sorts traffic that may pass from traffic that may not. The gatekeeper at the front door.

Installed on each PC and server to watch, record and remotely contain suspicious behaviour on that machine. It sees inside the endpoint, not across the network.

Collects logs from every device into one place and correlates them to find anomalies. The more it collects, the harder it becomes to decide what should raise an alert.

The team that watches alerts around the clock and makes the first call. Either in-house or outsourced.

A system placed deliberately to be attacked, so that the tools and techniques used can be recorded.

A fake asset that impersonates a real server, PC, IoT device or industrial controller, planted inside the network to wait for contact.

Fake saved passwords, fake network shortcuts and fake connection history left on real endpoints. The attacker treats them as a find, and follows them to a decoy.

An alert that fires when nothing is wrong. Too many, and real alerts get buried and analysts stop reacting — alert fatigue.

The traces an attack leaves — IP addresses, file hashes, domains. Distributing them to other controls lets you shut down the same attack elsewhere.

A public catalogue of the techniques attackers actually use. It gives everyone a common language for arguing about which stages you can and cannot detect.

Layering controls with different jobs — perimeter, endpoint, internal, forensic — rather than betting on one. Deception owns the internal layer.

Designing on the basis that being inside the network proves nothing, and verifying user, device and traffic every time. It assumes breach, which is why it pairs naturally with deception.

Average time to detect, and average time to respond or recover. The standard way to measure how fast a security function actually moves.

An authorised attempt to break in using the same methods a real attacker would. A vulnerability scan lists holes; this proves whether they can actually be walked through.

The technology that physically moves things — production lines, power, water, building systems. Unlike IT, it cannot be stopped and cannot easily be rebuilt.

The systems that control and monitor industrial equipment. Because uptime comes first, unsupported legacy operating systems often remain in service.

A way to split one physical network into several logical ones — the partitions between departments or process lines.

Dividing the network by function and criticality so that a breach in one area does not become a breach everywhere. Decoys are normally deployed segment by segment.

Networked cameras, printers, door controllers and sensors. They fall off the asset register and rarely get updated, which makes them a convenient foothold.

Devices and services connected without the IT function knowing. Nobody counts them as things to protect, which is exactly why they become entry points.