Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Cyberattacks Start with People and so Should Risk Assessments

11 Jun 2025 · 1 min

Watch on YouTube

1:27

In this concise presentation, the speaker argues that every cyberattack originates from a human attacker—whether a malware author, cybercriminal, disgruntled employee, or other archetype. The core message is that organizations should first identify which threat‑agent personas are relevant to them and then prioritize security controls that address those attackers' preferred tactics. By recognizing that not all threat agents target every organization, security teams can avoid spreading resources thinly across unlikely attack vectors. The speaker cites Frederick the Great’s adage, “He who defends everything defends nothing,” to emphasize the need for focused, persona‑driven risk assessments that map attacker capabilities, targets, and tactics to the most effective defensive measures.

Chapters

The origins of every cyberattack begins with a person, living, breathing person. They're the attacker. And it might be a malware writer, a cybercriminal, a disgruntled employee, or any number of other different archetypes. What's important is which attackers are relevant to your organization and how to prioritize controls that target their collective preferred methods of attack. Here is the key: not all threat agent personas are interested in you, which means there are attack methods that are not likely for your organization. Adjusting your protection strategy to focus on the most likely areas of attack greatly optimizes your effectiveness. As Frederick the Great said, "He who defends everything defends nothing." So stop blindly trying to fix everything. By incorporating threat agent archetypes, you can uplevel your risk assessment to know who is attacking you, their capabilities, what specifically they are targeting, and their preferred tactics. That enables you to arrange the best defense possible.