Source: Andriy Popov via Alamy Stock Photo

COMMENTARY

In the past, security professionals were true hackers at heart — passionate individuals who made money doing what they loved: breaking systems, pushing boundaries, and constantly learning. They grew their skills out of sheer curiosity and dedication.

Today, however, many in security are simply "professionals" who found a well-paying job but lack that hacker spirit. They're not driven by a love of the challenge or a hunger to learn. They may take the occasional course or learn a few technical tricks — but often, they're doing the bare minimum. This leads to weak security. Meanwhile, attackers? They still have that old-school hacker passion, constantly learning and evolving for the love of the challenge.

We've completely misunderstood how to do security. Instead of genuinely simulating bad guys and preparing for the real thing, we play around with automated tools and call it "offensive" security. Many red-team exercises simply follow a checklist of known exploits without adapting to the specific environment. In contrast, a genuine adversary simulation requires creativity and a deep understanding of the target's weaknesses — crafting custom attack paths and adjusting tactics on the fly. It's about going beyond technical skills and truly getting into the adversary mindset.

Let's be real — technical skills alone aren't going to save anyone. To outsmart attackers, we need to cultivate a hacker mindset: understand the motivations, tactics, and psychology behind attacks, focusing on creativity and adaptability rather than just checking boxes.

Why Adversaries Do What They Do

Too many defenders get stuck on the "how" of an attack — the technical exploits, tools, and vulnerabilities — but to stay ahead, we need to ask "why." Attackers aren't just pushing buttons; they're making strategic decisions, choosing the path of least resistance and maximum gain specific to their objectives.

Attackers know defenders are predictable. They know defenders — often too focused on what looks scary instead of what's actually vulnerable — will patch the big vulnerabilities while ignoring the misconfigurations or overly trusted third-party integrations. Red teams might overlook these, but real adversaries know they're prime opportunities. Attackers exploit trusted integrations to move laterally or exfiltrate data without triggering alarms. This is why understanding the "why" behind attacks is crucial. Attackers aren't just targeting technology — they're going after the path of least resistance, and too often, that's where we're late.

Stop Being a Button-Pusher

Here's the harsh truth: Relying solely on automated tools and predefined processes is a recipe for failure. While those tools are useful, attackers thrive on predictability, so the more security teams rely on the same tools and scripts, the easier it is for them to slip through.

Think about the SolarWinds breach, where attackers leveraged a trusted, automated process to compromise thousands of systems — because defenders didn't critically assess their own tools. SolarWinds is a lesson in the danger of blind trust in automation. If you're just pushing buttons, you're making their job easy.

Attackers are constantly testing the boundaries — doing the unexpected, finding unnoticed cracks. To defend against that, you need to do the same. Be curious, be creative, and don't be afraid to challenge the rules. That's what attackers are doing every day.

Detecting Intent in the Cloud

The cloud is a whole new ballgame. Old perimeter defenses don't cut it anymore — it's about understanding intent. Attackers aren't just exploiting vulnerabilities; they're using legitimate cloud services against you, moving laterally, escalating privileges, and blending in with regular user activity.

Take the Sisense breach: The attacker exploited cloud misconfigurations and legitimate credentials to access sensitive data. They didn't break in — they logged in. The attacker understood how to blend in with typical user activity. Recognizing intent in the cloud is critical; it's about seeing the attacker's goals and cutting them off before they succeed.

If you notice unusual activity, don't wait for an alert. Assume intent and start digging. The faster you understand why something is happening, the faster you can stop it.

Building a Hacker Culture

Growing and honing a hacker mindset is a journey, and it won't come from reading a book or taking a course. It takes time, practice, mentorship, and hands-on experience. Pair up newer team members with people who've been through the trenches, involve the defense team in red team exercises, and let them make mistakes. Real learning happens by doing.

Want to know if you have a hacker mindset? Try the Jack Attack Test (JAT), where creativity — not content — reveals true hacker thinking. For example, finding 10 different ways to "turn off the light" is similar to finding 10 ways to perform a denial-of-service (DoS) attack. Hackers think conceptually, while security professionals might get lost in the details, saying they "don't know anything about electricity."

Another thing: Give your team members the chance to think like attackers. Run attack simulations where they must step into the hacker's shoes. Get a threat intel report, and make them explain the why, not the how. Challenge them to take unconventional approaches. Attackers are masters of the unexpected, and if defenders want to keep up, they need to be too.

Embracing the Adversary Mindset

At the end of the day, security isn't just about tools — it's about understanding how the enemy thinks and why they make certain choices. Every move they make — each target, exploit, and escalation — is deliberate. To stay ahead, defenders must adopt this mindset. By understanding the strategy behind their actions, defenders can identify weak points in their defenses. It's not just about technology; it's about understanding intent, anticipating the unexpected, and challenging the norm. No tool can replace a curious mind ready to step into an adversary's shoes and do whatever it takes to stay ahead.