How Attackers Think

An attacker-economics lesson framed as scenario, attack chain, observable evidence, operator response, and WitnessOps controls.

Problem this page solves

Security teams often see phishing artifacts and account anomalies as isolated events. Without an attacker decision model, containment can be delayed or mis-prioritized. This page turns attacker economics into defensive priorities so operators can raise attacker cost early.

Reader outcome

After this page, you should be able to:

map suspicious activity to attacker decision points instead of treating events as random
identify which controls raise attacker effort at each decision point
choose escalation gates based on observed risk to identity, privileged access, and finance workflows

Mechanism-first attacker decision model

Most campaigns optimize for repeatable return, not novelty.

Decision point	Attacker question	Common low-cost path	Defensive implication
Target selection	"Where can one compromise create the fastest business impact?"	Focus on accounts tied to approvals, payments, vendor trust, or privileged access	Harden high-impact workflows first and reduce single-user failure points
Lure choice	"Which message is most likely to get action without verification?"	Reuse familiar business lures: invoice, shared file, login alert, policy reset	Route reports by workflow context and require out-of-band verification for high-impact requests
Friction avoidance	"How do I avoid strong controls and noisy behavior?"	Prefer weak MFA coverage, stale sessions, and normal-looking timing and channels	Close bypass paths: enforce MFA, revoke risky sessions, and monitor unusual sign-in patterns
Monetization path	"How does access convert to value?"	Payment diversion, data theft or extortion leverage, internal phishing spread, or access resale	Prioritize actions that interrupt conversion to financial or operational impact

Observable operator signals tied to attacker decision points

Decision point	Directly observable operator signals	Why the signal matters
Target selection	repeated lures to finance approvers, admins, or vendor-facing users; role-focused targeting patterns	suggests the attacker is optimizing for high-impact workflows
Lure choice	sender or reply-to mismatch, lookalike domains, urgency language tied to business workflows, payment-change requests	indicates the lure is built to bypass normal verification behavior
Friction avoidance	repeated attempts against accounts without enforced MFA, suspicious new sign-ins after interaction, mailbox or session persistence changes	indicates control evasion and attempts to maintain access quietly
Monetization path	beneficiary-change requests, unusual outbound finance communication, bulk sensitive-data access, internal lure propagation	indicates movement from access to business impact

Practical defensive decisions and escalation gates

Protect likely high-return targets first: finance, privileged, and vendor-trust workflows.
Treat workflow-themed lures as potential impact events, not only awareness events.
Disrupt friction-avoidance behavior quickly: revoke risky sessions, reset credentials where warranted, and remove persistence changes.
Escalate when observed signals indicate conversion toward financial, regulatory, or multi-user impact.

Gate definitions:

Gate A (exposure-only): suspicious lure observed, no interaction evidence.
Gate B (interaction): click or open occurred, no credential, MFA, or session-compromise evidence yet.
Gate C (account exposure likely): credential entry, unexpected MFA approval, suspicious new session, or persistence changes.
Gate D (high impact): privileged account involvement, payment or workflow impact, multi-user spread, or impact scope cannot be bounded quickly.

Close locally only when the evidence is sufficient, the impact scope is bounded, and the selected action stays inside your authorization boundary. Otherwise escalate explicitly.

What WitnessOps controls can support vs cannot guarantee

WitnessOps can support:

Threat Model to map likely abuse paths to controls
Phishing Investigation for governed triage and containment sequencing
Do I Need to Escalate? and What Evidence Is Required? for impact and uncertainty gates
Policy Gates for approval on high-impact actions
Receipts for signed decision and remediation traceability

WitnessOps cannot guarantee:

prevention of all phishing or identity-entry attempts
complete reconstruction when telemetry is missing, delayed, or altered
attacker intent or attribution from a single artifact set
external recovery outcomes, such as third-party fund-recovery timelines

Observed vs inferred separation

Observed: preserved lure artifacts, sign-in or session logs, mailbox or persistence changes, payment-workflow artifacts, and timeline events.
Inferred: "the attacker had full control," "all impacted systems are known," or "financial intent is proven."

Use observed signals to justify immediate containment. Keep inferred claims explicit and provisional until corroborated.

Trust assumptions and limits

Assumptions:

email, identity, endpoint, and workflow telemetry is retained and time-aligned enough for sequence reconstruction
key artifacts are preserved before broad cleanup or remediation
intrusive actions follow policy and approval gates

Limits:

delayed reporting can remove short-lived evidence, such as redirect chains or transient sessions
adversaries may evade, suppress, or overwrite telemetry
some impact-scope and intent conclusions remain probabilistic until more corroborating evidence is collected

Next-page handoff

Continue to The Cost of One Click for business-impact framing that maps these attacker decision points to concrete loss scenarios.