Where Will This Attacker Strike?

About this interactive

What you are doing: predicting who an attacker will hit, or what it will do next, from what the defenders know about it. The lesson's apple tree: most attackers reach for the low-hanging fruit, whatever is easiest to grab, and skip the apple at the top that takes time and risk. That attacker tries one trick on many victims and moves on when a target is protected, so enough security not to be the easy one turns it away. But an attacker after a big payoff, such as a government's secrets or a bank's money, picks one target and keeps climbing, and a strong defense only raises its cost. A grudge works the same way: a vindictive former employee goes after the company that wronged him. How to use it: first ask whether the attacker cares who the victim is. If it does not, pick the easiest target or the move to an easier one. If it has chosen, pick the target it chose or the move that keeps it coming. Each answer shows why.

What you'll learn

Predict which organization an adversary is most likely to hit, from its motivation, the value of what each target holds and how well each is defended
Predict whether an attacker who meets a defense will move on to easier fruit or keep climbing toward a target it has chosen

Aligned to

CompTIA Security+

2.1 Compare and contrast common threat actors and motivations.

2.2 Explain common threat vectors and attack surfaces.

Key terms

Low-Hanging Fruit: A term describing easily exploitable targets or vulnerabilities that opportunistic attackers will pursue before attempting more difficult ones.
Threat Actor: An individual or group responsible for a security incident or attack.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.
Attack Surface: The total set of points in a system where an unauthorized user can attempt to enter or extract data.

Topics

Adversary Targeting Low Hanging Fruit Threat Actors Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →