You Will Get Hacked. Your Job Is to Make It Expensive.

In early 2024, a finance employee at the engineering firm Arup joined a video call with the company’s chief financial officer and several colleagues. The faces looked right. The voices sounded right. After the call, the employee made 15 transfers worth about US$25 million. Everyone else on that call was a deepfake.

Arup later said that none of its internal systems were compromised. There was no malware to detect and no vulnerability to patch. The attackers walked past the entire security stack by going around it, using tools that keep getting cheaper.

You will get hacked. “It is a question of when, not if” has been repeated at so many conferences that it has stopped meaning anything, and most organisations still budget, report and make promises as though it were false. This article is about what changes when you take that sentence seriously.

It is not here to make you panic, and it is not an invitation to give up. Treat it as a planning assumption, the way an engineer assumes an earthquake will eventually hit the bridge. Some companies will get lucky, but you cannot put luck in a security strategy.

Why 100% security does not exist

A guarantee would require every control, every person, every vendor and every line of code you depend on to hold at the same time, every day. The attacker needs one of them to fail once. The recent numbers show how little of that is within your control.

• Exploitation can beat the patch. Mandiant’s M-Trends 2026 estimates the mean time to exploit at minus seven days, meaning exploitation is routinely under way before a fix is released. A flawless patching programme cannot close that window.
• Your defences are targets too. Google Threat Intelligence Group tracked 90 zero-days exploited in 2025. A record 43 hit enterprise technology, and 21 of those were in security and networking products, the very things bought to keep attackers out.
• Your perimeter includes other people’s mistakes. The 2026 Verizon DBIR found third parties involved in nearly half of all breaches, a 60% rise in a year.
• People are in scope. In Mandiant’s data, voice phishing is now the second most common way in, at 11% of intrusions, ahead of email phishing at 6%. Someone was persuaded on the phone, and no patch fixes that.

None of this requires anyone to be careless. A well-run programme still carries residual risk, and anyone promising you otherwise is selling something.

What the safe industry worked out long ago

Try buying an unbreakable safe. No serious manufacturer will sell you one, because they sell time. Under the UL 687 standard, a TL-30 rating means the door held out against two skilled attackers with tools for 30 minutes of working time. The label openly admits that with enough time, the safe opens.

So the buyer asks a better question than “can it be broken?” They ask whether the alarm will sound and the guards will arrive before the 30 minutes are up. Winn Schwartau brought the same idea to information security in his 1999 book Time Based Security: protection time has to exceed detection time plus reaction time. A wall is only worth what your response can do while the attacker is still climbing it.

Run your own numbers against that formula. Mandiant puts the global median dwell time at 14 days, and 122 days for espionage cases. Meanwhile, the median gap between initial access and hand-off to a second threat group fell from more than eight hours in 2022 to 22 seconds in 2025. If your wall holds for a week and nobody looks for a month, its strength hardly matters.

Security is a price, and you help set it

Every intrusion is a project with a budget, even when the budget is small. The attacker pays in four currencies you can name, plus a fifth that is easy to forget: the risk of being caught before the payoff.

This works because much of the threat is a business. Ransomware crews have affiliates, revenue shares and return on investment to think about. When you cost more than you are likely to pay, a rational crew moves on to the next name on the list.

The model has two limits, and a credible CISO should say them out loud. First, state actors work to a mission and not to a margin. If you hold what they want, a higher price will not make them leave, but it will slow them down and force them to make more noise, which gives your team time to act. Second, prices decay. A new bypass, a fresh CVE or a cheaper tool can erase a control’s value overnight, so the bill needs recalculating regularly and not just at audit time.

The threat ladder, from pocket change to nation state

Threats make more sense when you sort them by what they cost the attacker. The table below is a mental model and not a price list: the costs show the rough shape of the market, and the order of the middle rungs varies from case to case.

Rungs 1 to 3: the weather

Nobody chose you at this level. Your IP address came up, your employee’s password was in a stolen log, or your domain was on a list. It behaves like weather, constant and impersonal, and anything exposed will be tested.

It would be easy to dismiss if the numbers were not so bad. The 2026 DBIR shows vulnerability exploitation overtaking stolen credentials as the top route in for the first time in the report’s history, at 31% of breaches. Only 26% of the vulnerabilities on CISA’s known-exploited list were fully fixed, and the median time to patch grew to 43 days. This is the rung where the attacker has spent almost nothing, and where losing is hardest to explain.

Rungs 4 to 6: the human layer

Here the attacker starts spending on you specifically, though often not much. Rapid7 found access broker listings averaging about $2,700 in the second half of 2024, with almost 40% between $500 and $1,000. Its later sample averaged far more, pulled up by very high prices on one forum, so treat these as market signals and not as fixed rates. Either way, the entry price is small compared with a ransom demand.

MGM Resorts shows the leverage. Its 2023 attack, widely attributed to Scattered Spider, was reported by researchers to have started with a call to the IT service desk, though MGM has not confirmed how the attackers got in. Its SEC filing estimated a hit of about $100 million to adjusted earnings. Arup is the same story with a better costume: a process trusted what it could see and hear, and the attackers supplied exactly that.

Rung 7: when the attacker shows up in person

If remote routes get too expensive, some attackers come closer. In 2020, Egor Kriuchkov travelled to Nevada to recruit an employee at Tesla’s Gigafactory near Reno, offering a payment put at $500,000 by the judge and $1 million in earlier reports, to plant malware on the company’s network. The employee reported the approach and worked with the FBI. Kriuchkov was arrested and pleaded guilty.

In 2018, four GRU officers parked a rented car beside the headquarters of the Organisation for the Prohibition of Chemical Weapons in The Hague, with Wi-Fi attack equipment in the back under a coat. Dutch intelligence stopped them there. The everyday version is less cinematic: the courier who follows staff through a door, the “printer technician” who needs ten minutes alone with a network port. It also now arrives through hiring. Mandiant reports a median dwell time of 122 days for North Korean IT worker cases, in which the intruder comes in through your own recruitment process and collects a salary.

At this rung the attacker is spending something no botnet risks: personal freedom. In the Tesla case, the control that stopped the plot was an employee who knew the right thing to do and felt able to do it.

Rungs 8 and 9: the top of the market

In October 2021, someone using the name Jia Tan submitted a harmless patch to XZ Utils, a compression library present across Linux. Over more than two years, that persona earned a maintainer’s trust, and in February 2024 it shipped a backdoor that targeted SSH servers. It was caught weeks later, largely by chance, when the engineer Andres Freund looked into SSH logins that were running about half a second slower than they should. That is what a real attacker budget looks like, and it nearly worked.

Zero-days carry an equally clear price tag. In 2024, the exploit broker Crowdfense advertised up to $5 to $7 million for a full-chain, zero-click iPhone exploit. An attacker will not burn an asset like that if a phone call to your help desk would do the job.

AI is a discount on the whole ladder

AI has not added a new rung. It is marking down the existing ones, and the deepest cuts are in expertise and time, the two currencies defenders have relied on most. Attacks that once needed a skilled team can increasingly be run by a small one.

• Operations at machine pace. In November 2025, Anthropic reported that a group it assessed as Chinese state-sponsored had used its Claude Code tool against roughly thirty targets, succeeding in a small number of cases. AI carried out an estimated 80 to 90% of the campaign, with humans stepping in at perhaps four to six decision points.
• Vulnerability discovery. In April 2026, Anthropic said an unreleased model, Claude Mythos Preview, had found thousands of high-severity vulnerabilities and developed many related exploits autonomously. It limited access to defenders through Project Glasswing, while warning that it will not be long before such capabilities proliferate. Both reports come from a vendor with a commercial interest in the subject, but the direction is hard to dispute.
• Malware that asks for help. Google Threat Intelligence Group has documented families such as PROMPTFLUX and PROMPTSTEAL that query large language models during execution to evade detection.
• Impersonation on demand. Arup was two years ago, and the tools have only improved since. Voice phishing’s rise in Mandiant’s data points the same way.
• A growing bill. In IBM’s 2026 Cost of a Data Breach report, more than one in four organisations hit by a malicious attack said it involved AI. Those incidents averaged over $6 million, against a global average of $4.99 million for all breaches.

Keep it in proportion

Mandiant’s frontline view is a useful corrective: “we do not consider 2025 to be the year where breaches were the direct result of AI,” and “the vast majority of successful intrusions still stem from fundamental human and systemic failures.” Anthropic’s own case notes that the model occasionally hallucinated credentials. AI-driven attackers are fast, but they are not magic.

So both things are true. Most breaches today still come through the basics, and the cost of expert-level attacks is falling quickly. That argues for fixing the basics now, while you still have time to do so on your own schedule.

Three assumptions to retire

1. “We are too small to be targeted.” Personalised attacks used to be rationed by the analyst hours they required. As that cost falls, the attention once reserved for large enterprises can be pointed at everyone.
2. “Our patch cycle is good enough.” A 43-day median patch time sits badly against a mean time to exploit of minus seven days. You still need to patch fast, but you also need controls that work while no patch exists.
3. “I would recognise my CFO.” Seeing and hearing someone no longer proves who they are. Any request that moves money, changes credentials or grants access needs verification through a separate, pre-agreed channel.

The discount applies to defenders as well. IBM reports that extensive use of security AI and automation shortened breach lifecycles by 65 days, and against a 22-second hand-off, machine speed in triage and containment is becoming a requirement. Keep humans on the decisions that can hurt the business, and let automation handle the first minutes.

Getting hacked is the start of the fight

If compromise is inevitable, the question that decides your outcome is what happens next. The headline “we were hacked” hides a huge range of results, from one isolated laptop to a company that cannot trade for three weeks. Those results are separated by three capabilities: how early you detect the attack, how well you respond, and how far your controls let it spread.

Earlier, we said that a defender has to hold everywhere while the attacker only needs one success. Inside your network, that asymmetry starts to reverse. A real intrusion is a chain of steps, the idea behind Lockheed Martin’s Cyber Kill Chain and MITRE ATT&CK. The attacker has to get through each step unnoticed to reach the final stage, actions on objectives. You only need to catch one of them, and the earlier you do, the less it costs you.

Detect early, while you still have options

Many organisations still see the attack late, if at all. Mandiant found that 52% of organisations first detected malicious activity internally in 2025, which is an improvement from 43%, but it also means the rest first heard about it from someone outside. IBM puts the average time to identify and contain a breach at 247 days. Ransomware often announces itself at the last stage, so a ransom note is usually the end of a long story you did not read.

Detection needs the same deliberate investment as prevention, and buying a tool is the smallest part of it.

• See the whole path. Cover endpoints, identity, cloud, email and network traffic, and keep logs long enough to reconstruct a 14-day intrusion. A blind spot is where an attacker will end up living.
• Detect behaviour as well as known signatures. Tools change between campaigns, and a zero-day has no signature, but dumping credentials and moving to a domain controller look much the same every time.
• Plant tripwires. Decoy admin accounts, canary files and fake cloud keys have no legitimate use, so any touch is a high-confidence alert. They are among the cheapest detections you can buy.
• Cover the hours attackers prefer. Nights, weekends and holidays are when many intrusions progress, so an alert nobody reads until Monday may as well not exist.
• Test it. Run purple team exercises against the techniques your likely attackers use, and count which ones you caught, how quickly, and which you missed.

Respond with a mature plan and a practised team

Detection only buys you time, and someone has to use it. An alert without a capable response is simply a record of how you lost. This is where a mature incident response function earns its budget: it turns an alarm into containment, eradication and recovery, in the right order and without destroying the evidence you will need. NIST SP 800-61 and the NIST Cybersecurity Framework give you a solid structure to build on.

You can tell a mature IR capability by a few things that are easy to check.

• Named roles with deputies, including an incident commander, and clear links to legal, communications, HR and the executive team.
• Playbooks for the scenarios you actually expect, such as ransomware, business email compromise, cloud account takeover, insider activity and deepfake fraud.
• Authority given in advance, so that responders can isolate a system without waiting for a meeting.
• A retainer with an outside IR firm, with your insurer’s requirements already understood. The first day of a crisis is a poor time to negotiate a contract.
• Regular exercises with executives in the room, plus a blameless review after every incident that feeds new detections and fixes back into the programme.

Speed has a price tag too. In IBM’s 2026 figures, breaches lasting more than 200 days averaged $5.65 million, against $4.32 million for those resolved faster. And decide the hardest things while everyone is calm, because these questions are much harder to answer for the first time during an attack.

• Who has the authority to take a revenue-generating system offline at 3 a.m.?
• How will the response team communicate if email and chat are in the attacker’s hands?
• What is your position on paying a ransom, and who makes that call with legal counsel and your insurer?
• Which regulators, customers and partners must you notify, and how soon?
• What order do systems come back in, and has anyone actually tried it?

Our ransomware response playbook walks through those decisions in detail.

Reduce the blast radius and the gravity

Strong controls still matter once prevention has failed, because they decide how bad the failure gets. They do two jobs: they buy your detection and response teams more time, and they cap the damage if the attacker still gets to act. Consider the same stolen password in two different companies.

How this changes the conversation with the board

“We are secure” may be the most dangerous sentence in a board meeting. It is untrue, it teaches the board to treat security as a finished purchase, and on the day of an incident it turns a business risk into a broken promise. Replace it by changing the questions that leadership asks.

“We cannot promise that we will never be breached, and nobody honest can. We can promise that attacking us will be expensive, that an intruder will be spotted quickly, that no single failure can take the company down, and that we have rehearsed our worst day. Here is what each of those costs, and here is the risk you accept if we do not fund it.”

A board statement you can adapt

Inevitable is not an alibi

This mindset has an obvious way to go wrong. “Everyone gets hacked” must never become cover for neglect. Being hit by a zero-day in a security appliance, then containing it in hours, is a defensible outcome. Being hit through an internet-facing admin panel with a default password, or a known-exploited flaw left open for nine months, is not. Regulators, insurers and courts will know the difference.

Accountability therefore gets sharper. The question moves from “did anything happen?” to three harder ones: was it avoidable, how quickly did we see it, and how far did it get? A CISO can answer for those.

Where to spend first

Work up the ladder in order. The early items are cheap and cut off the largest share of attackers, while the later ones assume that somebody gets through anyway.

1. Close the free rungs. Keep a live inventory of everything internet-facing, take admin ports off the internet and fix known-exploited flaws in days, not weeks.
2. Make stolen passwords worthless. Roll out phishing-resistant MFA such as passkeys or FIDO2 keys, starting with administrators and remote access, and remove legacy authentication.
3. Harden the processes that move money and identity. Require strong identity checks at the help desk, callbacks through a known number, and dual approval for payments. These cost little, and they would have changed the odds in the Arup and MGM scenarios.
4. Shrink the blast radius. Separate admin tiers, segment networks, enforce least privilege and protect the identity provider as your most valuable system. One stolen account should never reach everything.
5. Make intruders noisy. Aim for full EDR coverage and central logs, plant decoy credentials and canary tokens, and test detections against real techniques. Each extra step an attacker takes should be another chance to trip an alarm.
6. Constrain your vendors. Give third parties scoped, time-limited and monitored access, and plan for what you would do if a key supplier were compromised tomorrow.
7. Cover the physical and insider routes. Escort visitors, control access to network ports, verify the identity of remote hires, and give staff a simple, blame-free way to report a strange approach.
8. Buy the ability to survive. Keep immutable backups, rehearse restoring identity systems as well as data, arrange an out-of-band communication channel and put an incident response retainer in place.

Put a number on the price

If cost is the goal, measure it. A red team is best understood as price discovery: do not just ask whether it got in. Ask what it cost, which step was cheapest, and which control forced it to change course.

Five moves for the next 30 days

1. Ask for a price. Have your red team or a trusted partner map the cheapest route to your most important asset, then fund closing that route first.
2. Check the free rungs. Compare your internet-facing inventory with CISA’s Known Exploited Vulnerabilities catalog this week.
3. Test the help desk. With proper authorisation, find out whether a convincing caller can reset a privileged account.
4. Set one callback rule. Any request to move money, change payment details or reset credentials gets verified through a known channel, and nobody is exempt, including the CEO.
5. Rehearse with the executives. Run a 90-minute exercise on a deepfaked CEO followed by ransomware on a Friday night, then take what you learn to the board using the statement above.

What winning looks like now

If winning means never being breached, every CISO eventually loses, usually in public. A better picture of winning is an incident report so dull that it barely reaches the board. An attacker spends weeks and real money to land on one workstation. They try a decoy credential and set off an alert. The team isolates the host before lunch, rotates what was exposed, and writes down what to fix. Customers never hear about it, and the attacker’s investment returns nothing.

You cannot build a safe that never opens. You can decide how much it costs to open it, and make sure someone is there when they try.

Sources

• Mandiant, M-Trends 2026: dwell time, initial infection vectors, time to exploit, hand-off time, AI in intrusions.
• Verizon, 2026 Data Breach Investigations Report: exploitation, third-party involvement, patching.
• Google Threat Intelligence Group, 2025 zero-day review, and its research on AI-enabled malware.
• IBM, Cost of a Data Breach Report 2026, as reported by eSecurity Planet.
• Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign” (2025) and Project Glasswing (2026).
• Rapid7, 2025 Access Brokers Report and its later initial access broker research.
• CNN and RTHK reporting on Arup (2024); MGM Resorts Form 8-K (October 2023).
• Court reporting on United States v. Kriuchkov (2020 to 2021); Netherlands Defence Intelligence and Security Service briefing on the OPCW operation (October 2018).
• Andres Freund, oss-security disclosure of the XZ backdoor (March 2024); Russ Cox, XZ attack timeline; CVE-2024-3094.
• Crowdfense exploit acquisition programme price list (April 2024), as reported by SecurityWeek and Security Affairs.
• Lockheed Martin, Cyber Kill Chain; MITRE ATT&CK; NIST SP 800-61 and the NIST Cybersecurity Framework.
• UL 687 burglary-resistant safe ratings; Winn Schwartau, Time Based Security (1999).