Lesson 01 — The Persistent Threat

Lesson 01 · Slide 1

Lesson 01 — The Persistent Threat

Why serious adversaries do not "attack" you once — they campaign against you continuously — and why static, audit-driven defence loses by default.

Day 1 Audience: All leaders No technical prerequisites

Notes: Opening session of the programme. Set the frame: this is not about a single breach, it is about being in constant contact with an opponent who never stops. Keep it strategic; the technical depth arrives in the demo.

Lesson 01 · Slide 2

What you will take away

A persistent-campaigning lens — the default mindset for every decision that follows in this programme
Why "deterrence" is the wrong model — and what replaces it when the adversary is always in contact
Why being a partner or ally puts you in scope — you inherit someone else's adversary
How a real intrusion against a principal unfolds — step by step, mapped to a recognised framework

Notes: Reveal one at a time so the room commits to each idea before the next. These four map to the lesson's four movements.

Lesson 01 · Slide 3

Cyber Persistence Theory — the executive lens

The strategic idea underneath this entire programme: in cyberspace, advantage comes from initiative and constant contact, not from threatening punishment.

Deterrence thinking

"If they hit us, we make them pay." Assumes discrete attacks, clear attribution, and a pause between rounds.

Persistence thinking

"They are already in contact, every day." Advantage goes to whoever sets and exploits conditions first — continuously.

Notes: Cyber Persistence Theory (Fischerkeller, Goldman, Harknett). You do not need the citation in the room, but you need the shift: from episodic to continuous.

Lesson 01 · Slide 4

Conflict as persistent campaigning

A state-level opponent does not run "an attack." It runs overlapping campaigns, indefinitely, across:

Espionage — quietly collecting on you, your people, and your decisions
Disinformation — shaping what your public and your own staff believe
Supply-chain pressure — reaching you through vendors and managed services you trust
Disruption of decision-making — degrading your ability to see clearly and act in time

Notes: The point: these are not separate teams you can defeat one at a time. They reinforce each other against the same target — you.

Lesson 01 · Slide 5

You are inside someone else's war

Partners, allies, suppliers, and adjacent institutions sit inside the extended target surface of a state campaign. You can be targeted not for what you did, but for who you stand next to.

Implication for the room

Your threat model is not "who is angry at us." It is "whose objectives are served by reaching what we hold, or by reaching someone through us."

Notes: This is where allied/partner organisations often underestimate their exposure. Make it personal to the hosting body.

Lesson 01 · Slide 6

Four things people lump together — and shouldn't

Category	Goal	What it means for you
Cybercrime	Money	Opportunistic; volume; often stoppable with hygiene
Espionage	Knowledge	Patient, quiet, wants to stay undetected for years
Destructive ops	Damage	Wants visible effect; timed for impact
Strategic targeting	Advantage	Persistent, multi-vector, aimed at decision-makers

Defences that stop the first do little against the last. Conflating them is how budgets get misallocated.

Notes: Leaders are most exposed to the right-hand columns, but most spending defends the left. Name that gap.

Lesson 01 · Slide 7

Lessons from Ukraine's "strange campaigns"

The defining modern example of sustained executive targeting under fire also produced counter-intuitive lessons in resilience:

Privacy as counter-collection — denying fragments is a national-defence act, not a personal preference
Vulnerability disclosure as hardening — finding and fixing in the open beats pretending you are clean
Community as capability — a mobilised, security-literate workforce is a force multiplier

Notes: The Russia–Ukraine war is the running case study for the programme. These three lessons recur in later modules — flag them now.

Lesson 01 · Slide 8

The "offence death cycle"

You will not make yourself impossible to attack. You can make yourself expensive, slow, and noisy to attack — so the adversary's cost rises every time they come into contact.

The goal, stated plainly

Not "keep them out forever." Rather: make every move they make cost them more than it costs you, and make sure you see them while they make it.

Notes: This reframes "we got breached" from failure to an expected event you are positioned to survive and exploit. Sets up Day 3's resilience theme.

Lesson 01 · Slide 9

Three comfortable half-truths

"We have antivirus."

Stops commodity malware. Irrelevant to a patient operator using your own valid credentials.

"IT owns cyber."

The decisions that matter — risk, budget, classification, crisis authority — are yours, not IT's.

"We passed an audit."

An audit is a snapshot against a checklist. Your adversary is a live opponent, not a checklist.

Notes: When you hear any of these from your team, treat it as a prompt to ask the next question — not as reassurance. This is the recognise-a-half-truth skill in miniature.

Lesson 01 · Slide 10

Demonstration — an intrusion against a principal

We will now walk a sanitised, end-to-end targeted intrusion against a senior official, one stage at a time, mapped to the MITRE ATT&CK chain. Press → to advance the chain.

Sanitised No live malware Illustrative only

Notes: Reassure the room: nothing here is operational. The value is seeing how cheaply the early stages are achieved and how late most organisations notice.

Lesson 01 · Slide 11

The kill-chain, one stage at a time

Recon
OSINT on the principal & staff → Resource Dev
Lookalike domain, lure → Initial Access
Spear-phish the assistant → Credential Access
OTP code relayed in real time → Collection & Exfil
Mailbox, calendar, contacts

Notice: the adversary used your valid login, not malware. Antivirus never had anything to detect.

Notes: Reveal node by node. Pause on Credential Access to note OTP MFA was defeated by real-time relay — this sets up Lesson 04's phishing-resistant auth. The red node is where most orgs first notice — far too late.

Lesson 01 · Slide 12

Ask the room: where was the cheapest place to have stopped that intrusion?

A. Every later stage is more expensive and less certain than the last. Counter-collection — denying the fragments that make targeting possible — is the cheapest, highest-leverage control, and it is mostly behavioural, not technical. We return to it in Day 2.

Notes: Let them vote by hand first, then click to reveal. The instinct is "firewall" or "DLP"; the lesson is that the leverage is upstream and human.

Lesson 01 · Slide 13

Think · pair · share

Take 90 seconds. Turn to the person beside you and name one fragment about you that is public right now and would help the adversary at the Recon stage.

Notes: Start the timer. The discomfort is the point — most will name their own calendar, travel, or a public bio. Harvest two or three answers before moving on.

Lesson 01 · Slide 14

Where this leaves us

The adversary is persistent — plan for contact, not for a single event
You are in scope because of who you are and who you stand next to
The cheapest defences are upstream and behavioural — denying fragments, raising cost
Comfortable reassurances are prompts to ask the next question

Lesson 02 — how to consume threat intelligence and attribution claims critically, so you act on evidence, not theatre.

Notes: Close by restating the four takeaways from slide 2 — now earned rather than asserted.