The Persistent Threat

Reading time ~12 minutes · No technical prerequisites · Day 1, Module 1.1

This programme rests on a single strategic premise: serious adversaries do not attack you once and withdraw. They campaign against you persistently. They are in contact with your organisation, your people, and your information today, and they intend to remain in contact indefinitely. Everything else in the next three days — every control category, every decision framework, every hard rule — follows from taking that premise seriously.

From deterrence to persistence

Most senior leaders inherited a mental model of conflict built on deterrence: an adversary contemplates an attack, weighs the likely punishment, and is dissuaded. That model assumes attacks are discrete events, that the attacker can be identified, and that there is a pause between rounds in which costs can be imposed. In cyberspace, none of those assumptions hold reliably. Operations are continuous, attribution is slow and contested, and there is no natural pause. An opponent who is patient and always present is not deterred by the threat of a response that may never be attributable.

The more useful frame is persistence. The advantage goes to whichever side sets and exploits favourable conditions first, and keeps doing so. This is the core of what scholars call Cyber Persistence Theory, but you do not need the academic apparatus to use it. You need the shift in default assumption: instead of asking "are we under attack?", assume you are always in contact and ask "where is the adversary gaining ground right now, and what is it costing them?"

Conflict as overlapping campaigns

A state-level opponent does not run an attack; it runs overlapping campaigns that reinforce one another. Espionage quietly collects on your decisions and your people. Disinformation shapes what your public — and sometimes your own staff — believe. Supply-chain pressure reaches you through the vendors and managed-service providers you already trust. Disruption operations degrade your ability to see clearly and decide in time. These are not separate problems to be defeated one at a time by separate teams. They are coordinated against the same target, and that target, increasingly, is the decision-maker rather than the network.

Four things that get lumped together

Leaders routinely collapse four very different threats into one word — "cyber" — and then fund defences against the wrong one. It is worth holding them apart:

• Cybercrime seeks money. It is opportunistic and high-volume, and good hygiene stops most of it.
• Espionage seeks knowledge. It is patient and quiet, and its goal is to remain undetected for years.
• Destructive operations seek damage. They want a visible effect, often timed for maximum impact.
• Strategic targeting seeks advantage. It is persistent, multi-vector, and aimed squarely at decision-makers.

As a leader, you are most exposed to the last two — yet most organisational spending defends against the first. Recognising that mismatch is one of the most valuable things you can do with a security budget.

Lessons from Ukraine

The Russia–Ukraine war is the defining modern example of sustained executive targeting under fire, and it is the running case study for this programme. It also produced several counter-intuitive lessons in resilience that recur throughout the next three days:

• Privacy as counter-collection. Denying an adversary the small fragments it needs to build a targeting picture is a national-defence act, not a personal preference. We treat it as a discipline in Day 2.
• Vulnerability disclosure as hardening. Finding and fixing weaknesses in the open, with a security-literate community, beats maintaining the comfortable fiction that you are already clean.
• Community as capability. A mobilised, security-aware workforce is a genuine force multiplier — and its absence is a genuine vulnerability.

The "offence death cycle": raising the adversary's cost

You will not make your organisation impossible to attack, and any vendor or adviser who promises that is selling you a comfortable half-truth. What you can do is make yourself expensive, slow, and noisy to attack: every time the adversary comes into contact, it costs them more, takes them longer, and gives you more chances to see them. Over time, that turns a soft target into one that is simply not worth the effort relative to the alternatives — and it means that when a compromise does happen, you are positioned to survive it and learn from it rather than be surprised by it.

The goal is not "keep them out forever." It is to make every move the adversary makes cost them more than it costs you, and to ensure you can see them while they make it.

Anatomy of an intrusion against a principal

The lesson's demonstration walks a sanitised intrusion against a senior official, mapped to a recognised attack framework (MITRE ATT&CK). The shape is worth internalising because it is so ordinary. It begins with reconnaissance — open-source collection on the principal and their staff. It proceeds to resource development — a lookalike domain and a tailored lure. Initial access comes not by breaking a firewall but by spear-phishing an assistant. Credential access follows, often by relaying a one-time passcode in real time, defeating legacy multi-factor authentication. And it ends in collection and exfiltration — the mailbox, calendar, and contacts quietly copied.

Two facts about that sequence should stay with you. First, the adversary used your valid login, not malware, so antivirus had nothing to detect. Second, most organisations first notice at the very last stage, long after the cheap, decisive moves were made. The cheapest place to have stopped it was before it started, by denying the reconnaissance fragments that made targeting possible — a control that is overwhelmingly behavioural, not technical.

Three half-truths to retire

When you hear any of the following from your own organisation, treat it as a prompt to ask the next question rather than as reassurance:

• "We have antivirus." It stops commodity malware and is largely irrelevant to a patient operator using your own credentials.
• "IT owns cyber." The decisions that actually matter — risk acceptance, budget, classification, crisis authority — are yours, not IT's.
• "We passed an audit." An audit is a snapshot against a checklist. Your adversary is a live, adaptive opponent, not a checklist.