How attacks actually happen

In this lesson you'll

• Describe the four most common ways attackers get into workplaces
• Explain why ordinary employees, not just IT, are the main target
• Recognize what ransomware and business email compromise look like from the inside

Attackers go where the doors are open

When people picture a cyberattack, they often imagine someone breaking through a firewall with clever code. That happens, but it is not the usual story. Most incidents begin with something far more ordinary: a person is tricked, a password is reused, a system is not updated, or a setting is left open.

Here are the four doors attackers use most often:

Notice that three of the four involve everyday choices by everyday people. That is good news: it means your habits make a real difference.

Two attacks worth knowing by name

Business email compromise (BEC). A criminal pretends to be someone you trust, often an executive or a vendor, and asks for money or data. A classic version: "We changed banks. Please send this month's payment to the new account below." No malware is needed. The FBI's Internet Crime Complaint Center (IC3) recorded about $3 billion in reported business email compromise losses in 2025, second only to investment fraud.

Ransomware. Criminals get into a network (often through a stolen password or a phishing email), copy data, then lock files and systems until a ransom is paid. Hospitals, schools, local governments and manufacturers are frequent targets because downtime is so painful for them.

Why you are the target

Attackers follow the money and the path of least resistance. It is usually easier to fool one busy person than to defeat well-run technical defenses. Criminals study job titles on professional networking sites, read company websites and time their messages for busy moments: month-end close, payroll day, a holiday weekend.

That does not mean you have to become a security expert. It means a few reliable habits, done every time, close most of the doors.

Workplace example: a county finance office

A county accounts payable clerk receives an email that appears to come from a road paving contractor the county really uses. It has the right logo, mentions a real project and asks to update the contractor's bank details before Friday's payment. The clerk notices the request changes where money goes, so she calls the contractor using the phone number already in the vendor file, not the number in the email. The contractor never sent it. One phone call stopped a six-figure loss.

By the numbers (and what they don't tell you)

In 2025 the FBI's IC3 received more than one million complaints for the first time, with about $20.9 billion in reported losses. These figures only include crimes people reported to the FBI, so the real total is higher. You don't need to memorize numbers; just remember that these crimes are common, costly and mostly aimed at people.

Try it

Think about your own job for five minutes and fill in this short table on paper or in a note:

If you use an approved AI tool at work, you can paste this prompt to get ideas. Don't include names or confidential details.

I work as a [job role] in [industry]. List the five most likely ways a criminal
might try to trick someone in my role into sending money, sharing data or giving
access. For each, give one warning sign and one simple way to verify the request.
Keep it under 250 words and use plain language.

Keep your table. You'll use it again in Module 2.

Key takeaways

• Most incidents start with ordinary doors: tricked people, stolen sign-ins, unpatched software and simple mistakes.
• Business email compromise and ransomware are two of the most damaging attacks, and both usually start with a person.
• Criminals research their targets and time requests for busy moments.
• A few habits, done every time, close most of the doors.

Sources

• FBI Internet Crime Complaint Center, 2025 Internet Crime Report (opens in a new tab)
• CISA, Secure Our World (opens in a new tab)