How Attackers Actually Think

You're thinking like a defender.

Most organisations build security by thinking about what they need to protect. They list their assets, categorise their data, implement controls, and write policies. This is sensible, necessary work — but it has a fundamental blind spot.

It's entirely inward-looking. It asks "what do we have?" and "how do we protect it?" — but it rarely asks the question that matters most: "if I wanted to break into this organisation, how would I actually do it?"

That's the question an attacker asks. And the gap between how defenders think and how attackers think is where most breaches live.

Penetration testing exists to bridge that gap. A good pen tester doesn't just run tools against your systems — they adopt the attacker's perspective, think creatively about how to subvert your defences, and demonstrate what a real adversary could achieve. Understanding that mindset is the first step to building defences that actually work.

What makes attackers different.

Attackers don't think in checklists, compliance frameworks, or risk registers. They think in opportunities, paths, and objectives. Their approach is fundamentally creative — they're solving a puzzle, and the puzzle is your organisation.

Here are the mental models that distinguish an attacker's thinking from a defender's:

The pattern is clear. Defenders think about what they've implemented. Attackers think about what's been missed, what's been assumed, and what's been forgotten.

Seven rules attackers live by.

Whether it's a financially motivated criminal gang, a state-sponsored APT group, or an opportunistic script kiddie, effective attackers share a set of operating principles. Understanding these helps explain why breaches succeed — and where defensive strategies most often fail.

How an attack actually unfolds.

Attacks aren't single events — they're journeys. Every successful compromise follows a progression, from initial research to final objective. Understanding this progression is essential for both pen testers (who simulate it) and defenders (who need to detect and interrupt it).

The most widely-used model for describing this progression is Lockheed Martin's Cyber Kill Chain, often supplemented with the more granular MITRE ATT&CK framework. Here's what the journey looks like in practice — not from a textbook, but from the attacker's perspective.

The critical insight for defenders: every phase is a detection opportunity. You don't have to stop the attacker at the perimeter. If you can detect and respond at any point in the chain — reconnaissance, delivery, lateral movement — you can disrupt the attack before the objective is achieved.

A realistic attack scenario.

Theory is useful, but a concrete example makes the attacker mindset tangible. Here's a realistic scenario — a composite drawn from patterns we see regularly in our pen testing engagements.

The target is a mid-size professional services firm. 300 employees, Microsoft 365, Azure AD, on-premises file servers, and a customer-facing web portal.

Every step in that scenario used legitimate tools, known techniques, and exploited predictable human behaviour. No zero-days. No custom malware. No genius-level hacking. Just patience, methodology, and an understanding of how organisations actually work.

This is exactly what a penetration test simulates — and exactly what a vulnerability scan would never have found.

It's not what you think.

Organisations tend to protect what they consider valuable — the production database, the financial systems, the customer portal. Attackers target something different: whatever gives them leverage.

The target isn't always the crown jewels. Often, it's the stepping stone to the crown jewels — the system, account, or relationship that provides the access or privilege needed to reach the real objective.

This is why threat modelling — thinking about who would attack you, what they'd want, and how they'd get it — is more valuable than simply listing your assets and ticking compliance boxes.

Know your adversary.

Not all attackers are the same. Their motivations, capabilities, and patience levels vary enormously — and your defences should be calibrated to the threats most relevant to your organisation.

Your penetration testing programme should reflect the adversaries most likely to target your sector and organisation. A small e-commerce business faces different threats to a defence contractor. The testing should be calibrated accordingly.

How this shapes effective pen testing.

Understanding the attacker mindset isn't just academically interesting — it directly determines the quality and value of a penetration test. A pen tester who thinks like an attacker will find fundamentally different things than one who follows a checklist.

The difference isn't in the tools — it's in the thinking. Both testers have access to the same technology. The attacker-minded tester uses those tools in service of a larger question: what is the worst realistic thing I can achieve with the access I've gained?

How to use attacker thinking in your defence.

You don't need to become a hacker to benefit from attacker thinking. But you do need to regularly ask yourself the questions an attacker would ask — and be honest about the answers.

The bottom line.

Attackers succeed not because they have better tools, but because they think differently. They look for what's been missed, chain small weaknesses into big compromises, target people as readily as technology, and adapt constantly to the defences they encounter.

Effective penetration testing embodies this mindset. A good pen tester doesn't just scan for vulnerabilities — they think like an adversary, act like an adversary, and show you what an adversary could achieve. The result isn't just a list of findings. It's a genuine understanding of your risk.

The best defence isn't a bigger wall. It's understanding how the people trying to get over, under, around, and through that wall actually think — and building your strategy accordingly.