A six person architecture practice in Bilbao lost four days to a wire transfer that never should have left. Nobody was hacked in the way the word suggests. Somebody read a genuine email thread about an invoice, waited, and sent a message from a lookalike domain at the exact moment a payment was expected. The phishing that works is the one that is expected. There was no attachment, no malware and no alarm to raise.
That is why this topic starts with the attacks. A defence chosen without knowing what actually arrives is a purchase, and the shape of what actually arrives is remarkably stable and remarkably unglamorous.
What each layer stops, and what walks past it
Every control has something it is transparent to, and a page that lists only the stopping half is an advertisement. Multi factor authentication is the clearest case. MFA stops credential stuffing and does not stop a stolen session cookie. Once somebody has authenticated, the browser holds a token that says so, and an attacker who obtains that token is inside without ever meeting the second factor. This is not an argument against MFA, which remains the highest value control available for the money. It is an argument for knowing its edge, because that edge is where the practice was actually attacked.
The same honesty applies downward. A password manager removes reuse, which is the attack that genuinely happens at this scale, and does nothing whatever about a person choosing to authorise a payment. Backups survive ransomware and do not survive a fraudulent transfer, because nothing was encrypted and nothing was lost except the money.
Two facts that decide how bad an incident gets
The first is about permissions, and it is routinely explained backwards. Least privilege limits the blast radius, not the likelihood. Giving the office manager rights to approve payments alone does not make an attack less likely; it decides how much is reachable once one account is taken. In Bilbao the objection was that six people who have worked together for a decade should not need separate approval rights, which is a reasonable thing to feel and an answer to a different question. The rights were not a judgement about a colleague. They were a limit on what a stranger holding that colleague's session could reach, and after the transfer they took an afternoon to arrange.
The second is about recovery, and it is the one nobody tests. A backup you have not restored is not a backup. The Bilbao practice had nightly backups running for three years and had never once restored one. When they eventually tried, the drawings restored and the project database did not, because it had been added to the server after the backup job was written and the job named directories explicitly. Nothing had failed. Nothing had been checked either.
The order, and what the certificate teaches
The order that works is the vocabulary, then the attacks, then the defences, then the tools. It is the order the topic is arranged in, and almost everybody does it in reverse, arriving through a tool because a tool is a thing you can download. the vocabulary and the shape of the problem is genuinely first, because the words are used precisely here and a conversation in which risk, threat and vulnerability are interchangeable cannot reach a decision.
Then where systems are actually broken into, which is the part that rearranges people's priorities, because the honest list is dominated by credentials, unpatched software and a person being asked politely. Only after that does the work that actually keeps things standing read as a set of choices rather than a shopping list, and only after that is the standard kit, and what each is for anything other than a menu.
The permission to practise any of this on a system you do not own is not implied, and the distinction is a legal one rather than an ethical preference. Written authorisation, scope and a defined window are what separate the work in testing a system the way an attacker would, with permission from a criminal offence, and the technical activity on both sides of that line is identical.
Both of those sit underneath everything else in the machines, the networks between them, and keeping both standing, because a control that has never been exercised and a permission nobody has reviewed are the two failures that are invisible until the day they are load bearing.
Where people stall
The stall is believing security is a product that gets added. It survives because the market is arranged to encourage it and because buying something is a decision that can be finished, whereas the actual work is patching, removing accounts nobody uses, and rehearsing a restore, none of which ever finishes and none of which is interesting to report to a partner meeting.
The second stall is the cryptography cluster, where people expect to need the mathematics and stop when they meet it. Almost nobody in this field implements a cipher. What is needed is what each primitive guarantees and what it does not: that a hash proves an unchanged file and hides nothing on its own, that signing proves origin and does not conceal, that encrypting conceals and does not authenticate. That is the useful layer of the maths that makes secrecy and proof possible, and it needs no algebra.
What to open, in 2026
A password manager for the whole practice is the single highest value purchase at this size, and Bitwarden has a free tier that is genuinely usable and an open source client. It replaced the shared spreadsheet, and it removes reuse across sites, which is what turns one leaked password elsewhere into an incident here.
Hardware security keys are the strongest available second factor and they resist exactly the lookalike domain attack that took the four days, because the key checks the domain and a person does not. They cost money, they are not free, and saying so plainly matters more than recommending them.
For finding out what is exposed before somebody else does, nmap remains the standard and is free, and it replaced assuming that a service is not reachable because it was not meant to be. Run it against your own address range and read the result as a list of things that will eventually be tried. The certificates that employers ask for are surveyed in the ones employers actually ask for, and the honest note is that they open interviews rather than teach the work.
What none of this answers is who is watching at three in the morning, which is a staffing question before it is a technical one and is where the servers topic picks it up.