Defend Against Real Threats

The threat library is sequenced by the empirical breach record, not by what a vendor wants to sell. Phishing leads because it remains the dominant initial-access vector in the Verizon DBIR series. Ransomware follows because it carries the highest single-incident cost and has shifted from opportunistic to vendor-impersonation since 2023. Business email compromise sits beside ransomware in dollar exposure and is still the top FBI IC3 loss category. Social engineering is the parent abstraction; the named groups (Scattered Spider, 0ktapus, FIN7, TA453) all live inside it.

Deepfake and AI prompt injection are newer, but the public-disclosure curve is steep. The 2024 Arup $25 million case redefined the threat for finance and treasury teams. Microsoft 365 Copilot, Slack AI, and Bing Chat have all shipped post-disclosure mitigations for prompt-injection chains that exfiltrated data without a click. We surface both pillars because the defensive controls (verification reflex, agent permission scoping, retrieval allowlisting) are still maturing in most enterprises and need explicit training programs rather than ad-hoc memos.

Each pillar follows the same structure: definition, attacker workflow, real cases with named victims, the defense framework, and the exact training scenarios from the 100+ exercise catalogue that drill the human side. Sources are listed at the end of every pillar so security leaders can cite the same primary research the page does: CISA advisories, FBI joint cybersecurity advisories, NIST publications, IBM and Sophos threat reports, OWASP LLM Top 10, and the Verizon DBIR.