When the probability of an attack is assessed as so low as to appear almost inconceivable, despite a potentially devastating impact, one of the most dangerous errors is to exclude it from risk scenarios on the grounds that it is unrealistic or unfeasible.
In psychology, denial is a defence mechanism that prevents an individual from confronting a reality perceived as too difficult to accept or manage: an understandable reaction in an ordinary person, but an unacceptable one in any security professional.
This is one of the reasons why many organisations are not prepared to face complex and destructive scenarios. Resilience requires competent professionals with proven incident management experience but, above all, it demands the avoidance of two fundamental errors which, although long recognised, remain highly relevant and risk nullifying defensive efforts.
Vulnerability 1: One Incident at a Time
Flawed assumption: attacks occur one at a time, allowing detection and response teams to concentrate their forces on one event before moving on to the next.
Operational reality: well-funded criminal organisations and state-sponsored groups do not operate in this manner. The main attack unfolds across multiple phases and layers, preceded and accompanied by lower-intensity diversionary actions designed to increase stress and disperse defensive attention and resources. A typical manoeuvre comprises in a typical Soviet fashion: Preparation, Diversion and Attack. With AI models, and frontier models in particular, are enhancing offensive capabilities to the point of enabling the use of extremely fast and efficient multi-agent platforms.
Capability gap: organisations typically size their security teams to handle one, or at most two, concurrent incidents. Even reliance on external support contracts entails activation times that consume decisive time windows, reducing or eliminating containment capability.
Systemic risk: should a multi-layered attack strike critical national infrastructure (energy, telecommunications, financial services, essential services, transport and healthcare), a fire sale scenario [cyber-parlance for Blitz offensive, note of the Editor] would materialise: a coordinated and sufficiently rapid offensive could realistically cause panic among the population and paralyse an entire nation.
Course of action:
- Develop incident detection, analysis and management capabilities that also cover concurrent and interdependent events and multi-layered attacks.
- Replace single, static teams with multiple rotating teams, assigned to other duties in peacetime but ready for immediate mobilisation.
- Establish a small cyber crisis command, also on a rotational basis, capable of coordinating the cyber, ICT, physical security, logistics, legal and external relations components with competence, speed, clarity and composure, as well as supporting senior leadership decision-making.
- Maintain a mature and widely distributed cyber security intelligence network that studies global attack cases and trends in depth and informs the development of realistic training scenarios.
Vulnerability 2: Unprotected Leadership
Flawed assumption: senior executives are often exempted from security measures, so as not to interfere with their day-to-day activities and to avoid repercussions on the careers of those who should enforce them.
Current state: in many organisations, senior leadership does not use strong authentication or periodic password changes, lacks now-essential protections such as privilege segregation, data loss prevention, mobile application security and web filtering, and is almost always excluded from security awareness campaigns. This constitutes a dangerous strategic contradiction.
Threat: the incidents currently most damaging to finances and reputation target senior leadership specifically. CEO fraud and BEC executive impersonation target individuals with very high operational privileges, access to the most critical information and the authority to move substantial sums within very short timeframes: precisely those who receive the least training and the least protection. By the way, political decision makers, exception made for high-security environments (MoD and MoI typically), are exposed to the same risks due to their carelessness.
Evidence: over the past two years, generative AI has made these attacks more sophisticated than ever before:
- Multi-million-dollar fraud against companies such as Arup and Fideuram, together with similar cases observed in Singapore, the United Kingdom, the United Arab Emirates and Switzerland.
- Credentials, sensitive information and customer data stolen from Mandiant/Google, Salesforce, Web3 organisations and the White House.
Evolution of offensive capability: synthetic voice (2019), synthetic voice supported by documentary context (2020), video deepfakes (2022), simultaneous live deepfakes of multiple executives (2024), and impersonation of institutional authorities targeting leading business figures (2025).
Convergence Scenario
The combination of the two vulnerabilities, a defence saturated by concurrent attacks compounded by a compromised leadership, constitutes the ideal precondition for a devastating fire sale offensive. The question, therefore, is not whether an extreme scenario appears probable today, but whether organisations and national structures would be able to manage it should it occur. This is not merely a technical problem, but first and foremost a strategic one: a matter of Command and Control.
Recommendations
- Protection of senior leadership: executive bodies, starting with the Chair and CEO, must be the first to be secured, with measures even more stringent than those applied to staff and with specific training to recognise the attack patterns targeting their role.
- Multi-incident response capability: incident response teams must be sized and trained to handle multiple concurrent attacks, supported by cyber security intelligence for knowledge of adversary techniques and for the definition of simulation and test scenarios. These measures are essential for national cyber security authorities and for all organisations that operate critical infrastructure or contribute to its operation.
