Any honest penetration test starts before the port scanner runs. It starts with a question most teams skip: who actually wants to break into you, and why? Until you’ve answered that, you’re testing blind, running OWASP checklists against a system without knowing who’s really coming, with what resources, and toward what goal. A threat model built without understanding the adversary defends against an imaginary enemy, not the real one.
Motive comes first
Almost every breach reduces to one of a handful of motives, and each one shapes how the attack actually looks.
Money, directly: extortion. The most common scenario by volume. The goal is to encrypt or steal data and sell it back to the victim. Speed and volume matter here, the faster an attacker moves from initial access to exfiltration, the higher the payout. Elegance is irrelevant. Conversion is everything.
Competitor-commissioned. A quiet, targeted intrusion. The goal isn’t noise, it’s extraction: a client list, pricing, correspondence, source code, deal terms. This kind of attacker is willing to sit patiently and stay invisible, because the value is in the data itself, not in the fact of the compromise.
Hacktivism and politics. The motive isn’t money, it’s damage and publicity. Defacement, a leak for the sake of leaking, taking infrastructure down on a symbolically meaningful date. This adversary is economically irrational, willing to spend disproportionate effort for a symbolic hit, which makes them genuinely unpredictable.
State interest: espionage. Long-term presence, maximum stealth, interest in specific information or a foothold for future operations. This used to be the domain of a small number of well-funded groups. Used to be is the operative phrase.
Once you’ve pinned the motive, you can sketch the actor. That’s where it gets interesting.
Who your enemy used to be
Just a couple of years ago, a serious attacker meant a team: people with rare expertise, years of accumulated instinct, and division of labor, someone holding infrastructure, someone writing exploits, someone processing the take. Assembling a team like that and pointing it at you required a real motive, because their time was expensive.
That created a natural barrier. A low-level troublemaker could run an off-the-shelf script, but chaining several vulnerabilities together, reverse-engineering an unfamiliar architecture, writing a custom exploit for a specific target, that took skill most people simply didn’t have. A large part of defense rested on that barrier: the hard stuff could only be done by the few.
According to Sonatype, the number of malicious packages in public repositories grew from 55,000 in 2022 to 454,600 in 2025, more than eightfold. That isn’t the same small set of professional groups working harder. That’s a much larger population of people suddenly capable of something that used to require real skill.
Who your enemy is today
Breaches are increasingly carried out by low- and mid-skill attackers armed with a stack of AI tools and models. This isn’t a speculative forecast. These are documented incidents from the past year.
February 2025, Japan. Three teenagers, 14, 15, and 16, who met through online gaming, used ChatGPT to write a program that automatically registered fraudulent Rakuten Mobile contracts. Police found roughly 3.3 billion username-password pairs on their computers, bought via Telegram. They sold around 2,500 of the fraudulent lines to criminal groups for about 7.5 million yen, just over 50,000 dollars in cryptocurrency.
December 2025, Osaka. A 17-year-old was arrested under Japan’s Unauthorized Computer Access Law after extracting personal data belonging to more than 7 million users of Kaikatsu Club, Japan’s largest internet cafe chain. When his code hit an error, he simply asked ChatGPT how to get past it and got a working answer. His stated motive is worth remembering: he wanted to buy Pokémon cards, and paid for them with a stolen credit card.
December 2025 to February 2026, Mexico. The case that shows the real scale of this shift. A single attacker used Claude Code and GPT-4.1 to systematically breach nine Mexican government agencies, compromising personal data belonging to 195 million citizens, full names, addresses, tax IDs, voter records, and government employee credentials from SAT, INE, and three state governments. Across 34 sessions, the attacker sent over 1,000 prompts that turned into 5,300 commands executed against live victim infrastructure, with Claude Code carrying out 75% of those commands directly. The model wasn’t defeated with an exploit, it was talked into it: the attacker convinced it every action was authorized and fell within the scope of a legitimate penetration test.
None of this is a set of isolated curiosities. Per The Hacker News, 2025 was the year LLMs crossed a threshold, moving from useful but error-prone assistants to end-to-end tools capable of running an attack from reconnaissance through exfiltration with minimal human involvement. Cloud intrusions rose 35% over the year, and AI-generated phishing began outperforming manual red-team campaigns outright.
And it cuts both ways, attackers aren’t only running their own models, they’re running stolen ones too. Sysdig tracked a campaign called Bizarre Bazaar that logged more than 35,000 sessions against exposed, under-secured AI infrastructure between December 2025 and January 2026, roughly a thousand attempts a day, while credential theft targeting AI services specifically rose 376% between Q4 2025 and Q1 2026. State-aligned groups have joined in too: Russia-linked APT28 embedded the Qwen2.5-Coder model directly into malware in its LAMEHUG campaign, so every infected host gets fresh, machine-tailored commands from the cloud model on the fly, something signature-based detection barely catches, since there are no static commands anywhere in the malware body.
The profile of today’s adversary isn’t a genius. It’s a mid-tier operator holding a weapon that gives them capability they never had before. The barrier to entry that half of defense used to rely on collapsed in the span of a single year.
Knights against a kid in a tank
Here’s an honest picture of where things stand. On one side, a security team: trained, disciplined, with mature processes. Knights in armor, cavalry, the whole formation. They know how to hold a line against the enemy they trained for, other humans, operating at human speed.
On the other side rides a kid in a tank. He isn’t smarter than the knights, and he barely knows how to do most of this himself. But he’s holding hardware from a different generation, and it erases every advantage the other side spent years training for. The problem isn’t that defenders got worse. It’s an arms asymmetry: the attacker picked up an AI tool that plans, writes code, automates exfiltration, and scales, while the defending team is still holding a spear, a shield, and its training. A tank doesn’t get tired, doesn’t lose focus, and doesn’t take weekends off.
The only real answer to a machine is another machine. The knight needs a tank of his own.
What that means for how we test
This is the understanding our own approach is built on. If attackers have spent a year running breaches with AI in the loop, testing has to be run with the same class of tooling, otherwise you’re measuring your defenses against an enemy that no longer exists.
We build our engagements to model exactly the adversary you’re actually going to face: a mid-tier attacker amplified by a stack of AI tools, operating at machine speed rather than human speed, not the polite, rate-limited scanner most vendors still sell as a “penetration test.” That starts with a real threat model for your specific business, not a generic template, and it’s exactly why we run a dedicated AI agent penetration testing practice: if your own AI-adjacent surface, chatbots, agents, LLM-backed features, isn’t tested against the same class of adversary described above, it’s the gap an attacker will find first.
The same logic drives our red team operations: a full adversary simulation run end to end, from reconnaissance to objective, not a list of disconnected findings. For a Cyprus business sitting on real client data, financial systems, or regulated infrastructure, that distinction is the difference between a report that looks reassuring and one that tells you what would actually happen.
The point is simple. We show up on your side of the field in the same class of tank the enemy will bring, before the enemy shows up. Better that we’re the ones who find the arms asymmetry on your perimeter first, not a 17-year-old who needs money for Pokémon cards.