Adriel T. Desautels, the founder and CEO of Netragard, is a Red Team pioneer with over 20 years of experience.
The first article in this series explained why cybersecurity spending so often fails to prevent damage. The Maginot Line was the right analogy: a historic lesson in building impressive defenses against the wrong intelligence. Companies make the same mistake when they fund visible, comprehensive-sounding controls that do not reflect how attackers actually operate.
This article explains how contextualized threat intelligence turns security spending into threat-informed defenses that prevent damage. The difference between appearance and reality is the difference between a cardboard shield and the real thing.
Damage Prevention Is Attainable; Breach Prevention Isn’t
Every security vendor markets its technology as best of breed, yet most tools are temporary mitigations until threat actors exploit or bypass them. Real security comes from damage prevention, not breach prevention.
Organizations usually learn how to build threat-informed defenses only after a breach. The postmortem reveals how attackers entered, moved and achieved their goals. That knowledge, applied to your business, is contextualized threat intelligence, and it is the key to effective security.
The real question is, would you rather suffer a breach at the hands of malicious actors or at the hands of an expert offensive security team you can trust?
A Real-World Example
A threat actor calls the helpdesk impersonating a key employee who left his devices behind during a family emergency. The helpdesk falls for the con and helps enroll the attacker’s personal device into MFA. When stolen credentials fail, the attacker calls back, claims an urgent deadline and pressures the engineer into setting a temporary password. Minutes later, the attacker can log in.
With that access, the attacker reaches a Citrix endpoint and finds open browser sessions authenticated to Microsoft and AWS with administrative privileges. The result is an irrecoverable compromise. We know this works because we did it during an engagement.
The Contextualized Threat Intelligence
The breach scenario exposes several attack disruptors—simple changes that would have broken the chain without adding new technology:
• Authentication: Require users to authenticate before helpdesk support is provided.
• Change Notification: Notify account owners by text and email when account changes occur.
• Login Notification: Alert account owners when authentication succeeds from a new or suspicious context.
The attack triggered no meaningful events because it relied on expert social engineering and living off the land. With those three disruptors in place, it would have failed.
Obtaining Contextualized Threat Intelligence
Threat actors behave like malicious red team operators, but red teaming should not be confused with genuine penetration testing. Red team operations are objective-focused: They prove whether one path can reach one goal. That is valuable, but it rarely shows all the ways an organization can be compromised.
Genuine penetration testing provides broader coverage across the targeted scope. Its value is in the attack disruptors delivered in the final report. This is the foundation of our company’s Real Time Dynamic Testing (RTDT) methodology: realistic testing designed to reveal paths to compromise and the defenses that would stop them. Red teaming and penetration testing are both useful, but they answer different questions.
What Cybersecurity Readiness Looks Like
Cybersecurity readiness is not a posture claimed through tools, checklists or assumptions. It is an operational state built on threat intelligence specific to your organization. You are ready when four things are true:
1. You know how attackers can get in. Not generally, but specifically: the credentials, misconfigurations, exposed devices, third-party trust and human paths that create access.
2. You know what can hurt the business. Not abstractly critical systems, but the assets whose compromise would trigger regulatory, competitive, financial or operational damage.
3. Your assumptions are tested. You do not infer security from vendor claims or compliance checklists. Skilled operators recently attacked the environment and showed what worked.
4. You have a framework that drives improvement. Each test informs the next investment. Disruptors are deployed, playbooks are exercised and defenses improve as weaknesses are removed.
AI-driven attacks increase the speed and scale of intrusions, making contextualized threat intelligence more important, not less. Ironically, AI often behaves like a novice script kiddie: loud, obvious and armed with the knowledge of the internet. If AI compromises an organization, the real failure is usually weak baseline security. Passing an AI penetration test does not prove strong security; it only proves the organization can stop something as conspicuous as a one-man marching band.
Frequent Questions I Hear From Business Leaders
• What is a cyber risk management strategy? A practical plan for reducing the risks that can damage the business, grounded in contextualized threat intelligence and realistic testing.
• Is a breach inevitable? Intrusions may be inevitable; damage is not. The goal is to disrupt attack paths before they become business-impacting compromises.
• How is real penetration testing different from scanning? A scan lists known issues. A genuine penetration test shows which weaknesses matter, how they combine and which disruptors would stop an attacker.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?