IT security

Several, and they work in different ways.

Malware. Viruses, trojans and ransomware infect systems and damage or steal data. Viruses replicate themselves; trojans hide inside harmless-looking programs; ransomware encrypts data and demands payment for the key.

Phishing. Attackers pose as someone trusted to obtain credentials or other confidential information, by an email that looks convincingly like a bank or an authority, or by telephone.

Social engineering. Attackers use human psychology to get around security measures: they build trust in order to manipulate, or mislead people into making a mistake.

Zero-day attacks. Attacks on weaknesses for which no patch exists yet. They are dangerous precisely because no fix is available, and speed of response is what counts.

Ransomware. Attackers encrypt data and demand payment. The cost lands twice: in the payment and in the interruption to operations. If customer data is taken as well, reputational damage comes on top.

Supply chain attacks. Attackers use weaknesses at a supplier. They are hard to defend against, because a company rarely has direct influence over a supplier's security, and because one compromised supplier can reach several companies at once.

Cloud attacks. Cloud environments open attack paths of their own, and their security needs watching continuously rather than once.

Phishing. The attacks keep getting better made, which is why they remain among the largest risks.

A penetration test is a controlled attack on your own systems. Instead of producing a list of theoretical weaknesses, it establishes what an attacker could actually do with them: which systems are reachable from there, which data can be read, how far the path goes.

The value lies in that chain. Single weaknesses are rarely the problem; what becomes dangerous is the combination of several small ones that together make a way in.

Cyber defence is the running operation: detecting attacks, assessing them and stopping them while they happen. It means continuous monitoring of systems and networks, evaluation of events in a SIEM, and a team that reacts to what stands out.

The difference from a penetration test: the test says where the gaps are. Cyber defence says whether someone is going through one right now.

Awareness training teaches people to recognise the attacks that aim at people rather than at technology: phishing mail, manipulated phone calls, a pretext at reception.

It matters because a large share of successful attacks starts there. A firewall can be configured; a convincingly written email to a person who does not read it as an attack goes straight past it.