This is a result of basic mechanics: “When one object exerts a force on a second object, the second one exerts a force on the first that is equal in magnitude and opposite in direction.” In cyber, it means that when defenses get stronger, attackers get more sophisticated; and when attackers get more sophisticated, defenses get stronger. It is action versus reaction ad infinitum – with cybercriminals currently holding the ascendancy.

(We are excluding adversarial nation-state activity from this discussion. See Cyber Insights 2022: Nation-States for information on the nation threat. It is worth noting, however, that the demarcation between cybercriminal and nation state actors is not always simple, with some actors having a foot in both camps.)