Adversary Psychology and the Modern Cybercrime Economy
A masterclass on how modern cyber criminals think, decide, and operate. Participants develop a working model of the adversary — their motivations, patience, risk calculus, and the psychological levers they rely on against the workforce. Covers the economic shift from software exploitation to identity attacks, the six behavioral levers that underpin virtually every successful social-engineering campaign, the specialization and criminal markets that drive modern cybercrime, and the feedback loop by which attackers learn from defender behavior. Part of The Human Factor Masterclass Series.
What you'll learn
- Reason about adversary behavior as the output of rational, patient, risk-aware decision-making, rather than as the output of personal malice or technical sophistication.
- Explain why modern adversaries have shifted from software exploitation to identity attacks, using the economic framework of attacker cost and expected return.
- Identify and name the six behavioral levers — urgency, authority, reciprocity, scarcity, social proof, and commitment — that underpin virtually every successful social-engineering campaign.
- Audit your organization's public footprint through adversary eyes, and prioritize reconnaissance-reduction efforts by what the adversary actually values.
- Understand the division of labor in modern cybercrime — specialization, markets, and trust mechanisms — and the implications for defender strategy and attribution.
- Recognize the adversarial feedback loop by which attackers test, iterate, and learn from defender behavior, and use the loop to inform your own detection and response investments.
Requirements
- Appropriate for CISOs, SOC leads, threat-hunting program owners, incident-response team members, risk officers, and senior analysts responsible for reasoning about adversary behavior.
- No prerequisite courses; completion of CS-210 (Ransomware & Service Continuity) provides useful operational context.
- Audio or captions enabled so you can follow the narrated video for each module.
Course content
7 chapters · 6 lectures · 1h 27m total
Module 1 — The Adversary as a Rational Actor
The foundational frame of the course: the adversary modeled as a rational actor pursuing goals under constraints rather than as a figure of random malice. Four observations — patience, risk calculation, impersonality, and adaptation — that reframe how a program reasons about defense.
1 item
Module 1 — The Adversary as a Rational Actor
The foundational frame of the course: the adversary modeled as a rational actor pursuing goals under constraints rather than as a figure of random malice. Four observations — patience, risk calculation, impersonality, and adaptation — that reframe how a program reasons about defense.
-
The Adversary as a Rational Actor Free preview14 minutes
Module 2 — The Economics of Identity Attacks
Why modern adversaries have shifted from software exploitation to identity attacks. Three cost curves — rising exploitation cost, collapsing credential cost, and consolidation of authentication into a single identity provider — that explain the shift as a predictable response to economics, with the organizational and budget consequences that follow.
1 item
Module 2 — The Economics of Identity Attacks
Why modern adversaries have shifted from software exploitation to identity attacks. Three cost curves — rising exploitation cost, collapsing credential cost, and consolidation of authentication into a single identity provider — that explain the shift as a predictable response to economics, with the organizational and budget consequences that follow.
-
The Economics of Identity Attacks15 minutes
Module 3 — The Six Behavioral Levers
The six behavioral levers — urgency, authority, reciprocity, scarcity, social proof, and commitment — that underpin virtually every successful social-engineering campaign against a workforce. How the levers combine in production operations and the procedural defenses that interrupt the sequence.
1 item
Module 3 — The Six Behavioral Levers
The six behavioral levers — urgency, authority, reciprocity, scarcity, social proof, and commitment — that underpin virtually every successful social-engineering campaign against a workforce. How the levers combine in production operations and the procedural defenses that interrupt the sequence.
-
The Six Behavioral Levers15 minutes
Module 4 — Reconnaissance and Target Selection
The quiet weeks of research that precede any serious social-engineering operation. The three layers of adversary reconnaissance — infrastructure, people, and relationships — and the four strategic approaches a program can use to reduce the operational value of its public footprint without pretending the footprint can be hidden.
1 item
Module 4 — Reconnaissance and Target Selection
The quiet weeks of research that precede any serious social-engineering operation. The three layers of adversary reconnaissance — infrastructure, people, and relationships — and the four strategic approaches a program can use to reduce the operational value of its public footprint without pretending the footprint can be hidden.
-
Reconnaissance and Target Selection14 minutes
Module 5 — Specialization and Criminal Markets
The division of labor in modern cybercrime: six specializations — initial-access brokerage, payload development, operation, laundering, infrastructure, and victim intelligence — traded on markets with their own prices and trust mechanisms. What that means for attribution, for capability assessment, and for defender investment strategy.
1 item
Module 5 — Specialization and Criminal Markets
The division of labor in modern cybercrime: six specializations — initial-access brokerage, payload development, operation, laundering, infrastructure, and victim intelligence — traded on markets with their own prices and trust mechanisms. What that means for attribution, for capability assessment, and for defender investment strategy.
-
Specialization and Criminal Markets15 minutes
Module 6 — The Adversarial Feedback Loop
The feedback loop by which adversaries and defenders learn from each other, and the implications for program planning and measurement. Why controls have half-lives, where to look for leading indicators of adversary adaptation, and how to measure a program's effect on the adversary rather than only its internal operation.
1 item
Module 6 — The Adversarial Feedback Loop
The feedback loop by which adversaries and defenders learn from each other, and the implications for program planning and measurement. Why controls have half-lives, where to look for leading indicators of adversary adaptation, and how to measure a program's effect on the adversary rather than only its internal operation.
-
The Adversarial Feedback Loop14 minutes
Final Assessment
A 12-question scenario-based assessment on adversary psychology. Scenarios test the reasoning frameworks of the course, not recall. You need 80% or higher to pass and earn your completion certificate. Unlimited retakes.
1 item
Final Assessment
A 12-question scenario-based assessment on adversary psychology. Scenarios test the reasoning frameworks of the course, not recall. You need 80% or higher to pass and earn your completion certificate. Unlimited retakes.
-
Final Assessment — Adversary Psychology and the Modern Cybercrime Economy