Topic starter
02/08/2026 12:23 pm
TL;DR: Modern cybercrime groups operate with corporate discipline, use social engineering and MFA fatigue to bypass defenses, and exploit the gap between deployed controls and validated controls, according to SafeBreach. The real issue is not tool coverage but whether those controls still work when attackers adapt, rehearse, and persist.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “Lessons from the Dark Web: What Hackers Teach Us about Cyber Resilience”.
Key questions
Q: How should security teams validate that their controls still work against current attacks?
A: Security teams should test live environments against real adversary techniques, not just rely on scan results or past assessments.
Q: Why does MFA fatigue still work against modern identity controls?
A: MFA fatigue works because it targets human decision-making rather than the authentication protocol itself.
Q: What are the signs that control coverage is weaker than it looks?
A: Common warning signs include controls that pass audits but fail in simulations, frequent user approvals of unexpected prompts, inconsistent configuration across environments, and gaps between response playbooks and actual containment behavior.
Practitioner guidance
- Validate controls against live adversary behavior Use adversary simulation to test whether authentication, alerting, and containment controls still work when users are pressured, systems change, or attackers repeat the same tactic.
- Harden MFA against push bombing Add number matching, risk-based prompts, and clear deny paths so users are less likely to approve requests just to stop repeated notifications.
- Review human approval paths as security controls Map where employees can override, approve, or accelerate access and treat those steps as part of the identity control surface, not just service desk convenience.
Bottom line: Cyber resilience fails when teams confuse deployed controls with validated controls, especially where attackers use human psychology to bypass technical defenses.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:23 pm
Attacker psychology is now part of the control plane. Security programs still tend to evaluate controls as if the adversary were static and purely technical. This article shows the opposite: attackers actively shape human decisions, which means controls that ignore user psychology will routinely underperform in the real world. The practitioner conclusion is simple: validate how controls behave under pressure, not only whether they are present.
A question worth separating out:
Q: What should organisations do when controls fail under simulated attack?
A: They should treat the result as a governance issue, not a single tool failure. Prioritise the specific path the attacker used, then adjust identity workflows, response logic, and configuration management so the same pressure does not produce the same outcome again. The fix is to close the exposed decision point, not to add another isolated control.
👉 Read our full editorial: Cyber resilience depends on validating controls against attacker psychology