Webinar Description
Key Takeaways
- Explores the economic motivations driving cybercriminal target selection
- Examines ransomware economics, credential theft markets and initial access broker operations
- Provides defensive strategies to reduce organisational attack surface
- Relevant for IT managers, security engineers, CISOs and managed service providers
- Covers Zero Trust principles, endpoint protection and privileged access management
Understanding Why Attackers Choose Their Victims
ThreatLocker presents a webinar examining the business logic behind cyberattacks and what makes certain organisations more appealing targets than others. Designed for IT professionals and security practitioners, the session addresses a fundamental question that often goes unexplored: why do cybercriminals select specific victims, and how can defenders use that knowledge to their advantage?
The timing is particularly relevant as ransomware operations have matured into sophisticated criminal enterprises with clear economic models. Understanding these models has become essential for organisations seeking to allocate security resources effectively rather than simply reacting to the latest threat headlines.
About This Event
The webinar, titled “What Makes You a Target? Lessons from the Cybercrime Economy,” is led by ThreatLocker CEO Danny Jenkins and Lead Cybersecurity Engineer Kieran Human. The live virtual session combines strategic insight with tactical guidance, offering attendees both conceptual frameworks for understanding attacker behaviour and practical steps they can implement immediately.
Downloadable resources accompany the presentation, providing reference material for security teams to apply the concepts within their own environments.
The Economics of Cybercrime
Modern cybercrime operates as a mature economy with specialised roles and market dynamics. Initial access brokers compromise organisations and sell that access to ransomware operators, creating a supply chain where different criminal groups focus on their respective competencies. This division of labour has lowered barriers to entry and increased the overall volume of attacks.
The webinar examines how attackers evaluate potential targets based on factors including perceived ability to pay ransoms, likelihood of having cyber insurance, quality of existing defences and potential for operational disruption. Organisations in sectors such as healthcare, finance, manufacturing and education often face elevated risk due to their reliance on continuous operations and the sensitivity of their data.
Credential theft feeds into this economy as stolen credentials provide the initial foothold that makes subsequent attacks possible. The relationship between credential markets and ransomware deployment illustrates how interconnected these criminal operations have become.
Defensive Strategies and Attack Surface Reduction
The session moves beyond threat analysis to address practical defensive measures. A central theme is making organisations less profitable to attack by increasing the effort required for successful compromise while reducing the potential payoff for attackers.
Technologies discussed include allowlisting, which permits only approved applications to execute, and Zero Trust Network Access, which eliminates implicit trust within network environments. Privileged access management limits the damage possible when credentials are compromised, while endpoint detection and response capabilities provide visibility into suspicious activity.
The webinar also addresses patch management and data storage access controls as foundational elements of a defensive posture. These measures work together to create layered protection that forces attackers to expend significantly more resources for uncertain returns.
Who Should Attend
The content is structured for IT managers, security engineers, CISOs, network administrators and professionals working within managed service providers or managed security service providers. Decision-makers responsible for security strategy will find value in the economic framing, while technical practitioners can apply the specific defensive recommendations.
Organisations across regulated industries including government, healthcare and finance may find the discussion particularly applicable given their elevated threat profiles and compliance obligations.
Shifting from Reactive to Strategic Defence
The webinar represents a broader shift in security thinking—from purely technical defence toward understanding adversary economics. When security teams grasp why they are targeted, they can make more informed decisions about where to invest limited resources. The goal is not to achieve perfect security, which remains impossible, but to become a harder and less rewarding target than alternatives available to attackers.