Beyond the Hoodie: What “Thinking Like an Attacker” Actually Means

We hear the phrase “think like a hacker” so often in this industry that it’s basically become background noise. It’s on every job description and at the start of every slide deck, but we rarely stop to talk about what it actually means. Most of the time, we’re too busy chasing the latest compliance checkbox or tweaking firewall rules to notice that the game has changed. While we’re focused on the "how" of security, the tools and the patches, the people on the other side are obsessing over the "why". They don’t see our defences as a wall; they see them as a puzzle that’s just waiting to be taken apart. If we’re going to actually protect our systems, we have to move past the stereotypes and get real about how an attacker’s brain actually works.

Why Our Defensive Instincts Are Failing Us

For too many organisations, security is treated like a predefined chore: install the firewall, patch the known CVEs, and check the compliance boxes. We view security as a series of physical locks to be bolted, forgetting that an attacker doesn’t see our security posture as a wall. They see it as a puzzle.

This "technification" of cybersecurity has created a dangerous intelligence gap. We have become experts at managing our tools, but we remain amateurs at understanding our opponents.

We think defensively and act defensively, but the former must change. We should think offensively; only then can we properly act defensively

While we obsess over our internal infrastructure, the enemy is obsessed with breaking it. They aren’t just looking at how a system works; they are investigating exactly how it can be forced to fail. To close this gap, we have to stop treating security as a technical hurdle and start treating it as a contest of human creativity. Defensive instincts are reactive, while an attacker’s mindset is investigative. It is the difference between hoping the lock holds and understanding exactly why someone wants to pick it in the first place.

It’s Not One Mindset; It’s a “Triple Threat”

Adversarial thinking is often glamorised as a Hollywood trope, specifically the lone genius in a hoodie. In reality, it is the sophisticated application of the triarchic theory of intelligence. In InfoSec, being "tech-smart" is just the baseline. To actually thrive, you need a mix of three distinct types of intelligence:

• Analytical Intelligence: The "book smarts" required to dissect complex systems. This is the world of logic and mathematical reasoning. You need to be able to look at raw data and derive a result, or at the other extreme, simplify a tangled web of dependencies. Think of Robert Tappan Morris, who mapped the technical DNA of the early internet to exploit trust protocols in BSD Unix.
• Creative Intelligence: The ability to find unconventional uses for boring rules. While a developer sees IP fragmentation as a way to handle large data packets, a creative attacker sees it as a way to bypass security assumptions. They count on the fact that system designers never expected fragments to arrive in non-linear, malicious orders.
• Practical Intelligence: The "street smarts" of the digital world. This is about strategy and outsmarting people, not just code. Kevin Mitnick mastered this through social engineering, proving that the weakest link in any protocol isn't the syntax but the person running it.

Many highly skilled developers fail at security because they are "left-brained", meaning they are heavy on the analytical side but light on the creative side. They build according to the rules, while the attacker thrives in the spaces where those rules bend.

The Counter-Intuitive Training Ground: Learning a Second Language

Surprisingly, the best place to foster an attacking mindset isn't a coding bunker; it is a language classroom. Learning a second language (L2) mirrors the hacker's journey because language itself is a protocol-rich system governed by phonetic, syntactic, and pragmatic rules.

• Grammar as Code (Analytical): Mastering a language requires analysing its technical subsystems. Just as a hacker learns the "grammar" of an OS to interact with it, a student must master the mechanics of a new tongue.
• Poetry and Slang (Creative): True fluency is knowing when not to follow the textbook. Bending rules to be poetic or using slang to achieve a feeling is functionally identical to a hacker experimenting with protocols to produce unexpected results.
• Persona and Pretext (Practical): To fit into a social context, language learners often adopt different personas. This is the exact same "pretexting" used in social engineering to blend in and evade detection.

Situational Awareness: Perceiving the "Glitch in the Matrix"

Adversarial thinking is the ingrained habit of investigating how things fail. It is nourished by situational awareness, which is the ability to notice the thing that doesn't fit. In a high-stakes environment, this follows a rigorous four-step loop:

1. Know what should be: Establish a baseline of "normal".
2. Track what is: real-time perception of current activity. This is where most people fail.
3. Infer the mismatch: Identify exactly where reality deviates from the expected.
4. Do something: Take proactive action based on that inference.

The most impactful attackers don't just hunt for random bugs; they look for the specific "glitch" that suggests a logical oversight.

Hacking is a Skill, Not a Gift

There is a common misconception that you are either born a "hacker" or you aren't. In reality, strategic thinking isn't like weightlifting, where you are constrained by physical limits. It is like learning to windsurf or fly a plane. It feels unnatural at first, but it is a masterable skill.

Look at the Akira Ransomware group. Since 2023, they have extracted over $244 million from 470 organisations. Their success isn't just due to "bugs". It is due to this "Triple Threat" of intelligence:

• Creative/Practical: They use "ClickFix" (fake CAPTCHA prompts) to trick users into manually running malware. They aren't hacking the computer; they are hacking the human.
• Analytical: They use the "comsvcs.dll MiniDump" technique to silently harvest credentials from memory. By using a legitimate Windows file, they bypass traditional alerts that are only looking for "malicious" tools like Mimikatz.
• Living-off-the-Land: They blend into legitimate admin traffic, moving through a network and exfiltrating data in under two hours.

The "So What?": Moving from Reactive to Proactive

Adopting this mindset transforms security from a "department" into a strategic business capability. When you move from a "checkbox" culture to a threat-informed culture, the focus shifts.

Instead of a vague worry that "ransomware exists", a strategic defender knows that specific groups are targeting their sector via vulnerabilities like CVE-2023-20269 in Cisco VPN appliances. This allows for:

1. Coverage Mapping: Validating that your tools actually stop real-world techniques, not just theoretical ones.
2. Evidence-Based Confidence: Moving beyond "hoping" you are secure to a quantifiable score based on simulated attacks.
3. Resource Optimisation: Shifting the budget from generic tools to the specific sensors that address the adversary's actual playbook.

Conclusion: The Mirror Test

Building a threat-informed defence isn't a project with a deadline; it is a continuous evolution of perception. It requires us to look into the mirror and see our systems through the eyes of those who wish to disrupt them. If we cannot imagine how we would break ourselves, we certainly cannot defend against someone who can.

As you evaluate your own posture today, ask yourself: if you were tasked with breaking into your own most important system, where would you start? Does your current defence even have a sensor in that room?