Modern Cyberattacks Target More Than Your Network

Some attacks arrive as suspicious traffic. Others look like a successful sign-in, a burst of new customer accounts or a perfectly ordinary request to an AI application.

The challenge is not only spotting malicious code. It is recognizing when someone is abusing a legitimate capability: an account creation flow, an authenticated session or a model connected to business data.

My O’Reilly live course, Anatomy of a Cyberattack, examines that problem through three connected areas: online fraud and bots, identity attacks, and threats involving AI systems. The aim is to make the mechanics understandable enough to support better detection and defense decisions.

When automation turns into abuse

Automation is essential to modern services. That also makes it useful to attackers.

A bot-driven campaign can repeatedly exercise the same business workflow, creating fraudulent accounts or attempting access at a scale that changes the economics of an attack. A request may be syntactically valid while the pattern behind it is harmful.

In the course, we examine forms of online fraud, the role of botnets and approaches to detection and mitigation. Discussion includes the business consequences of bot activity, such as misleading account or usage metrics.

The technical distinction matters: identifying a bot is not identical to identifying fraud. Some automation is legitimate. Defenders need to connect activity patterns to the purpose of a service and the behavior they intend to allow.

A successful sign-in is not the end of the investigation

Identity attacks can take different routes to a similar outcome: acting with someone else’s authority.

Phishing uses deception to draw a person into an attacker-controlled interaction. Credential stuffing tests previously obtained credentials against other services. Token replay attempts to reuse a captured authentication or session artifact rather than repeating the original sign-in.

Those differences affect where defenders need visibility and where controls apply. Strong authentication is important, but it should not be mistaken for a complete explanation of everything that happens after sign-in. Session handling, authorization and the behavior of an authenticated account also matter.

The identity section covers common attack tactics, detection and prevention approaches, and discussion of real-world identity compromise. The objective is not to memorize labels. It is to understand what an attacker needs, what evidence the activity may leave and where intervention can be effective.

AI creates another set of trust boundaries

An LLM application may combine instructions, retrieved documents, user input and external tools. That creates opportunities for content from one context to influence behavior in another.

Prompt injection is one example. An attacker attempts to redirect the application’s behavior through instructions embedded in input or material the model encounters. The resulting risk depends on the wider application, including the information and capabilities available to it.

We cover prompt injection and other LLM risks, using the OWASP Top 10 for LLMs and relevant NIST guidance to organize the discussion. The course also addresses risks in the AI and ML supply chain: the dependencies and external artifacts an organization relies on when building or adopting AI.

Deepfakes extend the conversation beyond application behavior. Convincing synthetic audio or video can support impersonation and social engineering. Plausible-looking media is not, by itself, evidence that a request is authorized.

These topics belong alongside identity and fraud, not in a separate universe. They can all challenge the assumptions people and systems make about who is acting and what should be trusted.

What the course is designed to help you do

The learning goals are practical: recognize botnet-enabled abuse, distinguish common identity attack techniques, understand emerging LLM threats and reason about mitigation. You will also explore the impact of deepfakes and the risks introduced through AI dependencies.

The session combines presentations, group discussion and Q&A. It is a beginner-to-intermediate course intended especially for CISOs, security directors, SOC managers and other cybersecurity leaders who want a clearer technical understanding of the attacks their organizations face.

You do not need another list of threats that ends with “be vigilant.” You need a way to ask sharper questions about the workflows you operate, the signals you collect and the controls you expect to interrupt abuse.

Join me for Anatomy of a Cyberattack to examine those questions across bots, identities and AI.

View the course and registration options on O’Reilly.

The course archive provides the longer-term reference. The course details above show the next scheduled session when one is available.