1.2. How Attackers Think: The Attacker's Advantage

💡 First Principle: Attackers succeed not because they're more sophisticated, but because they operate with freedom of choice — they pick their timing, their entry point, and their method, while defenders must cover everything at once.

Understanding attacker economics isn't morbid; it's strategic. When you know why attackers make the choices they do, you can make their choices more expensive (harder to succeed) and your detection faster (shorter time between breach and response).

The attacker's advantage has three dimensions: asymmetry of effort (one successful attack vs. defending the whole surface), time advantage (attackers can dwell undetected for months while gathering intelligence), and information advantage (attackers research specific targets before striking). Each of these has a corresponding defensive counter that the CySA+ exam tests.

⚠️ Common Misconception: Many learners assume sophisticated attackers use exotic zero-day exploits. In reality, the majority of successful breaches use known vulnerabilities, phishing, and stolen credentials — the "basics" that organizations failed to patch or train against.