The Breach Didn't Start in Your Network"

I'm John Foster, founder of BrushPass Intelligence and a retired United States Army Special Forces operator with more than two decades of experience conducting Operational Preparation of the Environment. In Special Forces, we understood a fundamental truth: no operation succeeds without preparation. "Before action comes intelligence." You study the terrain, identify the target, uncover vulnerabilities, and shape the environment to create conditions for success. Nation-state cyber actors operate according to the same logic. Long before a malicious email is sent, malware is deployed, or a security alert is generated, adversaries are conducting reconnaissance, building target profiles, developing access, and preparing the operational environment. Most organizations never see these activities because they occur outside the network and beyond the visibility of traditional security controls. Let me share a recent example. A colleague of mine, a highly technical professional with a strong cybersecurity background, received a connection request on LinkedIn from an individual presenting as the CEO of a legitimate-looking company. The profile was professional, the organization appeared credible, and the opportunity was compelling. Over several weeks, they exchanged messages and eventually scheduled a video interview. During the interview, as part of what appeared to be a routine technical assessment, my colleague was asked to clone a GitHub repository. For software developers and engineers, this is an entirely normal request. What he did not know was that the repository had been weaponized. Had the code executed successfully, it would have harvested credentials, established persistence, and provided the attacker with access to multiple networks and systems under his control. Fortunately, he recognized indicators that something was wrong, isolated the environment, and prevented execution. The incident was reported to the FBI's Internet Crime Complaint Center, and subsequent analysis linked the activity to an ongoing North Korean state-sponsored cyber campaign. The most important lesson is not the malware itself. It is the preparation that preceded it. The adversary identified a specific individual, established trust, developed a believable cover story, and created a pathway to access long before any malicious code was introduced. He was not targeted at random. He was selected because of the access, relationships, and opportunities he represented. One successful compromise could have provided a pathway into multiple organizations. That is not simply hacking. It is intelligence-driven targeting and operational preparation executed in the digital domain. Here's your action for this week. Identify the three individuals in your organization with the greatest access to critical systems and information. Not necessarily the most senior people—the most connected. Your network administrator. Your senior engineer. Your IT director. Now ask yourself a simple question: If a motivated adversary spent one week researching those individuals using only LinkedIn, public records, search engines, and commercially available data, what would they learn? What conferences do they attend? What technologies do they use? What professional communities do they participate in? What circumstances would make them trust an unsolicited approach? That exercise is the beginning of understanding your true security posture. Not your network security posture. Your human security posture. Because sophisticated adversaries do not begin by targeting systems. They begin by targeting people. And if the answers make you uncomfortable, that's not a problem. That's intelligence. I’m John Foster — founder of BrushPass Intelligence. Nation-state cyber threats do not begin inside your network. They begin with your people—long before any system is touched or any alert is triggered. That gap between human targeting and technical detection is what BrushPass Intelligence is focused on closing. Download the white paper at BrushPassIntel.com. Share this episode with your CISO. Know the adversary. Shape the outcome.