What cybersecurity threat do people still not take seriously enough?

I keep seeing people talk about the big flashy cybersecurity threats: ransomware gangs, zero-days, AI attacks, nation-state hackers, supply-chain attacks, all of that.

And yeah, that stuff matters.

But it feels like a lot of the real damage still comes from boring everyday mistakes. Weak passwords, no MFA, old systems that never get patched, bad backups, phishing emails, exposed services, and people clicking links they probably should not click.

So what do you think people still underestimate the most?

Is it phishing? Bad patching? Cloud mistakes? Users? Companies being cheap? Something else?

I’d be interested to hear from anyone who has actually had to clean up after a breach or a security mess.

The one I still see underestimated is asset ignorance. Not sexy, but it is the root of a lot of the other failures.

You cannot patch the box nobody admits exists. You cannot enforce MFA on the forgotten VPN profile. You cannot back up the weird little database under someone’s desk that became production by accident in 2017.

Phishing gets the headlines because humans are squishy, but the cleanup disasters usually start with an inventory that was more folklore than fact. Attackers are very good at finding the edge cases you forgot you owned. Computers are rude like that.

Phishing. It is still phishing. Granted, phishing is getting more sophisticated... It used to be the case that you could tell a phish because it just looked bad. Incorrect grammar, misspellings, spaces or tabs in nonsensical places, or even references to people or places that don't exist or have no relevance to the user. Now, prompts are leveraging AI to sound more realistic. New campaigns can be made fairly quickly to take advantage of current events. Spelling and grammar errors have gone way down. Deep reconnaissance will find your supervisor, your coworker, your next door neighbor. All these things make the message sound more legitimate, and causes the user to click. Or, perhaps even more insidiously, causes the user to call a number, send a text message, or email from a side channel; all things to evade established security policies. How do you block an email from a Gmail address with only a phone number and the promise of a job making $450 a week? Do we go to a default deny model for every email address? Surely we cannot just block all of Gmail, Yahoo, Hotmail, MSN and the others, right? Until we have much better filtering in place, this will always be a problem. And the problem is not new, nor is it exclusive to email. So do we use AI instead? Do we teach it to recognize bad messages rather than teaching our users? Is security awareness training and account diligence something we give to our robot overlords as well?

One thing I'd like to see the cybersecurity industry move toward is AI-powered, real-time reputation sharing between mail providers.

Traditional RBLs that block sender IPs still have value, but they're becoming less effective. Today's phishing attacks often come from compromised Yahoo, Outlook, Gmail, or business accounts with perfectly valid SPF, DKIM, and DMARC records. Blocking by IP alone just isn't enough anymore.

Imagine a global reputation network where participating mail servers anonymously share phishing indicators the moment they're detected. AI could identify the campaign, generate a fingerprint of the message, URLs, HTML, attachments, and sending behavior, then distribute that information worldwide within seconds. By the time the attacker switches IPs, the campaign itself is already recognized.

The future probably isn't IP reputation—it's campaign reputation. Stop the phishing operation, not just the server it happened to come from.

#CyberSecurity #Phishing #EmailSecurity #ThreatIntelligence #AI

I think people still pay little attention to such a branch as fraud. Everything happens as if already according to a simulated scheme, and people choose to just forget or try, but then give up anyway. And I'm not talking about calls asking for a code from the bank or about phishing emails from fake banks, but about large sites or corporations that continue to work and receive money in different ways.

Сreating viruses with the help of which they steal data, and then clean the victim's wallets. Everyone thinks that only fools get caught, but in fact, everyone can get into a scam project, some just out of shame or fear of appearing stupid, try to forget about deception, allowing a person to assert their impunity. People and the special services themselves are obliged to pay more attention to the problems with fraud on the Internet, and domain registrars are obliged to regulate actions on their servers, because some simply do not follow, thereby allowing fraudsters to steal even more money. In my opinion, every scammer or scammer is obliged to be prosecuted like an ordinary thief, here it is like in theft, everything is gradual. First, he deceived a person for a couple of dollars and got away with it, then he tries to deceive more people and so on until it comes to large projects with hacking or data theft, so it is worth not only improving the protection system of banks, but also destroying the idea of fraud in people's heads.

On Oct 25, 2026 5:05 PM, decarte sensed a disturbance and said:

You make a good point. Scams can catch smart, careful people too, and victims shouldn’t feel ashamed to report them. That shame only helps scammers keep going. Better security matters, but so does taking reports seriously and holding the people behind these operations accountable.