Why it matters to you

Most beginners quietly believe "I'm too small to be a target", and that single belief is what gets them hacked. This lesson dismantles it, then shows you the two big rewards of learning this subject.

By the end of this lesson you should be able to explain to a family member why automated attacks target everyone, not just the "important" people.

"Why would anyone attack me?"

It's a fair question. The mistake hidden inside it is imagining a hacker choosing you specifically. For ordinary people, that's almost never how it works. Real attacks are far more like fishing with a giant net than with a single hook.

An attacker writes a program once, then points it at millions of people or websites automatically. The program tries the same trick on everyone, day and night, with no human involved. It doesn't know or care who you are. It only knows that out of a million attempts, a few thousand will succeed. If you happen to have a weak password or you click the wrong link, the net catches you — not because you were chosen, but simply because you were reachable.

[How automated attacks scale]

You are not too small to be attacked. Automation makes everyone a target, all the time. "I'm not important enough" is not protection — it's a comforting myth.

Real things that happen to ordinary people every single day

Here are the four attacks that account for the vast majority of everyday breaches. Every one of them is automated and non-targeted:

1. Phishing

A fake email or text that looks like it's from your bank, a courier, or a social network tricks you into typing your password into a fake copy of the real site. Now the attacker has it. We'll go deep on phishing in Path 10.

2. Password reuse (credential stuffing)

You used the same simple password on ten sites. One of those sites gets breached and leaks it. Attackers then try that password on your email, your bank, your shopping accounts — and it works, because you reused it. This is called credential stuffing, and it's devastatingly effective.

Reports like Verizon's Data Breach Investigations Report consistently show that stolen credentials are involved in a huge share of confirmed breaches every year — often the single largest cause.

3. Ransomware

You open an unexpected attachment or download a "free" program. Hidden malware quietly encrypts (scrambles) all your files — photos, documents, everything — then demands money to unscramble them.

4. Account takeover

An attacker gets into your email. Because your email can reset the password of nearly every other account you own, that one foothold gives them your whole digital life.

[Why your email is the master key]

None of these attacks required you to be famous or rich. They required you to be online — which is everyone.

You're not just a victim — you can become a weapon too

Here's a piece of the picture most beginners never consider: a compromised device doesn't just hurt you. Attackers frequently use one compromised machine as a stepping stone to attack others — sending phishing emails from your real, trusted email account to everyone in your contacts (who are far more likely to trust a message that genuinely comes from your address), or enlisting your device into a botnet: a network of thousands of compromised machines an attacker controls remotely, often used to attack other, much larger targets without your knowledge at all. Your own personal security isn't purely a personal matter — a compromised home computer can become one small part of a much larger attack against someone else entirely.

The real financial and human cost

Beyond the individual scenarios above, the aggregate cost of cybercrime is genuinely enormous — industry reports consistently estimate global losses in the trillions of dollars annually, and that figure keeps climbing year over year. For an individual, the cost isn't only financial: victims of identity theft or ransomware often describe the experience as deeply stressful and time-consuming to resolve, frequently taking weeks or months to fully recover accounts, credit, and peace of mind — directly connecting to Path 09's identity theft protection lesson later in this course, which covers exactly how to prepare for and respond to this.

Two very good reasons to learn this

Reason 1: it protects you and the people you love

Even the basics in this course put you ahead of most people online. You'll:

• Spot the fake email before you click.
• Use strong and unique passwords via a password manager.
• Understand why "you've won a prize!" is bait.
• Know how to lock down the accounts that matter.
• Become the person your family and friends turn to for help.

Reason 2: it's one of the best careers you can build right now

There is a genuine, worldwide shortage of skilled security people. Reports from (ISC)² put the global shortage in the millions of unfilled roles. That means:

• Good pay.
• Freedom to work remotely from almost anywhere.
• Strong job security.
• And unlike many professions, you can break in without an expensive degree if you build real, demonstrable skills — which is exactly what this course is designed to help you do.

Security roles also span a genuinely wide range of day-to-day work, not just one narrow job description: some people spend their days finding vulnerabilities before attackers do (offensive security — Path 14, Path 15), others defend live systems and investigate incidents as they happen (defensive security — Path 12, Path 16), and others focus on policy, compliance, and risk management for entire organizations. Path 01's next lesson walks through these roles in detail, so you can start forming a sense of which direction genuinely interests you.

Every single skill you learn here is a skill an employer will pay for. You are not just learning to protect yourself — you're laying the first bricks of a serious career.

Write down, honestly: what's the single account or device in your own life that would cause the most disruption if it were compromised today? For that one thing specifically, note whether you currently have a strong unique password and 2FA enabled — if not, that's your very first real action item from this entire course.

What's the name of the attack where a password leaked from one site is automatically tried on many other sites?

Key terms

• Phishing — fake messages that trick you into giving up secrets.
• Credential stuffing — reusing a leaked password across many sites automatically.
• Ransomware — malware that scrambles your files and demands payment.
• Account takeover — an attacker gaining control of one of your accounts (often email first).

Recap

• Most attacks are automated and aimed at everyone at once — not at you personally.
• Being "small" doesn't protect you; being reachable does.
• Everyday attacks: phishing, password reuse, ransomware, account takeover.
• Learning this protects you and opens the door to a high-demand career.

References

• Verizon Data Breach Investigations Report — the definitive annual breach analysis.
• Have I Been Pwned — check if your email has appeared in known breaches.
• (ISC)² Cybersecurity Workforce Study — hard data on the security jobs shortage.
• Google Phishing Quiz — take it, then share it with family. Excellent free training.

Next up → The CIA Triad: the three things security actually protects