The radical transformation of the digital fraud landscape. I often think, in those late hours when the glow of a screen becomes the only window onto a world that never sleeps, about how it would feel to watch your own identity peel away from your body and travel through networks and digital systems — acting independently, without your consent, without your knowledge. In 2025, that strange, almost surrealist image became reality for millions of people. Sumsub's report, based on the analysis of more than four million attempted digital frauds, documents a 180% increase in sophisticated attacks compared to the previous year. This is not about more attacks. It is about a fundamentally different kind of attack.

What struck me when I read those figures — sitting at my desk on a grey November afternoon — was not their magnitude but their deeper meaning. We have moved out of the era of high-volume assaults, those hundreds of thousands of messages cast randomly into the world in the hope that someone would take the bait, and into a world where every strike is meticulously prepared, aimed at precisely the right person at precisely the right moment. It is as though digital violence has evolved from carpet-bombing to laser-guided precision strikes.

I wondered then — and I still wonder now — whether the teenagers I speak with, those who are born already with fingers shaped for touchscreens, truly understand what this shift means. For them, the digital world is as real as the air they breathe. But air can be poisoned without warning, until it is too late. And that is what is happening: the poison is becoming more refined, harder to detect, more lethal.

The Silent Farm: Bots, Public Perception, and the Invisible Beneficiary

There is a moment when a number stops being a statistic and becomes a symptom. That moment, as far as the internet is concerned, has already passed. It passed without newspaper headlines, without political declarations, without any institutional response remotely proportional to its gravity.

In 2024, for the first time in a decade, automated traffic surpassed human activity online. More than half of everything circulating on the internet — 51 per cent, according to Imperva's annual Bad Bot Report — was produced by no human hand, observed by no human eye, driven by no human intention. It was produced by machines that imitate people. Machines that comment, distribute likes, create accounts, spread messages, simulate consensus, and construct — with the tireless patience of a mechanism that never sleeps — a parallel reality in which no one knows with any certainty who they are actually talking to.

This is not a metaphor. It is a cybersecurity report. And its implications extend far beyond the world of IT.

Before 51%: How We Got Here

The internet was not born with bots. It was born with people who dreamed of a global network of knowledge — a space where ideas might travel freely and conversation transcend borders. The first bots arrived quietly, in the shadow of that dream: simple programmes that indexed pages, dispatched automated notifications, responded to elementary commands.

They were tools. Neutral, in principle.

The transformation was gradual. Social media platforms came to understand that engagement — not truth, not the quality of conversation, but raw emotional reaction, any form of activity at all — was their currency of exchange. And once someone grasped that bots could generate engagement on an industrial scale, they became instruments of power.

By 2023, nearly half of all global internet traffic — 49.6 per cent, according to the same Imperva research — was already coming from automated sources. The highest level recorded since the company began monitoring the phenomenon a decade earlier. A year later, the 50 per cent threshold was crossed. This trend is neither accidental nor reversible through individual vigilance alone.

I often wonder how I would explain it to my son — barely into his teens now, hours spent staring at his phone — what is actually happening in the depths of the internet he takes to be a safe place. How do you tell a child that whilst he checks his messages or downloads his latest app, somewhere in the hidden corners of the network, people are turning technology into a weapon? I don't want to frighten him. But I can't leave him defenceless, either.

And so I began writing this piece, thinking of him, of his friends, of all the adolescents growing up inside a digital world they don't fully understand. The year 2025 has brought with it an explosion of digital fraud so sophisticated it could serve as the backdrop for a film in the vein of William Gibson's Neuromancer or Blade Runner — worlds where the boundary between the real and the virtual blurs until it disappears entirely.

The Global Landscape of Cybercrime in 2025

When I look at the figures in this year's security reports, I feel a weight settle in my chest. The median cost of a security incident has risen from $190,000 to nearly $3 million over the past fifteen years. It is as though we are watching the inflation of a nightmare — one that worsens not gradually but exponentially. The IRIS 2025 report shows that extreme security events have grown roughly fivefold in financial impact, and I find myself thinking about all those small businesses, those family enterprises, those ordinary people who lose the savings of a lifetime to attacks they cannot even begin to comprehend.

Distributed denial-of-service attacks have reached dimensions without precedent. The attack on KrebsOnSecurity, for instance, peaked at 6.3 terabits per second. Try to hold that number in your mind: it is like trying to drink from a fire hose whilst you are already drowning. The Aisuru botnet, which I shall come to shortly, represents a tenfold escalation over the Mirai attacks of 2016. It is the evolution of a virus that keeps growing resistant to treatment.

The broader context — why being small makes you vulnerable. A small business does not mean a small risk.

I remember that my father, who spent his whole life repairing cars in a neighbourhood garage, always used to say that a thief doesn't break into houses with big dogs — he breaks into the ones with a low fence and the lights off. He was not a man given to elaborate metaphors; he was a man of mechanics, of tangible things, of direct cause and effect. If something wasn't working, you found the cause, you fixed it, you moved on. He knew nothing about cybersecurity, had never heard of Business Email Compromise, had never read any FTC report about the scams battering SMEs across America and Europe alike. But he had understood something fundamental about the nature of vulnerability: that nobody attacks you where you are strong and prepared — they attack you where you are distracted, rushed, tired, and above all, where you believe you are too small to matter.

I run a small firm. Based in Botoșani, in north-eastern Romania, a region that Bucharest systematically ignores and that investment maps pass through without stopping. I build websites for town halls, hospitals, schools, and private companies that have come to understand that existing on the internet is no longer a luxury — it is a condition of survival. I have clients who ask for quotes on European-funded projects and clients who negotiate the price of an SSL certificate with me as if they were haggling over tomatoes at a market. And within this entire spectrum of daily reality — invoices, contracts, emails, deadlines, deliverables, DNSC [National Directorate of Cyber Security] vulnerability reports, GDPR compliance, NIS2, Law 232 — I have discovered, particularly over the last two years, that I am not merely a provider of digital services. I am also a target.

Not a large, spectacular target of the kind that makes the news. Not a company with hundreds of employees, not a bank, not an operator of critical infrastructure. I am precisely the type of target that digital fraudsters prefer precisely because it is small, precisely because it has no IT department with twenty people and a well-paid CISO, precisely because behind the firm there is a single person who, at ten o'clock in the evening, is answering emails whilst his teenage son asks him to watch something together on YouTube, and the cat — Gri, a grey cat with the temperament of a Stoic philosopher — sleeps on the laptop keyboard with an indifference that is almost insulting towards the problems of the digital world.

The show was something else entirely. About betrayal without direct lying, about promises that never lie, and about the architecture of premeditated baseness. An informal presentation in relational hygiene. Not self-defence. Not cynicism. Hygiene. The distinction matters, and I repeat it because it is worth repeating: hygiene does not mean refusing to shake anyone's hand. It means knowing when to wash your hands ... if you're wondering what any of this has to do with Cybersecurity — I'll grant you, it's a touch melodramatic ... even if it stays on the level of metaphor.

"You were never told an untruth. You were told the truth in the order in which it could be used." — a thought that visits you at three in the morning, long after everything is over

Introduction — Or What a Play Looks Like When You Don't Know You're an Actor

The morning began early, with the smell of coffee I had made in a hurry and with my mother already in the hallway, already dressed, already holding her bag, a full twenty minutes before there was any need. She is eighty-two years old, and this punctuality of hers in the face of any commitment — the doctor, church, a nephew's wedding, a simple walk — remains unchanged, like a reflex from another era, from a generation that considered being on time the minimum form of respect for another person but in her haste she forgot the apartment door was open (we found out when we got back because her neighbors were visiting for coffee in the morning, and she was away from home). I drank my coffee standing up, watching her sitting on the hallway chair, staring straight ahead at the door with a focus I find difficult to describe as either courage or habit acquired from living with what cannot be changed.

The Senate has voted. Seventy-nine in favour, twenty-two abstentions, a single vote against. If you've ever watched Romanian digital legislation inch its way through parliament, you'll know how unusual a result like this is. Normally things drag on, get amended, get postponed. This time, they didn't.

The bill that prohibits commercial email addresses — Gmail, Yahoo, personal Outlook accounts — from official communications by public institutions is now before the Chamber of Deputies. Promulgation follows. A twelve-month transition period follows. For the first time in Romania, a national system of official, verifiable email, under Romanian jurisdiction, follows.

If you build and maintain websites for town halls, schools, hospitals, or county councils, this law changes the landscape you work in. Not tomorrow. But soon.

The Numbers That Explain Why a Law Was Necessary

67% of Romanian public institutions use commercial email addresses for official communications. Two thirds of them. We're not talking about a marginal habit confined to a handful of small municipalities in remote corners of the country. We're talking about the normal operating procedure of Romanian public administration.

From a web and SEO perspective, it's a pattern I've seen repeated across every project involving public institutions: the absence of basic digital infrastructure. A shiny new website, built with European funds or local budget money, and yet the contact email is still This email address is being protected from spambots. You need JavaScript enabled to view it.. An address created ten years ago, the password known by three people or by no one, the account accessed from computers running outdated antivirus software.

The law didn't appear out of nowhere. It appeared because this is exactly what things look like on the ground.

Last Saturday, my mother rang to tell me she'd received an advert on her phone — something about blood pressure medication. She hadn't searched for anything. She hadn't typed a word. But two days earlier she'd been on the phone to her sister, talking about the family doctor and a new prescription.

"The phone was listening to me," she told me, quite certain of it.

Perhaps it was. Perhaps not — the technical explanation is more nuanced than that. The subject itself is hardly new; this kind of unease has been circulating for at least five years. But her reaction says something essential: instinctively, we feel that we have lost control over what the world knows about us. And, by and large, we are right.

What We Mean by Anonymity, and Why It Matters

Anonymity is not a technical concept reserved for hackers or political dissidents. It is a fundamental psychological experience — the sense that you can exist, think, and act without every gesture being recorded, interpreted, and stored somewhere.

John Suler, professor of psychology at Rider University and author of The Psychology of Cyberspace, describes this need with clinical precision: each of us carries a public self and a private self simultaneously. The public self navigates social relationships — family, colleagues, neighbours. The private self is the interior space of reflection, of unspoken thoughts, of identity still being formed. Without that space, our sense of wellbeing begins to unravel.

This isn't paranoia. It's psychological hygiene.

The trouble is that this space is being systematically eroded, day by day, through mechanisms we have accepted without fully understanding them.

'Gran, you can't pay at the counter any more. Everything's online now!' This line, heard in countless households, perfectly captures the plight of an entire generation caught in the whirlwind of a forced digitalisation that has accelerated dramatically in recent years. The pandemic was merely the catalyst for a transformation long in the making, but which erupted with a speed that left no time for adaptation.

The digitalisation of public and private services has become not merely an option but an absolute necessity. Medical appointments, utility payments, tax declarations, even basic shopping — all have migrated into the virtual sphere with a rapidity that has left millions of people behind. And we are not speaking of people who resist progress, but of a vulnerable group that simply did not have the time needed to adapt to the new digital realities.

This 'forced digitalisation' — the term that defines the sudden and compulsory transition towards exclusively digital services — has created a profound social fracture. On one side stand the younger generations, digital natives, who navigate apps and online platforms with ease. On the other stand older people, a demographic group that represents a significant proportion of the population, yet has been effectively abandoned in this race towards modernisation.

The principal tension is not between progress and conservatism, but between the speed of technological implementation and the human capacity for adaptation. When essential services become available exclusively online overnight — without alternatives and without adequate support programmes — a dangerous void is created. This void is systematically exploited by cybercriminals who have identified older people as the perfect target: individuals who desperately need to access digital services, but who lack the tools necessary to protect themselves.

Digital wisdom in a globally connected world — or "incontestable truths" for everyday online safety — this collection of maxims makes an excellent introduction for self-taught beginners in the field of cybersecurity. In the age of hyperconnectivity, when every aspect of our lives is woven through with digital technology, wisdom in the domain of cybersecurity has become more precious than ever. From the first personal computers of the 1980s to today's sprawling Internet of Things ecosystems, humanity has accumulated not merely technical experience, but a deep philosophy of how to protect the digital universe we have built around ourselves.

These meaningful maxims are not mere aphorisms — they represent lessons learnt through hard trials, through costly security breaches, through attacks that changed the course of companies and even of entire nations. They are the crystallisation of experience from a global community of professionals who fight daily against cyber threats — whether those threats come from profit-driven hackers, state-sponsored attacks, or simple human errors with catastrophic consequences.

Bruce Schneier, regarded by many as the "dean of information security", observed as far back as the 1990s that "security is a process, not a product" — a revolutionary insight that redefined how we think about protecting digital systems. That paradigm has shaped entire generations of specialists and established the modern understanding that cybersecurity is not a final destination, but a continuous journey of adaptation and vigilance.

From John Chambers of Cisco's observation about "the two types of companies: those that have been hacked, and those that don't know yet they have been hacked", to Kevin Mitnick's reflections on the difference between amateur and professional hackers, these quotations illuminate not only the technical challenges but the deeply human dimension of cybersecurity.

In our digital world — where 48% of small and medium-sized businesses have experienced a security incident in the past year — these sayings offer us more than motivational quotes. They offer a conceptual map for navigating the complex landscape of cyber threats. Each one carries within it stories of vulnerabilities discovered, lessons learnt from failure, and defensive strategies that proved their worth.

This collection gathers fifty of the most profound and influential reflections from the field of cybersecurity, arranged thematically to provide a comprehensive perspective on the challenges and solutions in this vital domain. From foundational principles to the emerging challenges of artificial intelligence and the Internet of Things, these quotations guide us through the complexity of digital security with wisdom forged through direct experience.

I asked an AI assistant how to optimise my website. It gave me 304 perfect pieces of advice. And completely blind ones.

Preliminary note: The AI initially generated a list of 304 technical tips. I decided not to publish them. What follows is the explanation for that decision — and, perhaps, an argument more useful than all 304 points combined.

Let me tell you a small story. A true one.

I opened ChatGPT and asked: "What are the most common SEO mistakes made by websites that publish AI-generated content?"

It answered impeccably. Structured. With bullet points. With examples. It explained that AI-generated text tends to be generic, that it lacks genuine topical authority, that Google is getting better and better at detecting it, that E-E-A-T — Experience, Expertise, Authoritativeness, Trustworthiness — cannot be simulated but must be demonstrated through authentic human experience.

An excellent answer.

Given by a tool that doesn't know it's talking about itself.

The tool that cannot see itself in the mirror.

This is the first level of irony. The AI assistant explains to you the SEO vulnerabilities of AI-generated content with no trace of awareness that it itself is the exact source of the problem it is describing. It's rather like asking a drunk man how to avoid drink-driving and he gives you a theoretically impeccable answer, complete with statistics, recommendations, and an authoritative tone.

Technically correct. Existentially blind.

Researchers at Aalto University documented precisely this mechanism: users who consider themselves more familiar with AI display the highest degree of overestimation of their own performance — a complete reversal of the classic Dunning-Kruger effect.

But the same effect works in the opposite direction, at the level of the tool itself. The AI assistant describes with clinical precision the vulnerabilities of a type of content — and has no mechanism that would cause it to recognise the fact that it produces exactly that type of content. Not out of malice. Out of architecture.