What Do Hackers Hate the Most? Defenses That Actually Work

A passkey uses a cryptographic credential bound to the legitimate service. A fake sign-in page cannot simply collect a reusable code in the way it can with a password and one-time passcode. NIST distinguishes phishing resistance from merely adding another factor. Where supported, passkeys or security keys are a strong starting point for primary email and administrator accounts.

MFA still has boundaries. Malware can steal an authenticated session, recovery can be weaker than normal login, and older access methods can bypass the intended policy. Check recovery settings and remove obsolete authentication paths. An unexpected approval prompt is a reason to investigate.

A concrete result comes from Lucas A. Meyer and colleagues’ May 2023 study of Microsoft Azure Active Directory commercial accounts. They estimated a 99.22% lower compromise risk with MFA overall and 98.56% for accounts with leaked credentials. Those are observational results in that study population, not a 99.22% guarantee for your account, a passkey-only trial or proof that a determined intruder stops trying.

Credential stuffing reuses stolen username-password pairs against other services. A different random password for every account prevents one exposed password from being a universal key. A password manager makes that achievable without expecting a person to memorize dozens of secrets.

Protect the vault with a strong unique master secret and available MFA; secure the device that unlocks it and retain a safe recovery method. A manager is not a cure for malware on an unlocked computer. Prioritize accounts that can reset other passwords. Change compromised or reused passwords rather than imposing arbitrary rotations.

Updates remove known weaknesses, but a patch that never installs or requires a restart has not finished the job. Enable automatic browser and operating-system updates, check router support, and remove unused software. A service that is not exposed has fewer public access paths to defend.

For a team, maintain an inventory and an owner for every public service. Prioritize actively exploited vulnerabilities and critical exposure, test changes proportionately, and document exceptions with a deadline. A scanner finding a problem is only the beginning; someone must deploy and verify the fix.

For a named example, CVE-2023-34362 is the SQL-injection vulnerability in MOVEit Transfer associated with the 2023 CL0P campaign. The NVD record identifies affected releases and fixed-version boundaries; the joint FBI/CISA advisory documents exploitation. That is a much narrower and more useful claim than saying updates prevent all hacking. An exposed installation needs the vendor’s complete remediation process and a compromise assessment, not just a checkmark beside “updated.”

The October and November 2026 supermarket refrigeration incidents show why access to a management interface matters beyond an office computer. The separate incident dossier follows retailer reports, the public advisory and exposure measurements. It distinguishes the historical 4,500-interface observation from a count of hacked fridges, and does not assume that a published vulnerability explains every affected store.

For a system owner, the connection to this guide is concrete: identify who can reach administrative services, who owns their updates and how recovery is checked. Those are operational questions with verifiable answers. A dramatic incident headline is not evidence that every connected appliance is vulnerable in the same way.

Backups provide a route back after deletion, corruption or ransomware. Keep a copy separated from everyday access, protect backup administrator credentials and test representative restorations. A synchronized folder reproducing destructive changes is not sufficient evidence of recoverability.

A backup does not stop an attacker reading and publishing information before encryption. Plan separately for confidentiality and recovery. Try restoring a key application and checking whether configuration, dependencies and recovery credentials are available when the usual systems are down.

A compromised ordinary account should not automatically become an administrator. Give people and services the access required for their work, review it when roles change, and use separate privileged accounts for administration. Segmentation can restrict movement between workstations, servers and recovery infrastructure.

Write down which connections are necessary and validate that unnecessary ones are blocked. A diagram with separate zones is not evidence that access rules enforce those boundaries.

Useful logs answer specific questions: who signed in, what changed and which access was granted? Assign someone to review high-priority signals, retain a response contact and rehearse revoking sessions or disabling an account. Logs without ownership can become an expensive archive.

Define a small number of actions the team can execute during an incident. Record what was observed and when, verify that containment worked and check whether recovery settings or permissions were changed.

People need an easy way to report suspicious messages or accidental interactions. Avoid blame: attackers exploit normal work pressures and trusted conversations. Verify unusual payment or access requests through a separate known channel.

Awareness supports technical controls; it should not be the only barrier. A person who reports a mistaken click quickly gives responders a chance to act. Punishing that report makes the next incident harder to discover.

Open your email provider directly and check whether a passkey or MFA is enabled. Review recovery details and unfamiliar sessions. If the email password is reused, replace it. Turn on automatic updates and check when your last backup ran.

These checks identify work to complete; enrollment or a test restoration can take longer. If an exposure alert prompted your visit, identify what data it describes before deciding how widely to reset accounts.

Name the owners of identity, patching, backup restoration and response. Inventory public systems and privileged access. Confirm MFA is enforced on every relevant route, rather than merely available for enrollment. Set remediation deadlines based on exposure and impact.

Test an account-compromise scenario: can the team locate sessions, revoke them, check recovery settings and assess affected data? Keep evidence of completed actions. Review service accounts and suppliers too. Measure restored services and closed findings rather than purchased tools.

An MFA prompt can block a stolen-password attempt without ending the campaign. The next attempt may target account recovery, a live session or a different service. This review did not establish a measured time in which attack tools “move on” after encountering MFA, so that claim is not used. Reduced account compromise is evidence of a useful defense; it is not evidence about every attacker’s next decision.

A familiar sender can still be a compromised account. That is why the everyday advice to “watch for suspicious emails” needs a practical process: independently confirm an unusual transfer or access request, and give the recipient a quick way to report it. The person under pressure should have a useful next action rather than a demand to spot every convincing message.

Honeypots can help a team study or detect activity, but they introduce systems that need isolation and monitoring. They are not a sensible replacement for securing a person’s email. Publicly advertising law-enforcement contacts is also excluded as a standalone defense: a sign on a website does not close an exposed service or revoke a stolen session.

Awareness training remains in the list as support for verification and reporting, rather than a promise that trained people never click. Segmentation remains an organizational measure rather than an instruction for every home user. These are editorial scope decisions, not a claim to have run a comparative experiment across all security products.

If resources are limited, secure the accounts that can reset everything else, finish updates and verify a recoverable copy of important files. A business should then test what a stolen ordinary account can reach. That sequence answers a practical question—what should I do next—without pretending every threat has the same economics.

The controls above concern access to your systems. Identifying the person responsible is a separate evidence problem. Our guide to whether the FBI can track Tor examines documented investigative methods; the explanation of whether Tor is 100% untraceable addresses the boundaries of anonymity. These companion guides explain why a privacy tool does not remove evidence from devices or accounts, and why a successful investigation does not prove every network connection is traceable.