The attacker's mindset is systems thinking
Attackers don't break rules; they discover that the rules compose differently than the designers believed.
Useful to others as-is. Tested ideas, working code, real findings.
Security people love the phrase “think like an attacker,” but rarely unpack it. Here’s my working definition: an attacker is someone who reads a system as it is, not as it was intended.
Designers think in features. Attackers think in interactions between features. Almost every interesting vulnerability lives in the seam between two components that are each individually correct:
- The parser is fine. The renderer is fine. The parser’s output fed to the renderer is the bug.
- The IAM policy is fine. The default service role is fine. Together they’re a privilege escalation.
- The model follows instructions. The document contains instructions. Now the document is the operator.
This is just Donella Meadows with a hoodie on. Systems thinking says behavior emerges from structure, not from the intentions of the parts. Offense is the empirical branch of that claim.
The practical loop
- Build the designer’s mental model of the system.
- Build a second model from the actual artifacts: code, configs, network behavior.
- Attack the difference between the two models.
CTFs are a gym for step 3, because puzzle authors deliberately hide a gap between appearance and structure.
Two ways I actually work this loop: fuzzing automates step 3, mutating inputs until the gap between the two models reveals itself, and threat modeling runs the loop in reverse, mapping a system’s seams on purpose before someone else does.
The kindest thing about this mindset: it transfers. Markets, incentives, organizations: anything with rules has seams. That’s half of why I keep poking at quant ideas.
Paths that lead here
- The ADHD-HTB playbook: hacking the brain that hacks the box · The whole thing is the attacker's mindset swung around to face inward.
- From Paladins to Rivals: Why Hero Shooters Are So Stupidly Fun · That's the same loop as reading an opponent and hunting the weak link in their setup, the whole attacker's mindset.
- Kelly criterion for bug hunting? · That fold-on-tilt instinct is the same systems reflex behind the attackers mindset is systems thinking: watch the loop you are in, not just the move in front of you.
- The Diamond Lock: Writing Notes a Future Robot Can't Read · This is the attacker's game played from the defender's chair (the attackers mindset is systems thinking).
- Quant isn't prediction, it's edge and survival · Which is why I keep shelving it next to the attacker's mindset.
- Threat-modeling this garden · The meta-lesson belongs in the attackers mindset is systems thinking: the cheapest vulnerability to fix is the component you never built.
- You will never know enough, and that's the job · The attacker's mindset boils down to "what does this assume?", a question you can aim at a system you've never laid eyes on.
Where this note points
- Threat-modeling this garden · Eating my own dog food: a security person's website should survive its own methodology.
- Kelly criterion for bug hunting? · A half-formed hunch: allocating research time across targets is a bankroll problem, and Kelly might be the right lens.
More from these beds
- AI Slop and the Quiet Cost of Foraging · Maggie Appleton calls it jetspraying the web with AI slop. Here is why that cheap flood is so exhausting, told through Information Foraging Theory, and why your tiredness is a rational response, not a personal failing.
- The Dead Internet and Your Pattern-Hungry Brain · That creeping sense that the internet is mostly bots talking to bots has a name. Here is why the feeling is partly real, partly a trick your own mind plays, and what apophenia and the illusory truth effect are doing to you while you scroll.
- Explaining Without the Lecture · I got called a bad explainer, and I think I earned it. The fix isn't reading minds. It's the curse of knowledge, Grice's maxim of quantity, and treating an explanation like a game of catch instead of a monologue.