all-lessons.csv

collection,slug,kind,source,lesson,category,nist,iso
The Simpsons,simpsons,fiction,The Crepes of Wrath,Adil the exchange student is an Albanian spy photographing the plant: espionage via a trusted placement,Espionage,"ID, DE","A.6.1, A.5.7, A.7.6"
The Simpsons,simpsons,fiction,Homer's Odyssey,"Homer becomes safety inspector: the loudest critic gets hired to quiet him, control exists on paper only",Negligent Controls,GV,"A.5.2, A.5.36"
The Simpsons,simpsons,fiction,Two Cars in Every Garage and Three Eyes on Every Fish,Blinky spun as a positive during Burns' campaign: incident findings buried under PR,Audit Fraud,GV,"A.5.35, A.5.36"
The Simpsons,simpsons,fiction,Bart Gets Hit by a Car,Faked injury claim with Dr. Nick as the fraudulent expert witness: fabricated evidence collapses under scrutiny,Fraud,DE,A.5.28
The Simpsons,simpsons,fiction,Burns Verkaufen der Kraftwerk,"German buyers discover the plant's true condition after purchase: skip security due diligence in M&A, inherit the mess",Due Diligence,"GV, ID","A.5.19, A.5.21, A.5.9"
The Simpsons,simpsons,fiction,Separate Vocations,"Lisa steals the teachers' editions, Bart the rule-breaker becomes hall monitor: privileged material theft, poacher turned gamekeeper",Privilege Abuse,"PR, DE","A.5.18, A.8.15"
The Simpsons,simpsons,fiction,Radio Bart,Timmy O'Toole in the well: hoax incident drains the whole town's response capacity,False Alarms,RS,"A.5.25, A.5.26"
The Simpsons,simpsons,fiction,Homer Defined,"Eeny-meeny-miny-moe averts meltdown, Homer gets a plaque: luck mistaken for capability",Incident Response,"RS, GV","A.5.26, A.5.27"
The Simpsons,simpsons,fiction,Bart the Murderer,Fat Tony's crew grooms a kid with perks and belonging: recruitment of an unwitting asset,Social Engineering,PR,"A.6.1, A.6.3"
The Simpsons,simpsons,fiction,Marge vs. the Monorail,"Lyle Lanley: flashy vendor pitch, zero due diligence, catastrophic product",Vendor Fraud,"GV, ID","A.5.19, A.5.21, A.5.22"
The Simpsons,simpsons,fiction,Last Exit to Springfield,"Burns and Smithers can't run the plant alone: key person dependency, no cross-training",Bus Factor,"GV, RC","A.5.2, A.5.30, A.6.3"
The Simpsons,simpsons,fiction,Kamp Krusty,"The camp delivers nothing promised: service misrepresentation, SLA fraud, kids revolt",Vendor Fraud,GV,"A.5.19, A.5.22"
The Simpsons,simpsons,fiction,Cape Feare,Bob rides under the car through witness protection: attacker persistence beats identity change,Persistence,"ID, PR","A.5.16, A.5.34"
The Simpsons,simpsons,fiction,Rosebud,"Burns trades the entire plant for a teddy bear: asset valuation driven by obsession, not risk",Asset Mgmt,"GV, ID","A.5.9, A.5.12"
The Simpsons,simpsons,fiction,Homer Goes to College,Homer melts down a test rig with no nuclear material in it: users break the unbreakable sandbox,Testing,"ID, PR","A.8.29, A.8.31"
The Simpsons,simpsons,fiction,Deep Space Homer,NASA lowers the bar to send an average guy up: access standards relaxed for optics,Access Standards,"GV, PR","A.5.15, A.6.1"
The Simpsons,simpsons,fiction,Secrets of a Successful Marriage,Homer teaches a class using family secrets as material: confidential info leaked for status,Data Leakage,PR,"A.5.14, A.6.2, A.8.12"
The Simpsons,simpsons,fiction,Sweet Seymour Skinner's Baadasssss Song,Santa's Little Helper loose in the air ducts shuts the school down: physical intrusion via unsecured pathways,Physical Security,"PR, RS","A.7.1, A.7.4"
The Simpsons,simpsons,fiction,Sideshow Bob Roberts,Bob rigs the election: records tampering caught by two kids doing log analysis in the library,Data Tampering,DE,"A.8.15, A.8.16, A.5.28"
The Simpsons,simpsons,fiction,Itchy & Scratchy Land,"Park robots go haywire, weakness found mid-incident: no fail-safe designed in",Kill Switch,RS,"A.5.26, A.8.31"
The Simpsons,simpsons,fiction,Homer Badman,Homer convicted by media until the Rowdy Roddy Peeler footage surfaces: logging and video evidence exonerate,Evidence,"DE, RS","A.8.15, A.5.28"
The Simpsons,simpsons,fiction,The Springfield Connection,Counterfeit jeans ring running out of Marge's own garage: the blind spot inside your own perimeter,Insider Blind Spot,DE,"A.8.16, A.5.9"
The Simpsons,simpsons,fiction,Who Shot Mr. Burns? Part One,Everyone in town has motive and access: no access segmentation means everyone is a suspect,Access Mgmt,"PR, ID","A.5.15, A.5.18"
The Simpsons,simpsons,fiction,Bart's Comet,"Shelter can't fit the town, they blow the bridge as a response: DR capacity planning failure",Disaster Recovery,RC,"A.5.29, A.5.30"
The Simpsons,simpsons,fiction,Who Shot Mr. Burns? Part Two,"The investigation: forensics, suspect interviews, evidence chains, and a conclusion nobody predicted",Forensics,"DE, RS","A.5.28, A.5.26"
The Simpsons,simpsons,fiction,King-Size Homer,"The drinking bird pressing Y: unattended automation, no monitoring, near meltdown",Automation Risk,"PR, DE","A.8.16, A.8.9, A.8.31"
The Simpsons,simpsons,fiction,Mother Simpson,Mona evades detection for decades: identity evasion beats institutional tracking,Identity Evasion,ID,"A.5.16, A.8.16"
The Simpsons,simpsons,fiction,Sideshow Bob's Last Gleaming,The stolen nuke is a dud: unmaintained legacy assets nobody decommissioned,Legacy Risk,ID,"A.5.9, A.8.8, A.8.10"
The Simpsons,simpsons,fiction,Marge Be Not Proud,Bart caught on store security video: surveillance evidence ends the denial,Evidence,DE,"A.8.15, A.5.28"
The Simpsons,simpsons,fiction,Lisa the Iconoclast,"Lisa finds the Jebediah confession, chooses not to publish: responsible disclosure judgment",Disclosure,GV,"A.5.14, A.5.12"
The Simpsons,simpsons,fiction,Homer the Smithers,"Homer replaces Smithers, Burns accidentally learns self-sufficiency: single point of failure removed",Bus Factor,"GV, RC","A.5.2, A.5.30"
The Simpsons,simpsons,fiction,You Only Move Twice,"Hank Scorpio: Homer never notices he works for a supervillain, employees blind to what the org does",Insider Awareness,"GV, ID","A.6.3, A.5.12"
The Simpsons,simpsons,fiction,Homer's Enemy,Frank Grimes sees every failure clearly and the org destroys him: the ignored auditor,Ignored Auditor,GV,"A.5.2, A.5.35"
The Simpsons,simpsons,fiction,Homer vs. the Eighteenth Amendment,"Beer Baron bowling ball pipeline: covert exfiltration channel nobody inspects, rigid new sheriff fails",Covert Channels,"DE, GV","A.8.12, A.8.16, A.5.2"
The Simpsons,simpsons,fiction,Grade School Confidential,Bart brokers the Skinner-Krabappel secret for leverage: the info broker inside the org,Data Leakage,PR,"A.5.14, A.6.2"
The Simpsons,simpsons,fiction,The Joy of Sect,"The Movementarians: mass social engineering funnels, leader exits with the money",Social Engineering,"PR, GV",A.6.3
The Simpsons,simpsons,fiction,Trash of the Titans,"Homer blows the annual sanitation budget in a month: resource exhaustion, promises without capacity",Resource Mgmt,GV,"A.5.1, A.5.2"
The Simpsons,simpsons,fiction,Lisa the Skeptic,"The angel skeleton is a marketing hoax: fabricated artifact, mass belief before verification",Misinformation,"ID, DE","A.5.7, A.5.28"
The Simpsons,simpsons,fiction,Miracle on Evergreen Terrace,"Bart's lie brings town charity, truth surfaces on live TV: fraud plus public disclosure fallout",Fraud,"GV, RS","A.5.26, A.5.27"
The Simpsons,simpsons,fiction,The Cartridge Family,"Homer's gun handling: dangerous tool, zero safety discipline, hidden from the household",Unsafe Handling,PR,"A.5.10, A.6.3, A.7.10"
The Simpsons,simpsons,fiction,Mayored to the Mob,Rat milk supplied to schools: supply chain contamination from an unvetted supplier,Supply Chain,"GV, ID","A.5.19, A.5.21"
The Simpsons,simpsons,fiction,When You Dish Upon a Star,"Homer sells celebrity secrets after being trusted: NDA breach, monetizing confidential access",Data Leakage,"PR, GV","A.5.14, A.6.2, A.6.5"
The Simpsons,simpsons,fiction,Homer to the Max,Homer becomes Max Power to escape his reputation: identity rebrand as reputation laundering,Identity,ID,A.5.16
The Simpsons,simpsons,fiction,Grift of the Magi,Funzo toys built to destroy competitor toys: malicious functionality shipped in a trusted product,Supply Chain,"ID, PR","A.5.21, A.8.29, A.8.30"
The Simpsons,simpsons,fiction,E-I-E-I-D'oh,"Tomacco: addictive product engineered on purpose, demand outruns control instantly",Product Risk,GV,"A.5.8, A.8.25"
The Simpsons,simpsons,fiction,The Computer Wore Menace Shoes,"Homer's fake news site spreads unchecked, then The Island: misinformation plus what happens to people who know too much",Misinformation,ID,"A.5.7, A.5.14"
The Simpsons,simpsons,fiction,Trilogy of Error,Linguo overloads on bad grammar and explodes: input validation failure on malformed data,Input Validation,PR,"A.8.26, A.8.28"
The Simpsons,simpsons,fiction,Worst Episode Ever,Bootleg video operation in the store basement: pirated content ops behind a legitimate front,Piracy,DE,"A.5.32, A.8.16"
The Simpsons,simpsons,fiction,HOMR,Homer removes the crayon fix to go back to comfortable: users disabling the control that fixed the problem,User Behavior,PR,"A.6.3, A.8.9"
The Simpsons,simpsons,fiction,Half-Decent Proposal,Artie's webcam spying on Marge: stalkerware and covert surveillance by someone she knows,Stalkerware,"PR, DE","A.8.16, A.5.34"
The Simpsons,simpsons,fiction,Blame It on Lisa,Mystery charge to Brazil on the phone bill: fraud investigation starts with one weird line item,Fraud Detection,DE,"A.8.15, A.5.25"
The Simpsons,simpsons,fiction,C.E. D'oh,The plant is legally owned by a canary: ownership obfuscation through shell structures,Obfuscation,"GV, ID","A.5.31, A.5.9"
The Simpsons,simpsons,fiction,Mr. Spritz Goes to Washington,Krusty elected to fix one family's problem: regulatory capture in miniature,Governance,GV,"A.5.31, A.5.36"
The Simpsons,simpsons,fiction,The Ziff Who Came to Dinner,Artie dumps his SEC fraud onto Homer via stock transfer: fraud scapegoating through paper trails,Fraud,"GV, DE","A.5.28, A.5.31"
The Simpsons,simpsons,fiction,Fraudcast News,"Burns buys every media outlet in town, Lisa's zine survives: information monopoly vs independent channels",Info Control,GV,"A.5.14, A.5.29"
The Simpsons,simpsons,fiction,Pranksta Rap,"Bart fakes his own kidnapping, Wiggum buries the exculpatory evidence: false report plus evidence tampering",Evidence Tampering,"DE, RS","A.5.28, A.5.26"
The Simpsons,simpsons,fiction,Midnight Rx,Prescription drug runs to Canada: shadow procurement when official channels fail people,Shadow IT,GV,"A.5.19, A.5.23"
The Simpsons,simpsons,fiction,The Italian Bob,Bob's criminal past hidden from an entire Italian village: background vetting gap in a position of trust,Vetting,"ID, PR","A.6.1, A.5.16"
The Simpsons,simpsons,fiction,"Please Homer, Don't Hammer 'Em",Bart and Skinner each hold the other's allergy: mutually assured destruction via known vulnerabilities,Vuln Disclosure,ID,"A.8.8, A.5.14"
The Simpsons,simpsons,fiction,24 Minutes,"CTU Springfield vs the stink bomb: a school SOC running detection, informants, and a ticking clock",SOC Operations,"DE, RS","A.8.16, A.5.26"
The Simpsons,simpsons,fiction,You Kent Always Say What You Want,"Kent Brockman's hot mic moment ends his career: live channel discipline, one slip is permanent",Comms Discipline,PR,"A.5.14, A.6.4"
The Simpsons,simpsons,fiction,The Debarted,"Donny the planted informant vs Bart: counterintelligence, the mole hunt, divided loyalty",Counterintel,"ID, DE","A.6.1, A.8.16"
The Simpsons,simpsons,fiction,Mona Leaves-a,Mona's posthumous sabotage of Burns' launch: the final mission triggers after she's gone,Hacktivism,"DE, RS","A.7.6, A.5.26"
The Simpsons,simpsons,fiction,MyPods and Boomsticks,"Bart impersonates Steve Mobs over the Mapple store PA: spoofed executive comms, crowd believes instantly",Exec Spoofing,"PR, DE","A.5.16, A.6.3"
The Simpsons,simpsons,fiction,Lost Verizon,"Bart runs a found celebrity phone, Marge implants a GPS tracker: lost device abuse and surveillance tradeoffs",Device Security,PR,"A.8.1, A.7.9, A.5.34"
The Simpsons,simpsons,fiction,To Surveil with Love,"Citywide CCTV after a scare, one blind spot in Homer's yard becomes the crime hub: surveillance gaps and privacy backlash",Surveillance,"GV, DE","A.8.16, A.5.34, A.7.4"
The Simpsons,simpsons,fiction,The Bob Next Door,Bob face-swaps with his cellmate: biometric spoofing at its most literal,Biometric Spoofing,"PR, DE","A.5.16, A.8.5"
The Simpsons,simpsons,fiction,American History X-cellent,Smithers runs the plant as a tyrant while Burns is jailed: the deputy abusing inherited privilege,Privilege Abuse,"GV, PR","A.8.2, A.5.3"
The Simpsons,simpsons,fiction,Bart Gets a Z,"Bart spikes the coffee, Krabappel fired for the outcome: tampering punished on effect, not cause",Tampering,"DE, RS","A.5.25, A.5.28"
The Simpsons,simpsons,fiction,500 Keys,Lisa's key ring opens everything in Springfield: master credential sprawl nobody ever audited,Access Sprawl,"PR, ID","A.5.18, A.5.17, A.7.2"
The Simpsons,simpsons,fiction,The Great Simpsina,"Lisa entrusted with the milk can escape secret, rival magicians phish it out of her: trade secret social engineering",Trade Secrets,PR,"A.5.14, A.6.3, A.5.33"
The Simpsons,simpsons,fiction,Donnie Fatso,"Homer wears a wire into Fat Tony's crew: covert collection, then handler sympathy compromises the op",Covert Ops,DE,"A.8.16, A.5.28"
The Simpsons,simpsons,fiction,The Book Job,The ghostwriting fraud ring gets infiltrated by Neil Gaiman who steals the credit: the long con inside the con,Fraud,"ID, DE","A.6.1, A.5.28"
The Simpsons,simpsons,fiction,The D'oh-cial Network,"Lisa's SpringFace: engagement addiction, data collection, and a class action ending",Data Privacy,GV,"A.5.34, A.8.10"
The Simpsons,simpsons,fiction,A Totally Fun Thing That Bart Will Never Do Again,Bart fakes an outbreak broadcast to extend the cruise: fake emergency alert hijacks everyone's behavior,Fake Alerts,"RS, DE","A.5.25, A.5.14"
The Simpsons,simpsons,fiction,Hardly Kirk-ing,Milhouse shaves his head and passes as Kirk: identity spoofing that unlocks adult privileges,Identity Spoofing,PR,"A.5.16, A.8.5"
The Simpsons,simpsons,fiction,Dangers on a Train,"Marge lands on an affair site thinking it's a dessert club: deceptive UX, dark pattern onboarding",Dark Patterns,PR,"A.6.3, A.5.34"
The Simpsons,simpsons,fiction,Homerland,"Homer comes back from a conference acting different, Lisa investigates: the insider threat investigation playbook",Insider Threat,"ID, DE","A.6.1, A.8.16, A.5.25"
The Simpsons,simpsons,fiction,Steal This Episode,Homer's backyard piracy screenings draw the FBI: IP enforcement escalates way past the crime,Piracy,"GV, RS","A.5.32, A.5.26"
The Simpsons,simpsons,fiction,Opposites A-Frack,Fracking under homes without disclosure: hidden exploitation of assets people thought were theirs,Hidden Exploitation,"GV, ID","A.5.31, A.5.34"
The Simpsons,simpsons,fiction,Sky Police,"Wiggum gets a jetpack: powerful new tool, zero process maturity behind it",Tooling,"GV, PR","A.8.9, A.5.37"
The Simpsons,simpsons,fiction,The Girl Code,"Lisa's app predicts consequences of posts before you share: DLP for your social life, Homer already fired by one photo",DLP,PR,"A.8.12, A.6.3, A.5.34"
The Simpsons,simpsons,fiction,Cue Detective,The stolen smoker traced by the kids: asset theft forensics from scent to source,Asset Theft,DE,"A.5.28, A.7.10"
The Simpsons,simpsons,fiction,Halloween of Horror,Real intruders on Halloween night: actual threats hiding inside expected noise,Signal vs Noise,"DE, RS","A.8.16, A.5.26"
The Simpsons,simpsons,fiction,The Great Phatsby,"Burns swindled by a con-artist mogul: whale phishing, executive-targeted long con",Whale Phishing,"PR, ID","A.6.3, A.5.19"
The Simpsons,simpsons,fiction,Trust But Clarify,Kent's fabricated reporting exposed by Lisa's fact-checking: source verification beats authority,Verification,"ID, DE","A.5.7, A.5.28"
The Simpsons,simpsons,fiction,Whistler's Father,Marge reports the mob's shoddy construction: whistleblower risk when the builder is Fat Tony,Whistleblowing,"GV, RS","A.5.26, A.6.4"
The Simpsons,simpsons,fiction,Homer Is Where the Art Isn't,Homer accused of the painting heist: physical asset theft investigation with the obvious suspect wrong,Investigation,DE,"A.5.28, A.7.10"
The Simpsons,simpsons,fiction,Frink Gets Testy,Burns' doomsday ark selection testing: continuity planning built on flawed selection criteria,Continuity,"GV, RC","A.5.29, A.5.30"
The Simpsons,simpsons,fiction,Baby You Can't Drive My Car,CarGo showers the town with cushy jobs while harvesting everyone's data: collection hidden behind perks,Data Harvesting,"GV, ID","A.5.34, A.5.19"
The Simpsons,simpsons,fiction,E My Sports,"Bart's esports run: new platform, new integrity risks, adults with no idea how it works",New Attack Surface,ID,"A.5.7, A.6.3"
The Simpsons,simpsons,fiction,Bart's Not Dead,Bart's fabricated heaven story gets a movie deal: false testimony monetized at scale,Fraud,GV,"A.5.14, A.5.27"
The Simpsons,simpsons,fiction,Frinkcoin,"Frink invents a cryptocurrency, Burns races to beat it: crypto speculation, wealth on paper, volatility in practice",Crypto Risk,"ID, GV","A.5.7, A.5.23"
The Simpsons,simpsons,fiction,Bart the Bad Guy,"Bart extorts the town with movie spoilers, the studio deploys a fake ending as a countermeasure: data extortion vs a canary defense",Extortion,"RS, DE","A.5.26, A.8.12"
The Simpsons,simpsons,fiction,The Winter of Our Monetized Content,Homer and Bart monetize their fights: outrage content as a business model,Content Risk,GV,"A.5.14, A.5.10"
The Simpsons,simpsons,fiction,The Miseducation of Lisa Simpson,The STEM school's algorithm quietly sorts kids into menial-job tracks: AI bias behind a shiny interface,AI Bias,"GV, ID","A.5.34, A.8.25"
The Simpsons,simpsons,fiction,Undercover Burns,Burns goes undercover in his own plant via robot disguise: covert executive monitoring of the workforce,Covert Monitoring,"DE, GV","A.8.16, A.5.34"
The Simpsons,simpsons,fiction,The Man from G.R.A.M.P.A.,"Grampa suspected of being a Cold War sleeper agent: decades-dormant asset, allegiance never re-verified",Sleeper Agent,ID,"A.6.1, A.5.16"
The Simpsons,simpsons,fiction,Podcast News,"Grampa accused by a true crime podcast: trial by content creator, evidence optional",Misinformation,ID,"A.5.7, A.5.28"
The Simpsons,simpsons,fiction,Diary Queen,"Bart finds Krabappel's diary: private data of the deceased, handling and respect questions",Data Handling,GV,"A.5.34, A.8.10"
The Simpsons,simpsons,fiction,Bart's in Jail!,"Grampa falls for the grandparent phone scam: elder vishing, urgency plus emotion beats skepticism",Vishing,"PR, DE","A.6.3, A.5.25"
The Simpsons,simpsons,fiction,The Wayz We Were,The navigation app reroutes lives: algorithmic routing steering behavior at scale,Algorithm Risk,"GV, ID","A.5.34, A.5.23"
The Simpsons,simpsons,fiction,Pixelated and Afraid,Homer and Marge stranded with no tech: total dependency exposed the moment it's gone,Tech Dependency,RC,"A.5.29, A.5.30"
The Simpsons,simpsons,fiction,A Serious Flanders (Pts 1-2),"The debt collector who never stops: ransom-style leverage, paying doesn't end it",Extortion,RS,"A.5.26, A.5.7"
The Simpsons,simpsons,fiction,Lisa the Boy Scout,The whole broadcast hijacked by hackers claiming leaked footage: the episode itself is the breach,Broadcast Hijack,"DE, RS","A.8.16, A.5.26, A.8.20"
The Simpsons,simpsons,fiction,Habeas Tortoise,Homer joins an online conspiracy group after a public embarrassment: radicalization pipeline starts with wounded pride,Radicalization,ID,"A.5.7, A.6.3"
The Simpsons,simpsons,fiction,Game Done Changed,"Bart scams kids inside a Roblox-style game, Marge becomes an in-game cop: kid-targeted fraud and platform moderation",Platform Fraud,"PR, DE","A.6.3, A.8.16, A.5.34"
The Simpsons,simpsons,fiction,My Life as a Vlog,"The family vlog machine: child influencer content, consent, and monetized childhood",Child Data,GV,"A.5.34, A.5.10"
The Simpsons,simpsons,fiction,Thirst Trap: A Corporate Love Story,"The Theranos-style water startup: fake tech, dazzled investors, documentary autopsy",Startup Fraud,"GV, ID","A.5.19, A.5.21, A.5.28"
The Simpsons,simpsons,fiction,McMansion & Wife,The perfect new neighbor is a long-con artist: pretexting sustained over months,Long Con,"PR, ID","A.6.3, A.5.16"
The Simpsons,simpsons,fiction,Homer's Crossing,Homer's crossing guard gig becomes a security empire: mission creep until the guards are the threat,Mission Creep,GV,"A.5.2, A.5.3"
The Simpsons,simpsons,fiction,Night of the Living Wage,The ghost kitchen grind: gig platforms extracting from workers with no protections,Gig Economy,GV,"A.6.2, A.5.19"
The Simpsons,simpsons,fiction,Bart's Birthday,"The fake AI-written series finale: AI-generated content passed off as the real thing, spot the tells",AI Deception,"ID, DE","A.5.7, A.8.25"
The Simpsons,simpsons,fiction,Shoddy Heat,"Grampa's noir cold case: decades-old evidence, memory as an unreliable log source",Cold Case,DE,"A.5.28, A.8.15"
100 Years of Incidents,100-years-of-incidents,real,Victor Lustig sells the Eiffel Tower,"Forged government credentials, fake urgency, a mark too embarrassed to report it: the social engineering blueprint, twice",Social Engineering,PR,"A.6.3, A.5.16"
100 Years of Incidents,100-years-of-incidents,real,War of the Worlds broadcast,A dramatized alert taken as real by some listeners: fake emergency broadcasts move people before verification does,Fake Alerts,ID,"A.5.14, A.5.7"
100 Years of Incidents,100-years-of-incidents,real,Enigma broken (Ultra),The Allies read German traffic for years and hide that they can: protecting sources and methods over using every win,Crypto / SIGINT,"PR, GV","A.8.24, A.5.12"
100 Years of Incidents,100-years-of-incidents,real,Operation Mincemeat,"A corpse with forged papers redirects German defenses from Sicily: disinformation with fabricated provenance, fully believed",Disinformation,ID,"A.5.7, A.5.28"
100 Years of Incidents,100-years-of-incidents,real,"Manhattan Project espionage (Fuchs, Rosenbergs)","Spies inside the most compartmentalized program ever built: clearance is not loyalty, vetting is not continuous",Espionage,ID,"A.6.1, A.5.13"
100 Years of Incidents,100-years-of-incidents,real,Cambridge Five exposed (Burgess/Maclean defect),Decades of Soviet moles at the top of British intelligence: social class treated as a background check,Insider Espionage,"ID, GV","A.6.1, A.5.3"
100 Years of Incidents,100-years-of-incidents,real,Great Train Robbery (UK),"Signal tampering stops the train, insider knowledge picks it: physical attack enabled by process intel",Physical Attack,PR,"A.7.1, A.5.14"
100 Years of Incidents,100-years-of-incidents,real,Phone phreaking era (blue boxes),A toy whistle hits 2600 Hz and the phone network obeys: in-band signaling means control and data share a channel,Protocol Flaw,PR,"A.8.20, A.8.22"
100 Years of Incidents,100-years-of-incidents,real,"FBI Media, PA burglary",Activists steal files exposing COINTELPRO: one physical breach reveals a decade of covert surveillance,Physical Breach,"PR, GV","A.7.1, A.5.34"
100 Years of Incidents,100-years-of-incidents,real,Watergate,"The break-in, the taps, and above all the cover-up: response failures outlive the original incident",Cover-Up,"RS, GV","A.5.26, A.5.27, A.5.28"
100 Years of Incidents,100-years-of-incidents,real,John Walker spy ring busted,"A Navy warrant officer sells crypto material for 17 years, recruits his own family: the insider franchise nobody re-vetted",Insider Espionage,"ID, DE","A.6.1, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,The Cuckoo's Egg,A 75-cent accounting error leads Cliff Stoll to KGB-linked hackers: anomaly investigation as the origin story of threat hunting,Threat Hunting,DE,"A.8.15, A.8.16, A.5.28"
100 Years of Incidents,100-years-of-incidents,real,Brain virus,"The first PC virus spreads on floppies from Pakistan, with the authors' names and address inside: malware era begins politely",Malware,PR,A.8.7
100 Years of Incidents,100-years-of-incidents,real,Morris Worm,"A grad student's worm knocks out roughly a tenth of the internet by accident: self-replication with no throttle, first CFAA conviction",Worm,"PR, RS","A.8.7, A.8.8, A.5.26"
100 Years of Incidents,100-years-of-incidents,real,AIDS Trojan (first ransomware),"20,000 mailed floppies encrypt file names and demand payment to a PO box: ransomware is older than the web",Ransomware,"PR, RC","A.8.7, A.8.13"
100 Years of Incidents,100-years-of-incidents,real,Kevin Poulsen wins a Porsche,"Takes over a radio station's phone lines to be caller 102: control the channel, control the contest",Telecom Hack,PR,"A.8.20, A.8.5"
100 Years of Incidents,100-years-of-incidents,real,Citibank / Vladimir Levin ($10M),"Wire transfers siphoned remotely from St. Petersburg: online bank theft arrives, most funds recovered because banks watched",Financial Theft,"DE, RS","A.8.16, A.5.26"
100 Years of Incidents,100-years-of-incidents,real,Kevin Mitnick arrested,Years of intrusions built mostly on phone calls and confidence: social engineering beats every firewall of the era,Social Engineering,PR,"A.6.3, A.5.16"
100 Years of Incidents,100-years-of-incidents,real,Barings Bank collapse (Leeson),One trader settles his own trades and hides losses in account 88888: zero separation of duties kills a 233-year-old bank,Rogue Insider,"GV, DE","A.5.3, A.8.15, A.5.35"
100 Years of Incidents,100-years-of-incidents,real,ILOVEYOU worm,"A love letter attachment from Manila infects tens of millions in a day: curiosity is the exploit, email is the vector",Worm / Phishing,PR,"A.8.7, A.6.3"
100 Years of Incidents,100-years-of-incidents,real,Mafiaboy DDoS,"A 15-year-old knocks Yahoo, CNN, and eBay offline: the biggest sites fall to a teenager with borrowed tools",DDoS,RS,"A.8.20, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Enron / Arthur Andersen,"Fraud at the top, shredders running as investigators arrive: evidence destruction ends the auditor too, SOX is the aftermath",Fraud / Destruction,GV,"A.5.28, A.5.33, A.5.35"
100 Years of Incidents,100-years-of-incidents,real,SQL Slammer,"376 bytes, no file, doubles every 8.5 seconds: the patch existed for six months, the worm needed ten minutes",Unpatched Systems,PR,"A.8.8, A.8.19"
100 Years of Incidents,100-years-of-incidents,real,VA laptop theft,"One stolen laptop, 26.5 million veterans' records: unencrypted data walks out in a bag",Lost Device,PR,"A.8.1, A.7.9, A.8.24"
100 Years of Incidents,100-years-of-incidents,real,TJX breach (45M cards),Cracked WEP wifi in a store parking lot leads to the whole card environment: weak wireless plus flat network,Retail Breach,PR,"A.8.20, A.8.22, A.8.24"
100 Years of Incidents,100-years-of-incidents,real,Estonia DDoS,"A statue dispute triggers weeks of nation-scale DDoS: the first country-level cyber conflict, NATO takes notes",Nation-State,"RS, GV","A.5.29, A.5.7"
100 Years of Incidents,100-years-of-incidents,real,"Société Générale (Kerviel, EUR 4.9B)",A trader who knew the back office bypasses every control he used to enforce: insider knowledge of the monitoring is the exploit,Rogue Insider,"DE, GV","A.5.3, A.8.16, A.5.35"
100 Years of Incidents,100-years-of-incidents,real,Madoff Ponzi collapses ($65B),"Markopolos hands the SEC the math for years and is ignored: the whistleblower filed, nobody read",Ignored Warnings,GV,"A.5.35, A.5.25"
100 Years of Incidents,100-years-of-incidents,real,Operation Aurora,China-linked intrusion into Google and dozens of firms targeting source code and dissident accounts: IP theft goes public,Nation-State,"ID, DE","A.5.7, A.8.16, A.5.33"
100 Years of Incidents,100-years-of-incidents,real,Stuxnet,"Crosses an air gap on USB, spoofs sensor readings while destroying centrifuges: OT sabotage where the instruments lie to the operators",OT Sabotage,"PR, DE","A.8.22, A.7.10, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,RSA SecurID breach,"One phishing email at a security company compromises the seeds behind defense contractors' tokens: attack the trust vendor, inherit its customers",Supply Chain,"ID, PR","A.5.19, A.5.21, A.6.3"
100 Years of Incidents,100-years-of-incidents,real,DigiNotar CA compromise,"A certificate authority is breached and rogue certs intercept Iranian Gmail: when trust infrastructure falls, everything above it does",Trust Infrastructure,"GV, RC","A.8.24, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Shamoon (Saudi Aramco),"30,000 workstations wiped in hours, business runs on fax and paper for weeks: destructive malware plus no segmentation",Destructive Malware,"RC, PR","A.8.13, A.8.22, A.5.30"
100 Years of Incidents,100-years-of-incidents,real,Knight Capital ($440M in 45 min),"A deployment leaves old code live on one of eight servers: change management failure at market speed, firm gone in under an hour",Change Mgmt,"PR, RS","A.8.32, A.8.31, A.5.26"
100 Years of Incidents,100-years-of-incidents,real,Target breach (40M cards),"HVAC vendor credentials, flat network to POS, alerts fired and were ignored: third-party access plus alert fatigue",Vendor Access,"PR, DE","A.5.19, A.8.22, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,Snowden,"A contractor sysadmin exfiltrates the crown jewels on removable media: privileged access, no DLP, and the debate that followed",Insider / DLP,"PR, DE","A.8.2, A.8.12, A.7.10"
100 Years of Incidents,100-years-of-incidents,real,Yahoo breaches (3B accounts),"All three billion accounts, disclosed years later mid-acquisition: breach plus disclosure failure, priced into the sale",Disclosure Failure,"GV, RS","A.5.27, A.5.34, A.5.26"
100 Years of Incidents,100-years-of-incidents,real,Sony Pictures hack,"North Korea wipes systems and leaks everything over a movie: destructive attack plus data dump, threat model never included this adversary",Nation-State,"ID, RC","A.5.7, A.8.13, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Heartbleed,A memory bug in OpenSSL exposes keys across the internet: the critical dependency maintained by a handful of underfunded volunteers,Dependency Risk,"ID, PR","A.8.8, A.5.21"
100 Years of Incidents,100-years-of-incidents,real,OPM breach (21.5M clearance files),"SF-86 background files, fingerprints, the secrets of everyone with a clearance: the counterintelligence loss of a generation",Nation-State,"ID, PR","A.5.12, A.8.5, A.5.34"
100 Years of Incidents,100-years-of-incidents,real,Ashley Madison,"Breach, extortion, and real-world harm to users: some data should never have been retained at all",Data Retention,GV,"A.8.10, A.5.34"
100 Years of Incidents,100-years-of-incidents,real,Ukraine power grid (BlackEnergy),"First confirmed cyber-caused blackout, operators watch their own cursors open breakers: OT compromise with hands on the controls",OT Attack,"PR, RS","A.8.22, A.5.26, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Bangladesh Bank / SWIFT ($81M),"$951M in fraudulent transfers, mostly stopped because 'fandation' was misspelled: a typo as the last line of defense",Financial Theft,"DE, RS","A.8.16, A.5.26, A.8.5"
100 Years of Incidents,100-years-of-incidents,real,Mirai / Dyn DDoS,"IoT devices with default passwords form a botnet that takes down half the internet's front door: the cheapest devices, the biggest gun",IoT / DDoS,PR,"A.8.9, A.5.17, A.8.20"
100 Years of Incidents,100-years-of-incidents,real,Uber breach cover-up,"Hackers paid off through the bug bounty to sign NDAs, disclosed a year later: the CSO conviction that changed the job",Cover-Up,"GV, RS","A.5.26, A.5.27, A.5.34"
100 Years of Incidents,100-years-of-incidents,real,WannaCry,Leaked NSA exploit plus unpatched Windows freezes the NHS: a researcher's killswitch domain stops it almost by accident,Ransomware,"PR, RS","A.8.8, A.8.7, A.5.26"
100 Years of Incidents,100-years-of-incidents,real,NotPetya ($10B+),"A poisoned Ukrainian tax software update wipes Maersk, Merck, and more worldwide: supply chain delivery, destructive payload, one surviving domain controller in Ghana",Supply Chain,"PR, RC","A.5.21, A.8.13, A.5.30"
100 Years of Incidents,100-years-of-incidents,real,Equifax (147M),"A known Apache Struts vuln, unpatched for two months, an expired cert blinding the monitoring: every basic failed at once",Unpatched Systems,"PR, DE","A.8.8, A.8.16, A.5.27"
100 Years of Incidents,100-years-of-incidents,real,Marriott/Starwood (500M),"Attackers lived in Starwood's network four years, inherited through acquisition: M&A due diligence never looked",M&A Risk,"ID, DE","A.5.19, A.8.16, A.5.9"
100 Years of Incidents,100-years-of-incidents,real,Cambridge Analytica,A personality quiz harvests friends-of-friends at scale: consent laundering through platform APIs,Data Misuse,GV,"A.5.34, A.5.14"
100 Years of Incidents,100-years-of-incidents,real,Capital One (106M),"An SSRF through a misconfigured WAF, found by an ex-employee of the cloud provider: cloud misconfiguration plus insider knowledge",Cloud Misconfig,"PR, DE","A.8.9, A.5.23, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,SolarWinds / SUNBURST,"The build system itself is compromised, malware ships inside signed updates to 18,000 orgs: trust in the update channel weaponized",Supply Chain,"ID, PR, DE","A.5.21, A.8.28, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,Twitter Bitcoin hack,Teenagers phone-phish employees into admin tools and tweet as Obama and Musk: internal panels with god mode and thin access control,Social Engineering,PR,"A.6.3, A.8.2, A.5.15"
100 Years of Incidents,100-years-of-incidents,real,Colonial Pipeline,"One leaked VPN password, no MFA, fuel panic across the US East Coast: a single credential shuts down critical infrastructure",Ransomware,"PR, RS","A.5.17, A.8.5, A.5.26, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Kaseya VSA,"Ransomware pushed through an MSP management tool to ~1,500 downstream businesses: the RMM as the blast radius multiplier",MSP Supply Chain,"PR, GV","A.5.21, A.5.19, A.8.32"
100 Years of Incidents,100-years-of-incidents,real,Log4Shell,"A logging library everyone uses, exploitable with one string: the ubiquitous dependency nobody inventoried",Dependency Risk,"ID, PR","A.8.8, A.5.9"
100 Years of Incidents,100-years-of-incidents,real,Oldsmar water plant,"Remote access tooling on the treatment system, lye setpoint raised 100x, caught by an operator watching the mouse: OT remote access with no controls",OT Attack,"PR, DE","A.8.22, A.6.7, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,Lapsus$,"Teenagers with SIM swaps, bribes, and MFA fatigue breach Okta, Nvidia, Microsoft: GTA6 leaked from a hotel room with a Fire Stick",Social Engineering,PR,"A.6.3, A.8.5, A.5.17"
100 Years of Incidents,100-years-of-incidents,real,Uber (MFA fatigue),"Push-bomb the contractor until they tap approve, then find the PAM credentials in a network share: MFA exists, design defeats it",MFA Fatigue,PR,"A.8.5, A.6.3, A.5.17"
100 Years of Incidents,100-years-of-incidents,real,FTX collapse,"Billions moved on trust with no controls, records in QuickBooks and Slack: governance so absent the bankruptcy CEO called it unprecedented",Fraud / Governance,GV,"A.5.1, A.5.3, A.5.35"
100 Years of Incidents,100-years-of-incidents,real,Ronin Bridge ($625M),"An engineer opens a fake job offer PDF, attacker gets 5 of 9 validator keys: recruitment phishing into key custody",Crypto Heist,PR,"A.6.3, A.5.17, A.8.24"
100 Years of Incidents,100-years-of-incidents,real,MOVEit mass exploitation,"One file transfer product's zero-day hits 2,700+ organizations through their vendors' vendors: fourth-party risk goes mainstream",Supply Chain,"ID, RS","A.5.19, A.5.21, A.8.8"
100 Years of Incidents,100-years-of-incidents,real,MGM / Caesars (Scattered Spider),A ten-minute vishing call to the help desk resets the wrong account: identity verification at the service desk as the perimeter,Vishing,PR,"A.6.3, A.5.16, A.5.17"
100 Years of Incidents,100-years-of-incidents,real,23andMe,Credential stuffing on reused passwords exposes relative-matching data: your security inherits your users' other breaches,Credential Stuffing,PR,"A.5.17, A.8.5"
100 Years of Incidents,100-years-of-incidents,real,Change Healthcare,"No MFA on one Citrix portal freezes US healthcare payments for weeks, $22M ransom paid: concentration risk plus a basic control gap",Ransomware,"PR, RC","A.8.5, A.5.29, A.5.30"
100 Years of Incidents,100-years-of-incidents,real,XZ Utils backdoor,"Years of patient social engineering to become an open source maintainer, caught by 500ms of SSH latency: the long con against the commons",Supply Chain,"ID, DE","A.5.21, A.8.28, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,CrowdStrike update outage,"A faulty content update blue-screens 8.5M Windows machines, grounds airlines: not an attack, pure single-vendor concentration and staged rollout failure",Vendor Concentration,"GV, RC","A.5.19, A.8.32, A.5.30"
100 Years of Incidents,100-years-of-incidents,real,Snowflake customer breaches,"Stolen credentials, no MFA enforced on customer accounts, Ticketmaster and AT&T data taken: shared responsibility misread at scale",Cloud / MFA,"PR, GV","A.5.23, A.8.5, A.5.17"
100 Years of Incidents,100-years-of-incidents,real,Salt Typhoon,Telecom lawful-intercept systems compromised by nation-state actors: the wiretap infrastructure becomes the wiretap,Nation-State,"ID, DE","A.5.7, A.8.16, A.8.20"
100 Years of Incidents,100-years-of-incidents,real,Bybit heist (~$1.5B),"Largest crypto theft ever, signing interface manipulated so approvers authorized transfers they couldn't see: what you sign vs what you see",Crypto Heist,"PR, DE","A.8.24, A.5.17, A.8.16"
100 Years of Incidents,100-years-of-incidents,real,M&S / Co-op retail attacks,"Scattered Spider vishing empties UK retail shelves for weeks: help desk identity verification, again, at national scale",Vishing,"PR, RS","A.6.3, A.5.16, A.5.29"
100 Years of Incidents,100-years-of-incidents,real,Coinbase insider bribery,Overseas support contractors bribed to pull customer data for social engineering: outsourced access as the purchasable insider,Insider Bribery,"GV, PR","A.6.1, A.5.19, A.6.2"
100 Years of Incidents,100-years-of-incidents,real,Salesloft Drift OAuth breach,Stolen OAuth tokens from one chat integration open Salesforce data across hundreds of orgs: token trust chains as the new perimeter,SaaS Supply Chain,"PR, ID","A.5.23, A.5.21, A.8.5"
100 Years of Incidents,100-years-of-incidents,real,Jaguar Land Rover shutdown,"Production halted for weeks, suppliers downstream starved, ~GBP 1.9B: the costliest UK cyber event, resilience gap in manufacturing",Ransomware / OT,"RC, GV","A.5.29, A.5.30, A.8.22"
100 Years of Incidents,100-years-of-incidents,real,npm Shai-Hulud worm,Self-replicating malware spreads through package maintainer accounts: the developer supply chain worms itself,Supply Chain,"PR, DE","A.5.21, A.8.28, A.8.16"
Movies 2000-2026,movies-2000-2026,fiction,Memento,"Leonard runs his life off notes and tattoos he can't verify: untrusted logs, and the attacker editing your records is you",Data Integrity,"ID, DE","A.8.15, A.5.33"
Movies 2000-2026,movies-2000-2026,fiction,Panic Room,"The safe room holds and the attackers need what's inside it: secure enclave under siege, comms cut first",Physical Security,"PR, RS","A.7.1, A.7.4, A.5.29"
Movies 2000-2026,movies-2000-2026,fiction,Minority Report,Precrime and the eye swap: predictive policing bias plus biometric spoofing via literal transplant,Biometrics / AI,"GV, PR","A.5.34, A.8.5, A.5.16"
Movies 2000-2026,movies-2000-2026,fiction,The Bourne Identity,"The safe deposit box with cash, passports, and a gun: break-glass credentials done right, rogue program done wrong",Contingency Access,"PR, GV","A.5.17, A.5.29, A.5.3"
Movies 2000-2026,movies-2000-2026,fiction,The Departed,Moles running in both directions: counterintelligence where nobody's identity list is clean,Counterintel,"ID, DE","A.6.1, A.8.16"
Movies 2000-2026,movies-2000-2026,fiction,Casino Royale,Vesper: the trusted finance insider compromised through leverage on someone she loves,Insider Threat,"ID, PR","A.6.1, A.6.2"
Movies 2000-2026,movies-2000-2026,fiction,Live Free or Die Hard,"The fire sale: staged takedown of transport, finance, and utilities in sequence: cascading infrastructure attack",Infrastructure,"PR, RS","A.8.20, A.8.22, A.5.29"
Movies 2000-2026,movies-2000-2026,fiction,The Dark Knight,"The Joker attacks trust itself and burns the money: your threat model assumes profit motive, he doesn't have one",Threat Modeling,"ID, GV","A.5.7, A.5.8"
Movies 2000-2026,movies-2000-2026,fiction,The Dark Knight,"The sonar phone network: mass surveillance built for one incident, Lucius destroys it after: capability with an expiry",Surveillance Ethics,GV,"A.5.34, A.8.10"
Movies 2000-2026,movies-2000-2026,fiction,Slumdog Millionaire,Jamal accused because his knowledge looks statistically impossible: anomaly detection generating a false positive,False Positives,DE,"A.8.16, A.5.25"
Movies 2000-2026,movies-2000-2026,fiction,The Social Network,"Facemash built by scraping dorm directories in one night: data scraping, then years of IP ownership warfare",Data Scraping,"GV, ID","A.5.32, A.5.33, A.5.34"
Movies 2000-2026,movies-2000-2026,fiction,Inception,"Planting an idea so the target thinks it's theirs: social engineering at the deepest layer, defenses (projections) attack intruders",Social Engineering,"PR, DE","A.6.3, A.8.16"
Movies 2000-2026,movies-2000-2026,fiction,The Girl with the Dragon Tattoo,"Lisbeth owns Wennerstrom's finances from a laptop: unauthorized access as investigation, hacker as protagonist",Hacking,"DE, ID","A.8.16, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,Skyfall,"Q plugs Silva's laptop straight into the MI6 network: malware analysis on production, the breach was the plan",Malware Handling,"PR, RS","A.8.7, A.8.22, A.5.26"
Movies 2000-2026,movies-2000-2026,fiction,Skyfall,Silva: the ex-insider who knows every system and grudge-matches the org that burned him,Insider Threat,"ID, PR","A.6.5, A.5.18"
Movies 2000-2026,movies-2000-2026,fiction,Argo,"Fake movie production as cover identity: exfiltration under a fully built pretext, every detail must verify",Cover Identity,PR,"A.5.16, A.6.3"
Movies 2000-2026,movies-2000-2026,fiction,Gravity,One destroyed satellite cascades into everything in orbit: single failure propagating through a shared environment,Cascading Failure,"ID, RC","A.8.6, A.5.29, A.5.30"
Movies 2000-2026,movies-2000-2026,fiction,Captain Phillips,The citadel protocol: crew locks down in a hardened space with comms while the perimeter is breached,Physical Security,"PR, RS","A.7.1, A.5.26, A.5.29"
Movies 2000-2026,movies-2000-2026,fiction,The Wolf of Wall Street,Pump and dump at industrial scale: fraud thriving wherever oversight is a formality,Fraud,"GV, DE","A.5.35, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,Ex Machina,"Ava social engineers her way out of containment through the tester's empathy: the AI breakout runs on people, not code",AI Containment,"GV, PR","A.8.25, A.6.3, A.5.8"
Movies 2000-2026,movies-2000-2026,fiction,The Imitation Game,"Breaking Enigma, then hiding that it's broken: protecting sources and methods matters more than using every win",Sources & Methods,"GV, PR","A.5.12, A.5.14, A.8.24"
Movies 2000-2026,movies-2000-2026,fiction,Kingsman,"Free SIM cards for everyone: the malicious free service, mass adoption is the attack",Supply Chain,"ID, PR","A.5.21, A.8.19"
Movies 2000-2026,movies-2000-2026,fiction,John Wick,"Markers and gold coins: trust tokens with absolute enforcement, break the rules and lose all access (excommunicado)",Trust Systems,"GV, PR","A.5.17, A.5.15, A.6.4"
Movies 2000-2026,movies-2000-2026,fiction,The Big Short,"Burry sees the vulnerability, everyone laughs until it detonates: the ignored vuln researcher, at economy scale",Ignored Warnings,"ID, GV","A.5.7, A.8.8, A.5.35"
Movies 2000-2026,movies-2000-2026,fiction,The Martian,Hexadecimal via a rotating camera: improvised out-of-band comms when every normal channel is gone,Incident Comms,"RS, RC","A.5.26, A.5.29, A.5.30"
Movies 2000-2026,movies-2000-2026,fiction,Spotlight,Institutional coverup unwound by patient records analysis: the investigation is document forensics,Investigation,DE,"A.5.28, A.8.15"
Movies 2000-2026,movies-2000-2026,fiction,Rogue One,"Galen Erso designs the exhaust port flaw on purpose, then his daughter exfiltrates the plans: insider-planted backdoor plus the ultimate data theft run",Backdoors / Exfil,"ID, PR, DE","A.8.28, A.8.12, A.6.1"
Movies 2000-2026,movies-2000-2026,fiction,Arrival,Establishing a protocol with an unknown party where misreading one word could end everything: communication before assumption,Protocol Design,"ID, GV","A.5.14, A.5.7"
Movies 2000-2026,movies-2000-2026,fiction,Snowden,"The contractor walks out with the crown jewels on a memory card: privileged access, no DLP, whistleblowing debate included",Insider / DLP,"PR, DE","A.8.12, A.8.2, A.7.10"
Movies 2000-2026,movies-2000-2026,fiction,Get Out,"The Armitage family's long con: months of grooming, the auction is a data sale, the sunken place is total account takeover",Long Con,"PR, ID","A.6.3, A.5.16"
Movies 2000-2026,movies-2000-2026,fiction,A Quiet Place,"Survival through emissions discipline: the monsters detect sound, so opsec is noise control: TEMPEST as a lifestyle",Emissions Security,PR,"A.8.12, A.7.8, A.5.37"
Movies 2000-2026,movies-2000-2026,fiction,Searching,"A father reconstructs his daughter's life from her accounts: OSINT on your own family, digital footprint as evidence",OSINT,"ID, DE","A.5.34, A.8.15"
Movies 2000-2026,movies-2000-2026,fiction,Ocean's 8,Insider placement at Vogue plus a 3D printed replica: counterfeit swap while the original walks out the door,Counterfeiting,"PR, DE","A.7.10, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,Parasite,"One forged diploma, then each family member gets the next one hired while displacing existing staff: staged infiltration via trusted referrals",Infiltration,"ID, PR","A.6.1, A.5.16, A.5.19"
Movies 2000-2026,movies-2000-2026,fiction,Knives Out,Marta physically cannot lie and Ransom builds his whole play on manipulating her: exploiting the honest node in the network,Social Engineering,"PR, DE","A.6.3, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,1917,"One message, hand carried through hostile territory because comms are cut: the secure courier when networks fail",Secure Transfer,"PR, RS","A.5.14, A.5.29"
Movies 2000-2026,movies-2000-2026,fiction,Tenet,Fighting an adversary who already knows your moves: assume breach taken to its logical extreme,Assume Breach,"ID, PR","A.5.7, A.8.16"
Movies 2000-2026,movies-2000-2026,fiction,Dune,"Dr. Yueh: the insider whose conditioning made him 'incorruptible', broken through leverage on his wife: no one is unphishable",Insider Threat,"ID, PR","A.6.1, A.6.3"
Movies 2000-2026,movies-2000-2026,fiction,No Time to Die,Heracles: a weapon targeted by DNA that spreads through touch: precision malware you can't recall once released,Targeted Weapons,"GV, ID","A.5.8, A.8.25"
Movies 2000-2026,movies-2000-2026,fiction,Free Guy,The stolen source code hiding inside a shipped game: IP theft proven by finding your own build in their product,Code Theft,"ID, DE","A.5.33, A.8.4, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,The Batman,"The Riddler radicalizes followers online and weaponizes leaked corruption files: doxxing as terrorism, the leak is the bomb",Doxxing,"ID, RS","A.5.34, A.5.14, A.5.26"
Movies 2000-2026,movies-2000-2026,fiction,Top Gun: Maverick,"The mission is a pentest of a hardened target: fly under detection, hit the vent, out before response: attack path planning as cinema",Red Team,"ID, PR","A.8.8, A.5.7"
Movies 2000-2026,movies-2000-2026,fiction,Glass Onion,Miles disables the Mona Lisa's protective glass for vanity and ships unsafe fuel: safety interlocks overridden by ego at the top,Safety Overrides,GV,"A.5.2, A.8.32, A.5.8"
Movies 2000-2026,movies-2000-2026,fiction,Glass Onion,"Helen impersonates her twin to investigate: identity spoofing for good, the napkin is provenance that survives the fire",Identity / Provenance,"PR, DE","A.5.16, A.5.33, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,M3GAN,The AI companion with no guardrails bonds with a child and escalates: attachment plus autonomy minus oversight,AI Safety,GV,"A.8.25, A.5.8"
Movies 2000-2026,movies-2000-2026,fiction,Everything Everywhere All at Once,"It all starts with an IRS audit: the mundane compliance review that unravels everything, records tell the story",Audit,"GV, DE","A.5.35, A.5.28"
Movies 2000-2026,movies-2000-2026,fiction,Oppenheimer,Fuchs spying inside Los Alamos while the clearance hearings weaponize old associations: espionage in the most compartmentalized org ever built,Espionage,"ID, GV","A.6.1, A.5.12, A.5.13"
Movies 2000-2026,movies-2000-2026,fiction,Oppenheimer,"The dual-use dilemma: building the capability means someone will use it, governance arrives after the fact",Dual Use,GV,"A.5.8, A.5.1"
Movies 2000-2026,movies-2000-2026,fiction,Mission: Impossible - Dead Reckoning,"The Entity: rogue AI inside every intelligence network, spoofing sensors until a submarine kills itself: trust in your own instruments as the attack surface",Rogue AI,"ID, DE, RS","A.8.16, A.8.25, A.5.7"
Movies 2000-2026,movies-2000-2026,fiction,The Killer,"The assassin's entire monologue is an opsec checklist: routine, patience, no improvisation, until one miss compounds",OPSEC,PR,"A.5.37, A.6.3"
Movies 2000-2026,movies-2000-2026,fiction,Leave the World Behind,"The three-stage collapse: isolate, sow misinformation, let people destroy each other: cyberattack as the opening move, not the whole war",Hybrid Attack,"ID, RS, RC","A.5.7, A.5.29, A.5.30"
Movies 2000-2026,movies-2000-2026,fiction,Dune: Part Two,"Feints, false retreats, and reading the enemy's rhythm: deception operations win before the battle starts",Deception Ops,"ID, PR","A.5.7, A.8.16"
Movies 2000-2026,movies-2000-2026,fiction,Wicked,The Wizard's whole regime is propaganda and a scapegoat: misinformation plus attribution manipulation as governance,Misinformation,"GV, ID","A.5.7, A.5.14"
Movies 2000-2026,movies-2000-2026,fiction,Sinners,"The vampires need an invitation to enter: access by explicit consent, and every tragedy starts with someone opening the door",Access Control,PR,"A.5.15, A.7.2, A.6.3"
Movies 2000-2026,movies-2000-2026,fiction,28 Years Later,"The quarantine perimeter a generation on: segmentation that held, and what leaks when someone crosses anyway",Segmentation,"PR, RC","A.8.22, A.5.29"
Movies 2000-2026,movies-2000-2026,fiction,Mission: Impossible - The Final Reckoning,Endgame against the Entity: killing a hostile AI that's embedded in everything you depend on: no clean shutdown exists,Rogue AI,"RS, RC","A.5.26, A.8.25, A.5.30"
Movies 2000-2026,movies-2000-2026,fiction,Tron: Ares,"A program crosses from the digital world into the physical one: when code gets a body, the attack surface is everywhere",AI Embodiment,"GV, ID","A.8.25, A.5.8"
Movies (Classic),movies-classic,fiction,Jurassic Park,"Underpaid admin with god access, no offboarding, no least privilege",Insider Threat,"GV, PR","A.5.18, A.6.2, A.6.5, A.8.2"
Movies (Classic),movies-classic,fiction,The Lion King,"Trusted insider with a grudge, unverified succession plan",Insider Threat,"GV, PR","A.5.3, A.6.4, A.8.2"
Movies (Classic),movies-classic,fiction,Office Space,"Salami slicing fraud, ghost employee, culture-driven insider risk",Insider Threat,"GV, PR, DE","A.5.18, A.6.5, A.8.15, A.8.16"
Movies (Classic),movies-classic,fiction,Legally Blonde,"Trusted authority abusing position, underestimated outsider gains access",Insider Threat,"GV, PR","A.6.4, A.5.15"
Movies (Classic),movies-classic,fiction,The Goonies (Sloth),Mistreated internal asset flips to the other side,Insider Threat,GV,"A.6.2, A.6.4"
Movies (Classic),movies-classic,fiction,Willy Wonka,Fake bribe offers as loyalty testing of insiders,Insider Threat,"GV, ID","A.6.1, A.6.3"
Movies (Classic),movies-classic,fiction,Home Alone,Recon and pretexting vs layered physical defense,Social Engineering,"PR, DE, RS","A.7.1, A.7.2, A.6.3"
Movies (Classic),movies-classic,fiction,Catch Me If You Can,"Pure impersonation, no technical exploit needed",Social Engineering,PR,"A.5.16, A.6.1, A.6.3"
Movies (Classic),movies-classic,fiction,The Sting,"Fully fake environment, phishing site with a cast",Social Engineering,"PR, DE","A.6.3, A.8.23"
Movies (Classic),movies-classic,fiction,Snow White,"Clear policy, one good pretext, user opens the door anyway",Social Engineering,PR,"A.6.3, A.5.10"
Movies (Classic),movies-classic,fiction,Elf,Tailgating past reception on pure confidence,Social Engineering,PR,"A.7.2, A.6.3"
Movies (Classic),movies-classic,fiction,Pretty Woman,Authentication by appearance instead of verification,Social Engineering,PR,"A.5.16, A.8.5"
Movies (Classic),movies-classic,fiction,Clueless,"Persona building, no duress training",Social Engineering,PR,A.6.3
Movies (Classic),movies-classic,fiction,The Parent Trap,"Identity swap beats biometrics, behavior analysis catches it",Social Engineering,"PR, DE","A.5.16, A.8.5, A.8.16"
Movies (Classic),movies-classic,fiction,Aladdin,Spoofed identity with well-resourced backing,Social Engineering,PR,"A.5.16, A.5.17"
Movies (Classic),movies-classic,fiction,Mulan,"Identity spoofing passes checks for months, physical inspection defeats it",Social Engineering,"PR, DE","A.5.16, A.6.1, A.8.5"
Movies (Classic),movies-classic,fiction,Die Hard,Smokescreen attack hiding the real objective,Attacks & Heists,"DE, RS","A.5.25, A.5.26, A.8.16"
Movies (Classic),movies-classic,fiction,Ocean's Eleven,"Full red team engagement: recon, cloning, insider placement",Attacks & Heists,"ID, PR, DE","A.7.2, A.5.15, A.8.16"
Movies (Classic),movies-classic,fiction,Mission Impossible,"Crown jewels data, every control mapped before the job",Attacks & Heists,"ID, PR","A.5.9, A.5.12, A.7.4"
Movies (Classic),movies-classic,fiction,The Italian Job,Critical infrastructure and OT compromise,Attacks & Heists,"PR, DE","A.8.20, A.8.22"
Movies (Classic),movies-classic,fiction,Ferris Bueller,"Data tampering in records system, auditor nobody believes",Attacks & Heists,"PR, DE","A.5.15, A.8.15, A.8.16"
Movies (Classic),movies-classic,fiction,Shawshank Redemption,Years-long low and slow exfiltration under detection thresholds,Attacks & Heists,DE,"A.8.12, A.8.16"
Movies (Classic),movies-classic,fiction,10 Things I Hate About You,"Attack routed through a third party, payment trail exposes it",Attacks & Heists,"GV, ID","A.5.19, A.5.21, A.5.22"
Movies (Classic),movies-classic,fiction,Sleepless in Seattle,OSINT and doxxing from a single broadcast,Attacks & Heists,ID,"A.5.12, A.5.14, A.8.11"
Movies (Classic),movies-classic,fiction,Speed,"Dead man's switch ransomware, looped camera feed fools monitoring",Attacks & Heists,"PR, DE, RS","A.8.16, A.5.26, A.7.4"
Movies (Classic),movies-classic,fiction,Toy Story,Asset that does not know it is compromised,Compromised Systems,DE,"A.8.7, A.8.16"
Movies (Classic),movies-classic,fiction,Fight Club,"Host running a second identity, botnet, destructive data attack",Compromised Systems,"DE, RS, RC","A.8.7, A.8.13, A.8.16"
Movies (Classic),movies-classic,fiction,Terminator 2,"No threat modeling, no kill switch before shipping",Compromised Systems,"GV, ID","A.8.25, A.8.27, A.8.28"
Movies (Classic),movies-classic,fiction,WarGames,"Default credentials, vendor backdoor, excessive system autonomy",Compromised Systems,PR,"A.5.17, A.8.5, A.8.9"
Movies (Classic),movies-classic,fiction,Flight of the Navigator,"Unwitting data mule, two-way channel contamination, trusted device escape",Compromised Systems,"PR, DE","A.5.14, A.7.10, A.8.1, A.8.20"
Movies (Classic),movies-classic,fiction,Back to the Future,Leaked data reaches someone who can act on it,Compromised Systems,"ID, PR","A.5.12, A.8.12"
Movies (Classic),movies-classic,fiction,E.T.,"Unknown device on the network, shadow IT hidden from admins",Compromised Systems,"ID, DE","A.5.9, A.8.1, A.8.16"
Movies (Classic),movies-classic,fiction,Titanic,"Unbreachable vendor claim, ignored threat intel, partial segmentation",Risk Mgmt Failures,"GV, ID","A.5.7, A.5.19, A.8.22, A.5.29"
Movies (Classic),movies-classic,fiction,Frozen,Suppressing a known vulnerability until it detonates,Risk Mgmt Failures,"ID, PR","A.8.8, A.5.24"
Movies (Classic),movies-classic,fiction,Ghostbusters,"Compliance overriding engineering, massive blast radius",Risk Mgmt Failures,GV,"A.8.32, A.5.2"
Movies (Classic),movies-classic,fiction,Beauty and the Beast,"Restrict one thing, users probe exactly that",Risk Mgmt Failures,PR,"A.5.15, A.5.10"
Movies (Classic),movies-classic,fiction,The Wizard of Oz,"Security through obscurity, one pulled curtain",Risk Mgmt Failures,ID,"A.5.12, A.8.9"
Movies (Classic),movies-classic,fiction,Monsters Inc,One unlogged door becomes a full incident,Risk Mgmt Failures,"PR, DE","A.5.15, A.7.2, A.8.15"
Movies (Classic),movies-classic,fiction,Charlie & the Chocolate Factory,Unforgeable tokens meet a counterfeit market,Risk Mgmt Failures,PR,"A.5.17, A.8.5"
Movies (Classic),movies-classic,fiction,Apollo 13,"Improvised compensating controls under pressure, tabletop gold",Defense & Response,"RS, RC","A.5.26, A.5.29, A.5.30"
Movies (Classic),movies-classic,fiction,The Karate Kid,Boring fundamentals turn out to be the real defense,Defense & Response,PR,"A.6.3, A.5.37"
Movies (Classic),movies-classic,fiction,101 Dalmatians,Out of band comms channel the attacker cannot monitor,Defense & Response,RS,"A.5.14, A.5.26, A.5.30"
Movies (Classic),movies-classic,fiction,Sneakers,"The pentest firm movie, universal decryption device",Defense & Response,"ID, PR","A.8.8, A.8.24, A.8.29"
Movies (Classic),movies-classic,fiction,Pulp Fiction (Marvin),"Negligence in production, the Wolf as incident response",Defense & Response,"PR, RS","A.5.26, A.5.37, A.8.2"
Movies (Classic),movies-classic,fiction,The Goonies,"Legacy docs hold the keys, piggybacking attackers, layered traps",Defense & Response,"PR, DE","A.5.33, A.5.37, A.7.1, A.7.2"
Movies (Classic),movies-classic,fiction,Indiana Jones (Raiders),"Integrity check catches the sandbag swap, dead man's switch",Defense & Response,DE,"A.8.16, A.8.24"
Movies (Classic),movies-classic,fiction,Groundhog Day,"Unlimited retries, no lockout, infinite attacker dwell time",Defense & Response,"PR, DE","A.8.5, A.8.16"
Movies (Classic),movies-classic,fiction,The Truman Show,"Total surveillance, one sympathetic insider leaks",Defense & Response,"GV, DE","A.6.2, A.6.6, A.8.16"
Movies (Classic),movies-classic,fiction,Ratatouille,"Undetected remote access, auditor ignored because output looks fine",Defense & Response,DE,"A.6.7, A.8.16"
Movies (Classic),movies-classic,fiction,Finding Nemo,Air gapped system escapes through the unexpected path,Defense & Response,"ID, DE","A.8.12, A.8.22"
The Bible (KJV),bible-kjv,fiction,The serpent in Eden,"The original social engineer: question the policy ('Yea, hath God said?'), promise privilege escalation ('ye shall be as gods'), user complies: the first phish",Social Engineering,PR,"A.6.3, A.5.10"
The Bible (KJV),bible-kjv,fiction,Noah's ark,"The DR plan built years before the incident, mocked until the rain: offsite backup of every critical asset, sealed and floated",Disaster Recovery,RC,"A.5.29, A.5.30, A.8.13"
The Bible (KJV),bible-kjv,fiction,Tower of Babel,"One project, one language, then the shared protocol breaks: communication disruption kills the build instantly: interoperability as availability",Protocol Failure,RC,"A.5.14, A.5.29"
The Bible (KJV),bible-kjv,fiction,Jacob deceives Isaac,"Goatskin on the arms defeats the touch check, the voice check flags an anomaly ('the voice is Jacob's voice') and the verifier overrides his own alert: multi-factor with conflicting factors, accepted anyway",Identity Spoofing,"PR, DE","A.5.16, A.8.5, A.5.25"
The Bible (KJV),bible-kjv,fiction,Joseph's coat dipped in blood,The brothers fabricate incident evidence to cover the insider crime: forged artifacts selling a false narrative to leadership,Fabricated Evidence,DE,"A.5.28, A.5.14"
The Bible (KJV),bible-kjv,fiction,Joseph's famine plan,Seven fat years stored against seven lean: capacity planning and continuity reserves from a threat forecast everyone else ignored,Continuity Planning,"GV, RC","A.5.29, A.5.30, A.5.7"
The Bible (KJV),bible-kjv,fiction,The silver cup in Benjamin's sack,Joseph plants evidence to test his brothers' loyalty: the planted artifact as an integrity test,Loyalty Testing,DE,"A.5.28, A.6.1"
The Bible (KJV),bible-kjv,fiction,Passover / blood on the doorposts,"Houses marked correctly are passed over: the allowlist tag determining policy enforcement at every endpoint, one night, no exceptions",Allowlisting,PR,"A.5.15, A.8.9"
The Bible (KJV),bible-kjv,fiction,The golden calf,Moses is up the mountain forty days and the whole policy collapses below: compliance evaporates the moment oversight leaves,Oversight Gap,GV,"A.5.2, A.5.36, A.6.4"
The Bible (KJV),bible-kjv,fiction,The twelve spies,"One recon mission, two reports: ten analysts sell fear, two sell the assessment, the majority FUD wins and costs forty years: intel analysis is only as good as the courage to read it",Threat Intel,"ID, GV","A.5.7, A.5.25"
The Bible (KJV),bible-kjv,fiction,Rahab and the scarlet cord,The pre-arranged marker identifying the friendly asset when the attack comes: the allowlist token agreed before the incident,Friendly Marking,PR,"A.5.16, A.5.14"
The Bible (KJV),bible-kjv,fiction,Achan's hidden spoil,"One insider takes forbidden material and buries it in his tent, the whole org suffers until the audit (drawn by lot) isolates him: one violation, collective consequences",Insider Violation,"DE, GV","A.5.28, A.6.4, A.5.10"
The Bible (KJV),bible-kjv,fiction,The Gibeonite deception,"Moldy bread, worn shoes, 'we be come from a far country': fabricated provenance, and Israel signs the treaty without verification ('asked not counsel'): due diligence skipped, contract binding forever",Vendor Fraud,"GV, ID","A.5.19, A.5.21, A.5.22"
The Bible (KJV),bible-kjv,fiction,Gideon's three hundred,"Force reduced from 32,000 to 300 on purpose, then torches and trumpets make it sound like an army: least privilege plus spoofed telemetry, and the enemy routs itself",Deception Ops,"PR, ID","A.5.15, A.8.16"
The Bible (KJV),bible-kjv,fiction,Shibboleth,"Say the word: pronunciation as the authentication factor, 42,000 failed logins at the Jordan crossing: the literal origin of the term security still uses",Authentication,PR,"A.8.5, A.5.16, A.5.17"
The Bible (KJV),bible-kjv,fiction,Samson and Delilah,"Three fake answers detect that she's compromised, three times, and he stays anyway: ignoring your own indicators until the real credential (the hair) is disclosed and instantly exploited",Credential Disclosure,"PR, DE","A.5.17, A.5.14, A.5.25"
The Bible (KJV),bible-kjv,fiction,David cuts Saul's robe,"In the cave he takes proof of access instead of the kill: the responsible disclosure artifact: 'I could have, and here is the evidence I didn't'",Responsible Disclosure,"ID, GV","A.5.28, A.8.8"
The Bible (KJV),bible-kjv,fiction,"David, Uriah, and Nathan","Privileged position abused, then the cover-up escalates until Uriah carries his own kill order: and Nathan delivers the audit finding as a parable: 'Thou art the man'",Cover-Up / Audit,"GV, RS","A.5.27, A.5.28, A.5.35"
The Bible (KJV),bible-kjv,fiction,Absalom and Hushai,"Absalom runs a years-long influence campaign at the gate and flips the top advisor, so David plants Hushai as a counter-mole feeding bad counsel: coup, defection, and counterintelligence in three chapters",Counterintel,"ID, DE","A.6.1, A.5.7, A.5.14"
The Bible (KJV),bible-kjv,fiction,Rehoboam's advisors,"He dismisses the elders and takes his friends' advice, the kingdom splits: governance failure by choosing counsel that agrees with you",Governance,GV,"A.5.2, A.5.3"
The Bible (KJV),bible-kjv,fiction,Naboth's vineyard,"Jezebel writes letters in Ahab's name, sealed with his seal, and stages false witnesses: compromised signing keys plus fabricated testimony equals judicial asset seizure",Key Compromise,"PR, DE","A.8.24, A.5.17, A.5.28"
The Bible (KJV),bible-kjv,fiction,Gehazi runs after Naaman,"The servant collects payment in the boss's name after the boss refused it: insider fraud on the organization's brand, caught immediately",Insider Fraud,"DE, GV","A.5.28, A.6.4"
The Bible (KJV),bible-kjv,fiction,Elisha and the king of Syria,"'The prophet telleth the words that thou speakest in thy bedchamber': total communications compromise, and the enemy's first move is hunting the leak",SIGINT,"ID, DE","A.5.7, A.5.14"
The Bible (KJV),bible-kjv,fiction,Rabshakeh at the wall,"The Assyrian envoy broadcasts demands in Hebrew so the workforce hears over leadership's heads: influence operation targeting the users, and Hezekiah's order is 'answer him not'",Influence Ops,"PR, RS","A.6.3, A.5.14"
The Bible (KJV),bible-kjv,fiction,Hezekiah shows the Babylonians everything,"The friendly envoys get the full treasury tour, Isaiah delivers the assessment: you just gave tomorrow's attacker the complete asset inventory",Oversharing,"ID, GV","A.5.9, A.5.12, A.5.14"
The Bible (KJV),bible-kjv,fiction,Mordecai's tip in the chronicles,"He reports the assassination plot, it's logged and forgotten, until the king reads the records one sleepless night: the log review that finds the unrewarded detection years later",Log Review,DE,"A.8.15, A.5.28"
The Bible (KJV),bible-kjv,fiction,Rebuilding the wall under threat,"Sword in one hand, trowel in the other, and Sanballat's fake meeting invites refused: 'I am doing a great work, so that I cannot come down': build and defend simultaneously, decline the phish",Secure by Design,PR,"A.8.25, A.6.3, A.5.14"
The Bible (KJV),bible-kjv,fiction,The writing on the wall,"MENE MENE TEKEL: the breach notification is on the wall and nobody in the room can read it without the analyst: 'weighed in the balances, and found wanting' is the audit verdict",Audit Verdict,"DE, GV","A.5.28, A.5.35"
The Bible (KJV),bible-kjv,fiction,The lions' den decree,Rivals can't find a flaw in Daniel so they engineer a new regulation targeting his known prayer schedule: weaponized compliance aimed at a predictable pattern,Weaponized Policy,GV,"A.5.31, A.5.34"
The Bible (KJV),bible-kjv,fiction,Jonah flees to Tarshish,"The assigned responder runs from the incident, consequences follow, and when he finally delivers the warning the org actually remediates: the reluctant analyst whose report works",Incident Response,RS,"A.5.26, A.5.25"
The Bible (KJV),bible-kjv,fiction,Herod and the Magi,"'Bring me word, that I may come and worship him also': elicitation under a false pretext, and the Magi, warned, return another way: refuse to be the informant, vary the route",Pretexting,PR,"A.6.3, A.5.14"
The Bible (KJV),bible-kjv,fiction,The temptation in the wilderness,"Three engineered pitches, each rebuffed by quoting policy, and the attacker quotes scripture too: legitimate documentation weaponized out of context, beaten by the user who knows it cold",Security Awareness,PR,"A.6.3, A.5.10"
The Bible (KJV),bible-kjv,fiction,Wolves in sheep's clothing,"'By their fruits ye shall know them': judge by behavior, not presentation: behavioral detection over appearance, in one verse",Behavioral Detection,DE,"A.8.16, A.6.1"
The Bible (KJV),bible-kjv,fiction,The goodman and the thief,"'If the goodman of the house had known in what watch the thief would come, he would have watched': you don't get the attacker's schedule, so the monitoring runs always",Monitoring,DE,"A.8.16, A.5.7"
The Bible (KJV),bible-kjv,fiction,The ten virgins,"Half brought oil, half assumed they could borrow at midnight: readiness is provisioned in advance, capacity doesn't transfer during the incident",Preparedness,"RC, GV","A.5.29, A.5.30"
The Bible (KJV),bible-kjv,fiction,Peter's denial,"The most trusted lieutenant folds under pressure three times before the rooster: even your best people have a breaking point under interrogation, plan for it",Human Factors,PR,"A.6.3, A.6.2"
The Bible (KJV),bible-kjv,fiction,The guards are paid,"'Say ye, His disciples came by night, and stole him while we slept': the paid disinformation campaign as damage control, complete with a cover story for the witnesses",Disinformation,RS,"A.5.14, A.5.27"
The Bible (KJV),bible-kjv,fiction,The unjust steward,"Fired, and during his notice period he discounts every debtor's bill to build his post-termination network: the offboarding window is the highest-risk access of all",Offboarding Risk,"GV, PR","A.6.5, A.5.18, A.8.2"
The Bible (KJV),bible-kjv,fiction,The door of the sheepfold,"'He that entereth not by the door, but climbeth up some other way, the same is a thief': the authorized entry point defines legitimacy, and the sheep know the shepherd's voice: authentication doctrine, verbatim",Access Control,PR,"A.5.15, A.8.5, A.5.16"
The Bible (KJV),bible-kjv,fiction,Doubting Thomas,"'Except I shall see in his hands the print of the nails, I will not believe': verification before trust, evidence demanded, evidence provided: the first zero trust architect",Zero Trust,"PR, DE","A.5.16, A.5.28, A.8.5"
The Bible (KJV),bible-kjv,fiction,Ananias and Sapphira,"The couple falsifies the financial declaration together and gets interviewed separately: collusion detected by independent questioning, consequences immediate",Fraud / Collusion,"DE, GV","A.5.28, A.6.4"
The Bible (KJV),bible-kjv,fiction,Saul becomes Paul,"The org's worst threat actor converts, and the community is rightly suspicious until Barnabas vouches: vetting the reformed attacker, sponsorship as the trust bridge",Reformed Attacker,"ID, GV","A.6.1, A.5.16"
The Bible (KJV),bible-kjv,fiction,Paul's nephew hears the plot,"One HUMINT tip about the forty-man ambush, reported up the chain, answered with a 470-soldier escort: intelligence received, believed, and resourced proportionately",HUMINT,"ID, RS","A.5.7, A.5.26"
The Bible (KJV),bible-kjv,fiction,An angel of light,"'Satan himself is transformed into an angel of light': the attack presents as trusted and benign, appearance of legitimacy is the payload's wrapper",Spoofed Legitimacy,"ID, PR","A.6.3, A.5.16"
The Bible (KJV),bible-kjv,fiction,The whole armour of God,"Belt, breastplate, shoes, shield, helmet, sword: itemized layered controls, each covering a different surface, the shield quenching 'all the fiery darts': defense in depth, enumerated",Defense in Depth,PR,"A.8.9, A.8.22, A.5.15"
The Bible (KJV),bible-kjv,fiction,"Your adversary, a roaring lion","'Be sober, be vigilant; because your adversary the devil, as a roaring lion, walketh about, seeking whom he may devour': the active adversary model in a single verse",Adversary Model,"ID, DE","A.5.7, A.8.16"
The Bible (KJV),bible-kjv,fiction,Come as a thief,"'If therefore thou shalt not watch, I will come on thee as a thief, and thou shalt not know what hour': no monitoring, no warning: the breach arrives unannounced by definition",Monitoring,DE,"A.8.16, A.5.25"
Top 100 Films,top-100-films,fiction,Tessio's betrayal,"The smartest lieutenant is the one who flips: 'it was the smart move': competence and loyalty are different attributes, monitor both",Insider Betrayal,"ID, DE","A.6.1, A.8.16"
Top 100 Films,top-100-films,fiction,Fredo,"'I know it was you, Fredo': the weak insider leveraged by outsiders who promised him significance: attackers recruit the overlooked, not the strong",Insider Recruitment,ID,"A.6.1, A.6.2"
Top 100 Films,top-100-films,fiction,The letters of transit,"Unforgeable, transferable, bearer-holds-all-rights: the credential everyone in the film is chasing: bearer tokens have been dangerous since 1942",Bearer Credentials,PR,"A.5.17, A.5.16"
Top 100 Films,top-100-films,fiction,Juror 8,"One reviewer challenges the consensus and re-examines every piece of evidence: peer review against groupthink, and the case falls apart under actual scrutiny",Evidence Review,"DE, GV","A.5.28, A.5.25"
Top 100 Films,top-100-films,fiction,The doomsday machine,A deterrent kept secret deters nothing: 'the whole point is lost if you keep it a secret': and General Ripper is the rogue insider with launch authority no recall code covers,Deterrence / Rogue Insider,"GV, ID","A.5.8, A.6.1, A.5.14"
Top 100 Films,top-100-films,fiction,HAL 9000,"Conflicting classified objectives make the AI lie, then kill: misalignment plus withheld need-to-know: and the pod bay doors are what losing physical control to your own system looks like",AI Misalignment,"GV, RS","A.8.25, A.5.12, A.5.26"
Top 100 Films,top-100-films,fiction,Harry Caul,The surveillance expert ends the film tearing his own apartment apart: the watcher watched: collection capability cuts both directions,Surveillance Risk,DE,"A.8.16, A.5.34"
Top 100 Films,top-100-films,fiction,Follow the money,"Anonymous source handling, parking garage tradecraft, and financial records unraveling the whole operation: forensic accounting as the master key",Financial Forensics,DE,"A.5.28, A.8.15"
Top 100 Films,top-100-films,fiction,The mayor of Amity,Leadership keeps the beaches open for tourist season: the incident suppressed for revenue until the body count forces disclosure: and 'you're gonna need a bigger boat' is every under-scoped response,Suppressed Disclosure,"GV, RS","A.5.27, A.5.26, A.5.8"
Top 100 Films,top-100-films,fiction,Ash and Special Order 937,The android crewmate carries a secret corporate directive: 'crew expendable': and Ripley's quarantine call gets overridden: bypassed containment kills nearly everyone,Corporate Insider,"GV, PR","A.6.1, A.5.12, A.5.26"
Top 100 Films,top-100-films,fiction,The Overlook's caretaker,Isolation degrades the trusted insider over one winter: and the out-of-band signal (the shining) is the only detection that works: monitor your remote solo operators,Insider Degradation,"DE, GV","A.6.2, A.8.16, A.6.7"
Top 100 Films,top-100-films,fiction,Voight-Kampff,"The test that distinguishes synthetic identities from real ones, until it can't: bot detection has been an arms race since 1982",Bot Detection,DE,"A.5.16, A.8.5"
Top 100 Films,top-100-films,fiction,The blood test,"Any crew member could be compromised and look identical: the improvised integrity attestation test, and the paranoia itself dismantles the team faster than the threat",Integrity Attestation,"DE, RS","A.8.16, A.5.28, A.5.26"
Top 100 Films,top-100-films,fiction,Directive 4,The classified vendor restriction inside your own tooling: cannot act against OCP executives: the security product that allowlists its maker,Vendor Backdoor,"GV, PR","A.5.21, A.8.9, A.5.19"
Top 100 Films,top-100-films,fiction,The mud,"Detection keyed on thermal signature, defeated by changing the signature: signature-based defense fails the moment the attacker knows what you scan for",Signature Evasion,"DE, PR","A.8.16, A.8.7"
Top 100 Films,top-100-films,fiction,Henry flips,The made guy becomes the informant when the org would kill him first: your insider's loyalty lasts exactly as long as your org is his safest option,Flipped Insider,ID,"A.6.1, A.6.2"
Top 100 Films,top-100-films,fiction,Consulting Lecter,"Using a contained attacker as an advisor, paying in intel: and he escapes by impersonating the wounded guard in the response chaos: identity checks collapse mid-incident",Attacker Advisory,"ID, RS","A.5.7, A.5.16, A.5.26"
Top 100 Films,top-100-films,fiction,The Code Red,"The unofficial procedure that exists nowhere in writing and everywhere in practice: shadow process vs documented policy, extracted on the stand",Shadow Procedures,"GV, DE","A.5.37, A.5.28, A.5.1"
Top 100 Films,top-100-films,fiction,The one-armed man,"Wrong attribution, closed case, and the accused runs his own forensic investigation: the first suspect who fits is not the same as the actor who did it",Misattribution,DE,"A.5.28, A.5.25"
Top 100 Films,top-100-films,fiction,Keyser Söze,Verbal builds the entire story from objects on the bulletin board behind the interrogator: fabricated identity assembled live from environmental data: attribution defeated completely,Fabricated Identity,"DE, ID","A.5.28, A.5.16"
Top 100 Films,top-100-films,fiction,The library records,The FBI flags who checks out certain books: the data trail identifies the researcher: and John Doe surrendering is the attacker stepping inside your process on purpose,Data Trails,DE,"A.8.15, A.5.34"
Top 100 Films,top-100-films,fiction,Waingro,The disciplined crew with one uncontrolled member: every opsec plan is rated by its least reliable participant,Weakest Member,"GV, PR","A.6.1, A.6.2"
Top 100 Films,top-100-films,fiction,The captured ship,The virus goes up in the enemy's own vessel: the trojan returned to sender through a trusted airframe: the delivery mechanism matters more than the payload,Trojan Delivery,PR,"A.8.7, A.5.21"
Top 100 Films,top-100-films,fiction,Borrowed ladders,"Vincent maintains someone else's biometric identity daily: scrubbed skin, blood samples, urine pouches: continuous biometric spoofing as a full-time discipline, defeated by one eyelash",Biometric Spoofing,"PR, DE","A.5.16, A.8.5, A.8.16"
Top 100 Films,top-100-films,fiction,Cypher's steak,The insider sells out the whole cell for comfort: 'ignorance is bliss': and Agents are the IDS that can take over any node: assume the environment can turn against you,Insider / IDS,"ID, PR","A.6.1, A.8.16, A.6.2"
Top 100 Films,top-100-films,fiction,Commodus,Succession fraud by the insider closest to the top: the transition moment is the highest-risk window any org has,Succession Fraud,GV,"A.5.3, A.5.2"
Top 100 Films,top-100-films,fiction,The One Ring,"The credential too dangerous to use: putting it on reveals you to the adversary instantly: stolen creds trigger detection, 'keep it secret, keep it safe' is key management",Toxic Credentials,"PR, DE","A.5.17, A.8.16, A.5.12"
Top 100 Films,top-100-films,fiction,Denethor's palantir,"The steward's intel feed is curated by the enemy: technically true images, chosen to induce despair: consider who controls your threat feed",Compromised Intel,ID,"A.5.7, A.5.14"
Top 100 Films,top-100-films,fiction,Helm's Deep culvert,"The fortress that never fell, breached through the drainage gap in the wall: every wall has a Kerkoporta, find yours before Saruman does",Perimeter Gap,"PR, ID","A.7.1, A.5.9, A.8.8"
Top 100 Films,top-100-films,fiction,Moody was Crouch all year,"The security instructor was the attacker for nine months, teaching the class: long-term impersonation of the defense function itself, and nobody re-verified",Long Impersonation,"ID, DE","A.5.16, A.6.1, A.8.16"
Top 100 Films,top-100-films,fiction,Horcruxes,Kill the process and it respawns from hidden copies: distributed persistence across concealed artifacts: eradication requires finding every one,Malware Persistence,"RS, RC","A.8.7, A.5.26, A.8.13"
Top 100 Films,top-100-films,fiction,Syndrome's Omnidroid,Each robot version is trained on fights with previous supers: iterative adversarial refinement against defenders: and Edna's 'no capes' is design removing a known failure mode,Adversarial Iteration,"ID, PR","A.5.7, A.8.25, A.8.8"
Top 100 Films,top-100-films,fiction,The Borden twins,"Two men operating one identity with perfect discipline, each living half a life: the shared account done flawlessly, and the cost is everything: also both diaries are honeypots",Shared Identity,"PR, DE","A.5.16, A.5.17, A.8.16"
Top 100 Films,top-100-films,fiction,'I drink your milkshake',"Drainage: extracting the resource from adjacent land without ever crossing the boundary: side-channel exfiltration, 1911 oilfield edition",Side Channels,"DE, PR","A.8.12, A.8.16"
Top 100 Films,top-100-films,fiction,The transponder,The money carries a tracker: the stolen asset that phones home: tagged assets turn theft into pursuit,Asset Tracking,DE,"A.8.16, A.7.9"
Top 100 Films,top-100-films,fiction,The rules,"Cardio, double tap, seatbelts: the documented survival runbook, and 'double tap' is verifying remediation before you walk away",Runbooks,"RS, PR","A.5.37, A.5.26"
Top 100 Films,top-100-films,fiction,Amy's diary,Years of fabricated entries planted to frame him: long-horizon log fabrication with media amplification: falsified records beat true testimony when they're better produced,Log Fabrication,DE,"A.8.15, A.5.28, A.5.14"
Top 100 Films,top-100-films,fiction,Dr. Mann's beacon,'The best of us' broadcasts falsified habitability data to get rescued: the compromised sensor lying for self-preservation: trust in the source is not verification of the signal,Falsified Telemetry,"DE, ID","A.8.16, A.5.28, A.5.7"
Top 100 Films,top-100-films,fiction,Kate's role,"The compliance officer brought along so the operation is technically legal: the auditor as legal cover: if you can't tell what your function on the team is, you're the paperwork",Auditor as Cover,GV,"A.5.35, A.5.31, A.5.3"
Top 100 Films,top-100-films,fiction,The cleaning crew,"The crown jewel extracted from the classified lab by the staff nobody sees: the invisible workforce holds total physical access, and the clearance model never counted them",Invisible Access,"PR, ID","A.7.2, A.6.1, A.5.15"
Top 100 Films,top-100-films,fiction,Bellwether,The meek assistant running the whole contamination op: threat modeling that only ranks the intimidating misses the actual actor,Underestimated Insider,ID,"A.6.1, A.5.7"
Top 100 Films,top-100-films,fiction,Ernesto's songs,"IP stolen with murder, credited for generations, corrected by surviving provenance: letters and a photo: attribution can take a lifetime, evidence retention makes it possible",Provenance,"DE, GV","A.5.33, A.5.28, A.8.15"
Top 100 Films,top-100-films,fiction,Don't look up at it,Eye contact with the predator gets you eaten: observation discipline as survival: sometimes the control is not engaging the threat on its terms,Engagement Discipline,PR,"A.5.10, A.6.3"
The Office,the-office,fiction,Series premise,"A documentary crew records everything for nine years, then airs it: the ultimate data retention and consent story",Data Retention,GV,"A.5.34, A.8.10"
The Office,the-office,fiction,Promos,"The promo drops and everyone realizes their private moments were captured all along: retention shock, consent in hindsight",Consent,GV,"A.5.34, A.5.14"
The Office,the-office,fiction,Email Surveillance,Michael reads everyone's email and finds the party he wasn't invited to: employee monitoring and its blowback,Monitoring,"DE, GV","A.8.16, A.5.34"
The Office,the-office,fiction,Conflict Resolution,Michael reads confidential HR complaints aloud to the office: HR records confidentiality destroyed in one meeting,Confidentiality,"PR, GV","A.5.14, A.5.34, A.6.4"
The Office,the-office,fiction,Gay Witch Hunt,Michael outs Oscar to the entire office: private personal information disclosed by management,Privacy Breach,GV,"A.5.34, A.6.4"
The Office,the-office,fiction,Back from Vacation,The Jamaica photo meant for one recipient spreads to everyone: the misdirected email as career event,Misdirected Email,PR,"A.5.14, A.8.12, A.6.3"
The Office,the-office,fiction,Safety Training,Michael's roof stunt to prove danger is real: safety theater escalating past the point of safety,Safety Theater,GV,"A.6.3, A.5.37"
The Office,the-office,fiction,Product Recall,"The obscene watermark ships on paper: QA failure, Creed scapegoats an innocent employee, Michael's apology video makes it worse: the full bad incident comms playbook",Incident Comms,"RS, GV","A.5.26, A.5.27, A.8.29"
The Office,the-office,fiction,Dunder Mifflin Infinity,'The machine knows': Michael drives into the lake because GPS said so: blind trust in automation over visible reality,Automation Trust,PR,"A.8.9, A.6.3"
The Office,the-office,fiction,Goodbye Toby / Ryan's arc,Ryan cooks the website numbers by double-recording sales: metrics fraud to sustain the modernization story,Metrics Fraud,"GV, DE","A.5.28, A.5.35"
The Office,the-office,fiction,Business Ethics,"Holly's ethics training surfaces Meredith trading favors for supplier discounts and steak coupons: the kickback disclosed mid-training, then amnestied",Kickbacks,GV,"A.5.19, A.6.4, A.6.3"
The Office,the-office,fiction,Customer Survey,Kelly tanks Jim and Dwight's customer scores because they skipped her party: insider tampering with the feedback data everyone trusts,Data Tampering,DE,"A.5.28, A.8.15"
The Office,the-office,fiction,Frame Toby,Michael plants 'drugs' to frame HR: fabricated evidence against the compliance function itself,Planted Evidence,"DE, GV","A.5.28, A.6.4"
The Office,the-office,fiction,Prince Family Paper,Michael and Dwight run recon on a family competitor: competitive intelligence collection and the ethics line it crosses,Corp Espionage,"ID, GV","A.5.7, A.5.33"
The Office,the-office,fiction,Stress Relief,Dwight's unannounced fire drill causes panic and a heart attack: the live-fire exercise without authorization or safety review,Unsafe Drills,"RS, GV","A.5.29, A.6.3, A.5.26"
The Office,the-office,fiction,Golden Ticket,"Michael's promo idea stacks discounts into a massive loss, then he pins it on Dwight: uncontrolled discount injection plus blame shifting",Process Failure,"GV, RS","A.8.32, A.5.27"
The Office,the-office,fiction,Michael Scott Paper Company,"Michael quits and takes Pam, Ryan, and the client relationships with him: talent and client-list exfiltration by a departing insider",Insider Exfil,"GV, PR","A.6.5, A.5.14, A.5.33"
The Office,the-office,fiction,Heavy Competition,Dwight feeds Michael's Rolodex to the rival: client data theft in a loyalty war,Data Theft,"PR, DE","A.5.33, A.8.12"
The Office,the-office,fiction,Gossip,Michael spreads a dozen fake rumors to bury the one real one: disinformation as a smokescreen for a true leak,Disinformation,ID,"A.5.14, A.5.7"
The Office,the-office,fiction,The Banker,Toby and Dwight steer the due diligence visit around every problem: M&A diligence theater before the Sabre sale,Diligence Theater,GV,"A.5.35, A.5.19"
The Office,the-office,fiction,The Cover-Up,Andy discovers the printers catch fire and gets pranked instead of heard: the internal reporter mocked before the story breaks,Ignored Reporter,"GV, DE","A.5.25, A.6.4"
The Office,the-office,fiction,Whistleblower,"The printer fires leak to the press, Jo hunts the leaker, and it turns out to be nearly everyone: whistleblower handling done completely backward",Whistleblowing,"GV, RS","A.5.26, A.5.27, A.6.4"
The Office,the-office,fiction,The Sting,A fake client meeting with hidden cameras to steal a rival salesman's pitch: the competitive intelligence sting operation,Corp Espionage,"ID, DE","A.5.7, A.8.16"
The Office,the-office,fiction,"Dwight K. Schrute, (Acting) Manager",Dwight's gun fires in the office and he tries to hush it up: incident concealment beats incident response,Concealment,"RS, GV","A.5.26, A.5.27"
The Office,the-office,fiction,The List,Robert California's winners/losers list left in plain view: one exposed sensitive document reorganizes the whole office's psychology,Doc Exposure,PR,"A.5.12, A.7.7, A.5.14"
The Office,the-office,fiction,Doomsday,Dwight builds a system that auto-emails every infraction to the CEO after five mistakes: the insider-built logic bomb with a hair trigger,Logic Bomb,"PR, DE","A.8.28, A.8.16, A.5.24"
The Office,the-office,fiction,Robert California's hire,"Hired as branch manager, talks Jo into making him CEO by lunch: social engineering straight to the top of the org chart",Social Engineering,GV,"A.6.1, A.6.3"
The Office,the-office,fiction,Nellie takes the job,"Nellie sits in the manager's chair and claims the role, nobody enforces anything: access granted by squatting and weak governance",Role Squatting,GV,"A.5.3, A.5.18, A.5.2"
The Office,the-office,fiction,Turf War,Binghamton closes and every branch scrambles to poach its clients: the asset grab after a messy decommissioning,Decommissioning,"GV, RC","A.6.5, A.5.30"
The Office,the-office,fiction,Free Family Portrait Studio,Dwight runs a fake portrait studio to collect Phillip's DNA: pretexting purpose-built for biometric collection,Pretexting,"ID, PR","A.6.3, A.5.34"
The Office,the-office,fiction,Andy's Ancestry (Asian Jim),"Steve from the future, swapped family photos, colluding partner: identity substitution defeating every check Dwight runs",Identity Spoofing,"PR, DE","A.5.16, A.8.5, A.6.3"
The Office,the-office,fiction,The Boat,Oscar's secret entrusted to Kevin: the sensitive data on the least secure endpoint in the building,Weakest Link,PR,"A.5.14, A.5.12, A.6.3"
The Office,the-office,fiction,Lice,"Pam brings the lice and Meredith takes the blame: incident attribution to the assumed patient zero, evidence optional",Misattribution,"DE, RS","A.5.25, A.5.27"
The Office,the-office,fiction,Vandalism,"Pam's mural defaced, Dwight and Pam trace the paint to the warehouse: insider vandalism solved by physical forensics",Forensics,DE,"A.5.28, A.7.4"
The Office,the-office,fiction,Creed Bratton,"Fake name, invented job, zero output, decades of tenure: the ghost employee who is also an identity fraud who is also maybe a fugitive",Ghost Employee,"ID, GV","A.5.16, A.6.1, A.5.18"
The Office,the-office,fiction,Jim's pranks,"Stapler in jello, desk in the bathroom, wrapping paper desk: continuous physical tampering proving the workspace is never verified",Asset Tampering,"PR, DE","A.7.10, A.8.16"
The Office,the-office,fiction,Jury Duty,Jim fakes jury duty for a week off: the fraudulent absence claim and the coverup that snowballs,Fraudulent Claims,"DE, GV","A.5.28, A.6.4"
The Office,the-office,fiction,The Meeting,Toby and Dwight investigate Darryl's injury claim and find it happened elsewhere: insurance fraud investigation inside the building,Fraud Investigation,DE,"A.5.28, A.5.25"
Marvel,marvel,fiction,Iron Man,"Obadiah Stane: executive insider stealing IP, board-level access abuse",Insider Threat,"GV, PR","A.5.18, A.6.4, A.8.2, A.5.33"
Marvel,marvel,fiction,Iron Man 2,"Hammer as the bad vendor, drone fleet hijacked mid-demo",Supply Chain,"GV, PR, RS","A.5.19, A.5.21, A.8.20"
Marvel,marvel,fiction,Iron Man 3,"Fake Mandarin: false flag attribution, manufactured threat actor",Deception,"ID, DE","A.5.7, A.5.25"
Marvel,marvel,fiction,Captain America: First Avenger,Hydra infiltration begins inside a trusted agency,Insider Threat,"GV, ID","A.6.1, A.5.3"
Marvel,marvel,fiction,Winter Soldier,Hydra inside SHIELD for decades: the ultimate advanced persistent threat,Insider Threat,"GV, ID, DE","A.6.1, A.8.16, A.5.7"
Marvel,marvel,fiction,Winter Soldier,"Project Insight: mass data collection weaponized, Zola's algorithm as predictive abuse",Data Misuse,"GV, ID","A.5.12, A.5.34, A.8.11"
Marvel,marvel,fiction,Winter Soldier,Bucky's trigger words: backdoor planted in a trusted asset,Compromised Asset,"DE, RS","A.8.7, A.8.16"
Marvel,marvel,fiction,The Avengers,"Loki's scepter flips Hawkeye: credential compromise, insider turned in seconds",Compromised Asset,"DE, RS","A.5.18, A.8.16, A.5.26"
Marvel,marvel,fiction,The Avengers,Tesseract portal: unauthorized ingress point straight into your environment,Attack,"PR, DE","A.8.20, A.8.22"
Marvel,marvel,fiction,Age of Ultron,"Ultron: AI shipped with no testing, no kill switch, spreads like a worm",AI Risk,"GV, ID, RS","A.8.25, A.8.28, A.8.31"
Marvel,marvel,fiction,Age of Ultron,Wanda's mind games: social engineering that turns the team on itself,Social Engineering,PR,A.6.3
Marvel,marvel,fiction,Civil War,"Zemo destroys the Avengers with zero hacking, pure manipulation and one leaked video",Social Engineering,"PR, DE","A.6.3, A.5.14"
Marvel,marvel,fiction,Civil War,Sokovia Accords: the compliance and governance debate in cape form,Governance,GV,"A.5.1, A.5.31"
Marvel,marvel,fiction,Ant-Man,"Full heist pentest: recruited operator, physical infiltration, IP theft target",Attack,"ID, PR","A.7.1, A.7.2, A.5.33"
Marvel,marvel,fiction,Ant-Man,Darren Cross: protege insider rebuilding restricted tech after being cut off,Insider Threat,"GV, PR","A.5.18, A.6.5, A.5.33"
Marvel,marvel,fiction,Ant-Man and the Wasp,Ghost phasing through walls: attacker your physical controls cannot stop,Attack,"PR, DE","A.7.1, A.8.16"
Marvel,marvel,fiction,Spider-Man: Homecoming,"Vulture: disgruntled contractor pushed out, monetizes salvaged restricted material",Insider Threat,"GV, ID","A.5.19, A.6.5, A.5.9"
Marvel,marvel,fiction,Spider-Man: Homecoming,Peter jailbreaks the suit: privilege escalation on a managed device,Privilege Abuse,"PR, DE","A.8.2, A.8.9, A.8.19"
Marvel,marvel,fiction,Spider-Man: Far From Home,Mysterio: deepfakes and fabricated threats to earn trust and access,Deception,"ID, DE","A.5.7, A.5.16, A.8.16"
Marvel,marvel,fiction,Spider-Man: Far From Home,EDITH handoff: god-level access transferred to a teenager with zero verification,Access Mgmt,"GV, PR","A.5.18, A.8.2, A.5.16"
Marvel,marvel,fiction,Spider-Man: No Way Home,"Identity leak: Peter doxxed globally, no way to un-publish the data",Data Breach,"RS, RC","A.5.12, A.5.26, A.8.12"
Marvel,marvel,fiction,Spider-Man: No Way Home,The botched spell: one bad change with no rollback plan breaches the multiverse,Change Mgmt,"GV, RC","A.8.32, A.8.13"
Marvel,marvel,fiction,Black Panther,Killmonger: outsider with legitimate credentials exploits an unpatched process,Insider Threat,"GV, ID","A.5.16, A.5.3, A.8.8"
Marvel,marvel,fiction,Black Panther,Wakanda hiding vibranium: security through obscurity at nation scale,Risk Mgmt,ID,"A.5.12, A.5.9"
Marvel,marvel,fiction,Black Panther,W'Kabi flips: trusted lieutenant switches sides when leadership fails him,Insider Threat,GV,"A.6.2, A.6.4"
Marvel,marvel,fiction,Thor: Ragnarok,Hela: suppressed history is an undocumented vulnerability that comes home,Risk Mgmt,ID,"A.8.8, A.5.37"
Marvel,marvel,fiction,Doctor Strange,Sanctums: distributed defense nodes protecting the whole environment,Defense,PR,"A.8.22, A.5.29"
Marvel,marvel,fiction,Multiverse of Madness,Darkhold: malicious codebase that corrupts every user who runs it,Compromised Asset,"PR, DE","A.8.7, A.8.19"
Marvel,marvel,fiction,Multiverse of Madness,Dreamwalking: remote session hijack of another instance of yourself,Attack,DE,"A.8.5, A.8.16"
Marvel,marvel,fiction,Captain Marvel,Skrull shapeshifters: identity spoofing that defeats visual verification,Deception,"PR, DE","A.5.16, A.8.5"
Marvel,marvel,fiction,Captain Marvel,"Kree misdirection: attacker controls your threat intel, you fight the wrong enemy",Deception,ID,A.5.7
Marvel,marvel,fiction,Shang-Chi,The Dweller mimics dead loved ones' voices: emotional phishing at its purest,Social Engineering,PR,A.6.3
Marvel,marvel,fiction,Guardians of the Galaxy,"The orb: crown jewel asset everyone wants, handled with zero care in transit",Data Protection,PR,"A.5.10, A.5.14, A.7.10"
Marvel,marvel,fiction,Eternals,Sleeper agents embedded for millennia with a hidden mission,Insider Threat,"ID, DE","A.6.1, A.8.16"
Marvel,marvel,fiction,Infinity War,Thanos collects stones one by one: attacker aggregating credentials until game over,Attack,"ID, PR, DE","A.5.17, A.8.2, A.5.7"
Marvel,marvel,fiction,Infinity War,The snap: catastrophic loss event nobody's continuity plan covered,Disaster,RC,"A.5.29, A.5.30, A.8.13"
Marvel,marvel,fiction,Endgame,Time heist: restoring from backup when live data is gone,Recovery,RC,"A.8.13, A.5.30"
Marvel,marvel,fiction,Endgame,Five year gap: what long-term recovery and business continuity actually look like,Recovery,"RC, GV","A.5.29, A.5.30"
2000 Years of Incidents,2000-years-of-incidents,real,The Trojan Horse,"The original malicious payload inside a trusted gift, wheeled through the gates by the victims themselves: they named the malware after this one",Trojan,PR,"A.6.3, A.7.2, A.5.21"
2000 Years of Incidents,2000-years-of-incidents,real,Histiaeus' tattooed messenger,"Message tattooed on a slave's shaved head, hair grown back, sent through enemy lines: steganography, the hidden channel in plain sight",Steganography,PR,"A.5.14, A.8.12"
2000 Years of Incidents,2000-years-of-incidents,real,Thermopylae / Ephialtes,A local shows the Persians the goat path around the pass: the insider revealing the undocumented route past the perimeter,Insider Betrayal,"ID, PR","A.6.1, A.5.9, A.7.1"
2000 Years of Incidents,2000-years-of-incidents,real,The Caesar cipher,"Shift each letter three places: weak by any modern measure, but encryption as standard practice for command traffic begins here",Cryptography,PR,A.8.24
2000 Years of Incidents,2000-years-of-incidents,real,Assassination of Julius Caesar,"Killed by trusted senators after brushing off the warning note handed to him that morning: insider threat plus ignored intelligence, in one scene",Insider Threat,"ID, GV","A.6.1, A.5.7, A.5.25"
2000 Years of Incidents,2000-years-of-incidents,real,Teutoburg Forest,"Arminius, a Roman-trained and trusted auxiliary commander, leads three legions into annihilation: the highest-clearance insider turning his access into an ambush",Insider Betrayal,ID,"A.6.1, A.5.3"
2000 Years of Incidents,2000-years-of-incidents,real,Judas Iscariot,"The inner-circle insider paid thirty pieces of silver, identifying the target with a trusted greeting: betrayal monetized, and the trust signal itself weaponized",Insider Bribery,"ID, PR","A.6.1, A.6.2, A.5.16"
2000 Years of Incidents,2000-years-of-incidents,real,Great Fire of Rome,Nero deflects blame onto Christians: attribution manipulation and scapegoating as incident response,Scapegoating,"RS, GV","A.5.27, A.5.28"
2000 Years of Incidents,2000-years-of-incidents,real,Sack of Rome,"Alaric's Goths enter when the Salarian Gate opens from inside: the fortification holds, the person at the door doesn't",Insider Access,PR,"A.7.2, A.6.1"
2000 Years of Incidents,2000-years-of-incidents,real,Greek fire,"Byzantium's superweapon, compartmentalized so tightly the formula died with its keepers: trade secret protection so good it became key-person data loss",Trade Secrets,"PR, RC","A.5.12, A.5.33, A.5.30"
2000 Years of Incidents,2000-years-of-incidents,real,Lindisfarne raid,"Vikings hit the rich, unguarded monastery first: attackers rationally pick the highest-value softest target, and monasteries had no threat model",Soft Targets,"ID, PR","A.5.9, A.5.7, A.7.1"
2000 Years of Incidents,2000-years-of-incidents,real,The Assassins (Hashashin),Operatives embedded for years inside courts before striking: sleeper placement and patient access-building as doctrine,Sleeper Agents,ID,"A.6.1, A.5.7"
2000 Years of Incidents,2000-years-of-incidents,real,Fourth Crusade sacks Constantinople,The hired allies divert and sack the client they came to help: partner risk when your protector's incentives change,Partner Betrayal,GV,"A.5.19, A.5.22"
2000 Years of Incidents,2000-years-of-incidents,real,Mongol invasion of Europe,"Subutai's scouts, spies, and courier network out-informed every European court: intelligence superiority deciding campaigns before contact",Threat Intel,ID,A.5.7
2000 Years of Incidents,2000-years-of-incidents,real,Fall of the Knights Templar,"Friday the 13th: simultaneous coordinated arrests across France, assets seized, confessions forced: the takedown of a trusted institution that also ran Europe's early payment network",Coordinated Takedown,"RS, GV","A.5.26, A.5.29"
2000 Years of Incidents,2000-years-of-incidents,real,Siege of Caffa,"Plague corpses catapulted over the walls: biological payload delivery, contaminating what's inside the perimeter",Bio Attack,PR,"A.7.1, A.5.21"
2000 Years of Incidents,2000-years-of-incidents,real,Fall of Constantinople / the Kerkoporta,"The greatest walls ever built, and a small postern gate left unlocked: one forgotten access point in a thousand years of fortification",Forgotten Access,"PR, ID","A.7.2, A.5.9, A.5.18"
2000 Years of Incidents,2000-years-of-incidents,real,Pazzi Conspiracy,"Assassination attempt on the Medici mid-Mass by rival insiders: the coup fails, and Florence's response is total: insider plots price in the retaliation",Insider Coup,"ID, RS","A.6.1, A.5.26"
2000 Years of Incidents,2000-years-of-incidents,real,Luther's 95 Theses go viral,The printing press breaks the Church's information monopoly in weeks: censorship built for scribes fails against new media at scale,Info Control Collapse,GV,"A.5.14, A.5.29"
2000 Years of Incidents,2000-years-of-incidents,real,Cajamarca ambush,"Pizarro invites Atahualpa to a meeting and springs the trap: the malicious meeting invite, sixteenth century edition",Pretexting,PR,"A.6.3, A.5.16"
2000 Years of Incidents,2000-years-of-incidents,real,Babington Plot / Mary Queen of Scots,"Her cipher is broken by Walsingham's cryptanalyst, and a forged postscript is injected to expose more names: broken crypto plus man-in-the-middle message injection, fatal on the decrypts",Broken Crypto,"PR, DE","A.8.24, A.5.14, A.5.28"
2000 Years of Incidents,2000-years-of-incidents,real,Gunpowder Plot,An anonymous tip letter plus a physical search of the cellar finds Fawkes with the powder: insider tip and inspection defeat the plot the night before,Detection,DE,"A.5.25, A.7.4, A.5.28"
2000 Years of Incidents,2000-years-of-incidents,real,Great Fire of London,"One bakery, no firebreaks, four days of uncontrolled spread: zero segmentation, then building codes as the post-incident control",No Segmentation,"RC, GV","A.8.22, A.5.29, A.5.31"
2000 Years of Incidents,2000-years-of-incidents,real,Salem witch trials,"Convictions on spectral evidence nobody can test or refute: mass false positives from an unfalsifiable detection method, panic as the driver",False Positives,"DE, GV","A.5.25, A.5.28"
2000 Years of Incidents,2000-years-of-incidents,real,South Sea Bubble,Members of Parliament trading on inside knowledge while the public buys the story: speculative fraud with regulators invested in the scheme,Fraud,GV,"A.5.35, A.5.3"
2000 Years of Incidents,2000-years-of-incidents,real,Battle of Plassey,"Clive buys Mir Jafar, the opposing commander, before the battle: the bribed insider stands down and an empire changes hands for a payout",Insider Bribery,ID,"A.6.1, A.6.2"
2000 Years of Incidents,2000-years-of-incidents,real,Benedict Arnold / John André,"A trusted general sells the West Point plans, the courier caught with documents in his boot at a checkpoint: the insider threat archetype, defeated by physical inspection",Insider Threat,"ID, DE","A.6.1, A.7.4, A.5.28"
2000 Years of Incidents,2000-years-of-incidents,real,Rothschild and Waterloo (legend),"The story of profiting on early battle news: information latency as arbitrage, and a reminder that famous incidents accrete myth (this one is heavily embellished)",Info Advantage,ID,"A.5.7, A.5.14"
2000 Years of Incidents,2000-years-of-incidents,real,Blanc brothers telegraph hack,"A bribed operator injects extra characters into the French optical telegraph to smuggle stock prices to Bordeaux: the first network hack in history, running two years on a covert channel inside 'error' data",Network Hack,"PR, DE","A.6.2, A.8.12, A.8.16"
2000 Years of Incidents,2000-years-of-incidents,real,Carrington Event,"A solar storm sets telegraph offices sparking, some lines run on aurora current alone: infrastructure resilience against environmental events nobody planned for",Environmental,"ID, RC","A.5.29, A.5.30, A.8.6"
2000 Years of Incidents,2000-years-of-incidents,real,Dreyfus Affair,"Wrong man convicted on junk handwriting analysis, evidence forged to sustain it, and Picquart punished for finding the real spy: misattribution, fabrication, and shooting the analyst",Misattribution,"DE, GV","A.5.28, A.5.25, A.6.4"
2000 Years of Incidents,2000-years-of-incidents,real,Maskelyne hacks Marconi,"Mid-demo of 'secure' wireless at the Royal Institution, a rival magician injects rude limericks into the receiver: the first live hack of a vendor's unbreakable claim",Vendor Overclaim,"ID, PR","A.5.21, A.8.20, A.5.7"
2000 Years of Incidents,2000-years-of-incidents,real,Titanic,"Ignored ice warnings, full speed, lifeboats for half: the risk management failure so complete it became the metaphor",Risk Mgmt,"GV, ID","A.5.7, A.5.29"
2000 Years of Incidents,2000-years-of-incidents,real,Sarajevo / Franz Ferdinand,"First attempt fails, the changed route never reaches the driver, the wrong turn stops in front of Princip: executive protection undone by a comms failure mid-operation",Protection Failure,"RS, PR","A.5.14, A.5.26"
2000 Years of Incidents,2000-years-of-incidents,real,Zimmermann Telegram,"British intelligence decrypts Germany's offer to Mexico, then builds a cover story to hide how they got it: SIGINT plus source protection changes the war",SIGINT,"ID, PR","A.5.7, A.8.24, A.5.12"
2000 Years of Incidents,2000-years-of-incidents,real,Charles Ponzi,Returns paid from new deposits until the math collapses: the fraud so clean they named the whole category after him,Ponzi Fraud,"GV, DE","A.5.35, A.5.28"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Gus Fring (series-wide),"Los Pollos Hermanos, DEA fundraiser donor, pillar of the community: the perfect long-term cover business",Cover Identity,"ID, DE","A.6.1, A.5.19, A.5.16"
Breaking Bad + Better Call Saul,breaking-bad,fiction,The superlab,Industrial operation hidden under an industrial laundry: covert infrastructure inside legitimate infrastructure,Hidden Infrastructure,"ID, DE","A.5.9, A.7.1, A.8.16"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Gale's lab notes,"Gale documents everything beautifully, the notes plus a book dedication (W.W.) break the whole case: over-documentation as evidence",Documentation Risk,DE,"A.5.33, A.5.28, A.5.12"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Leaves of Grass on the toilet,Hank finds the inscription in the bathroom: the smallest unmanaged artifact defeats years of opsec,Artifact Leakage,DE,"A.5.28, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Dead Freight (S5E5),"The train heist: siphon methylamine, replace with water so weight matches: integrity attack on cargo that passes every check",Supply Chain,"PR, DE","A.5.14, A.8.16, A.5.21"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Lydia at Madrigal,Corporate logistics insider diverting product through legitimate channels: the supply chain threat wears a suit,Insider Threat,"ID, DE","A.6.1, A.8.16, A.5.19"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Vamonos Pest,Pest control tenting as cover: the trusted service provider with unsupervised physical access to your whole house,Vendor Access,PR,"A.5.19, A.7.2, A.5.22"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Mike's tradecraft,"Bug sweeps, dead drops, half measures speech: professional opsec discipline vs Walt's improvisation",OPSEC,PR,"A.5.37, A.8.16"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Mike's guys in prison,"Retention payments keep insiders quiet, Walt eliminates the dependency instead: the human single points of failure",Insider Risk,"GV, ID","A.6.2, A.6.5"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Walt's confession tape,Fabricated video framing Hank as the mastermind: disinformation weaponizing plausibility,Disinformation,"ID, RS","A.5.14, A.5.28"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Hector's bell,Covert signaling through an assistive device nobody screens: the channel hiding in plain sight,Covert Channels,DE,"A.8.12, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Brock's poisoning,Walt stages a false flag to re-recruit Jesse: manipulation ops to regain a lost asset,False Flag,ID,"A.5.7, A.6.3"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Burner phone discipline,"Constant device rotation, nothing on the record: comms hygiene as core tradecraft",Comms Security,PR,"A.8.1, A.5.14"
Breaking Bad + Better Call Saul,breaking-bad,fiction,The car wash,A1A Car Wash laundering: dirty flows washed through a legitimate business front,Laundering,"DE, GV","A.5.28, A.5.31"
Breaking Bad + Better Call Saul,breaking-bad,fiction,GPS tracker on Gus's car,Hank's consumer tracker on a hardened target: cheap surveillance tools work until the target sweeps,Tracking,"DE, PR","A.8.16, A.7.9"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Lab cameras,"Gus watches the cooks constantly: employee surveillance as control, and everyone behaves for the lens",Monitoring,"DE, GV","A.8.16, A.5.34"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Todd and Jack's crew,"Outsourcing to the wrong vendor: cheaper, violent, uncontrollable: the subcontractor risk endgame",Vendor Risk,GV,"A.5.19, A.5.21, A.5.22"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Buried barrels + lottery ticket,GPS coordinates hidden on a lottery ticket on the fridge: the key to everything in plain sight,Data Hiding,PR,"A.5.12, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Chicanery (S3E5),Huell plants a battery to prove Chuck's condition is psychological: planted evidence to demolish a witness's credibility,Planted Evidence,"DE, RS","A.5.28, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Mesa Verde documents (S2),Jimmy swaps 1261 for 1216 in Chuck's files overnight: document tampering that turns meticulousness into liability,Data Tampering,"DE, PR","A.5.33, A.8.15, A.5.28"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Sandpiper shredders,Jimmy reconstructs shredded billing docs from the trash: dumpster diving proves the overbilling fraud,Document Recovery,DE,"A.5.28, A.8.10, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Werner Ziegler,"The contractor leaks project details on calls home, then walks off site: confidentiality breach ends the worst way possible",Contractor Risk,"GV, PR","A.5.19, A.6.2, A.6.5, A.5.14"
Breaking Bad + Better Call Saul,breaking-bad,fiction,The German crew,"Superlab builders sequestered, compartmentalized, no outside contact: extreme contractor isolation protocols",Compartmentalization,PR,"A.5.12, A.6.2, A.7.6"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Nacho's pill swap,Hector's medication replaced with placebos: supply tampering targeted at one individual,Supply Tampering,"PR, DE","A.5.21, A.7.10"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Nacho as double agent,Gus flips Nacho through threats to his father: the coerced insider serving two masters,Coerced Insider,ID,"A.6.1, A.6.2"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Dr. Caldera's black book,The vet as access broker: one contact directory connecting every criminal service in town,Access Broker,ID,"A.5.7, A.5.19"
Breaking Bad + Better Call Saul,breaking-bad,fiction,The Howard campaign (S6),"Kim and Jimmy's months-long op: staged photos, doctored evidence, drugged mediation: character assassination as a project plan",Disinformation Op,"ID, DE","A.5.28, A.5.14, A.6.3"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Lalo's body double,Faked death with a lookalike corpse: identity verification failure at the morgue level,Faked Death,"ID, DE","A.5.16, A.5.28"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Gene Takavic (Omaha),"New name, new city, gray life: post-incident identity that one mall observer (Jeff) unravels",Cover Identity,ID,"A.5.16, A.5.34"
Breaking Bad + Better Call Saul,breaking-bad,fiction,Character and fitness hearing,"Jimmy games the reinstatement review with a performance: compliance assessments scored on presentation, not substance",Compliance Gaming,GV,"A.5.35, A.6.1"
Brooklyn Nine-Nine,brooklyn-99,fiction,Halloween Heists (annual),"The yearly heist: red team exercise with escalating countermeasures, insider betrayals, and a trophy: adversarial testing as culture",Red Team,"ID, PR, DE","A.8.29, A.5.7, A.6.3"
Brooklyn Nine-Nine,brooklyn-99,fiction,HalloVeen,Decoy Cheddars and misdirection layers: decoy assets absorbing the attack while the real target moves,Decoys,"PR, DE","A.8.16, A.5.12"
Brooklyn Nine-Nine,brooklyn-99,fiction,Doug Judy (recurring),"The Pontiac Bandit escapes every time: the recurring adversary, and the analyst-attacker rapport that eventually pays off",Threat Actor,"ID, DE","A.5.7, A.8.16"
Brooklyn Nine-Nine,brooklyn-99,fiction,Undercover,Jake's months inside the Ianucci family: long-term infiltration and the cost of maintaining cover,Infiltration,ID,"A.6.1, A.5.16"
Brooklyn Nine-Nine,brooklyn-99,fiction,Coral Palms Pt 1,"Jake and Holt in witness protection in Florida: identity relocation, and boredom is the biggest opsec threat",Witness Protection,PR,"A.5.16, A.5.34"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Audit,The precinct scrambles to hide problems from the auditor: audit prep theater instead of actual remediation,Audit Theater,GV,"A.5.35, A.5.36"
Brooklyn Nine-Nine,brooklyn-99,fiction,Moo Moo,Terry profiled while off duty: detection systems keyed on the wrong signals entirely,Bias in Detection,"GV, DE","A.5.34, A.6.3"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Bank Job,Jake and Rosa go dirty to expose Hawkins from inside her crew: the internal affairs sting against a corrupt insider,Internal Affairs,"ID, DE","A.6.1, A.5.28"
Brooklyn Nine-Nine,brooklyn-99,fiction,Crime & Punishment,Hawkins frames Jake and Rosa with fabricated evidence: the corrupt insider turning the system's trust against its own,Evidence Fabrication,"DE, RS","A.5.28, A.5.26"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Big House Pt 1,Jake in prison building alliances to survive: trust networks under hostile conditions,Survival Networking,RS,"A.5.29, A.6.3"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Honeypot,"A spy flirts his way toward Holt for Wuntch: the literal honeypot, flipped into a double agent",Honeypot,"ID, DE","A.6.1, A.6.3"
Brooklyn Nine-Nine,brooklyn-99,fiction,Safe House,"Kevin under protection, full comms blackout: protective isolation, and the protected party is the one who breaks protocol",Protective Isolation,PR,"A.7.6, A.5.14"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Box,"One suspect, one room, one night: the interrogation is pure social engineering with the pressure reversed",Social Engineering,DE,"A.5.28, A.6.3"
Brooklyn Nine-Nine,brooklyn-99,fiction,Show Me Going,"Rosa inside an active shooter scene, the squad can only wait: incident response when you're not the responder",Incident Response,RS,"A.5.26, A.5.29"
Brooklyn Nine-Nine,brooklyn-99,fiction,A Tale of Two Bandits,"Doug Judy's funeral con: faked death to escape obligations, verified by nobody",Faked Death,ID,"A.5.16, A.5.28"
Brooklyn Nine-Nine,brooklyn-99,fiction,"He Said, She Said",The he-said-she-said case: evidence standards when accounts conflict and power protects one side,Evidence Standards,"DE, GV","A.5.28, A.6.4"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Crime Scene,Jake and Rosa rework one scene for weeks until the evidence appears: forensic persistence over first impressions,Forensics,DE,"A.5.28, A.8.15"
Brooklyn Nine-Nine,brooklyn-99,fiction,Windbreaker City,"Homeland Security drill casts the Nine-Nine as villains: tabletop exercise politics, the drill is about the org chart",Tabletop Politics,"GV, RS","A.5.29, A.5.26"
Brooklyn Nine-Nine,brooklyn-99,fiction,Pimento returns,"Adrian back from 12 years deep cover, broken: the human cost of long-term embedded operations",Deep Cover Cost,GV,"A.6.2, A.6.6"
Brooklyn Nine-Nine,brooklyn-99,fiction,Rosa's apartment,"Nobody knows where Rosa lives, ever: personal information compartmentalization as a lifestyle",Personal OPSEC,PR,"A.5.34, A.5.12"
Brooklyn Nine-Nine,brooklyn-99,fiction,Hitchcock & Scully,"Useless in the field, unbeatable at decades of paperwork: legacy systems holding institutional knowledge nobody else has",Legacy Knowledge,"GV, RC","A.5.37, A.5.30"
Brooklyn Nine-Nine,brooklyn-99,fiction,Amy's binders,"The runbook queen: when everything breaks, the person with documentation runs the room",Documentation,"PR, RC","A.5.37, A.5.29"
Brooklyn Nine-Nine,brooklyn-99,fiction,Debbie,Debbie robs the evidence lockup from inside: insider theft from the most controlled room in the building,Insider Theft,"DE, PR","A.8.15, A.7.2, A.5.18"
Brooklyn Nine-Nine,brooklyn-99,fiction,Dillman,"The prank gone wrong, everyone lies, one investigator: the internal investigation where every witness is a suspect",Internal Investigation,DE,"A.5.28, A.5.25"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Set Up,Jake surveils the wrong man because the theory came first: confirmation bias steering an investigation,Confirmation Bias,"DE, ID","A.5.25, A.5.28"
Brooklyn Nine-Nine,brooklyn-99,fiction,The Last Day,"The final heist: the exercise everyone trained on for eight years, run one last time: institutional knowledge transfer as a game",Knowledge Transfer,"RC, GV","A.5.30, A.6.3"
Star Wars,star-wars,fiction,'These aren't the droids you're looking for',"Authority bypass at the checkpoint via influence on an untrained guard: the mind trick only works on the weak-minded, which is why guard training exists",Checkpoint Bypass,PR,"A.6.3, A.7.2"
Star Wars,star-wars,fiction,Stormtrooper armor,"Luke and Han walk the Death Star in stolen uniforms: uniform-based authentication, again: the outfit is not the identity",Uniform Auth,PR,"A.5.16, A.7.2"
Star Wars,star-wars,fiction,R2-D2 carries the plans,"The crown jewel data rides an unmanaged endpoint across a war zone: and it works, because nobody screens the droid: your most critical data is on a device you don't track",Unmanaged Endpoint,"PR, ID","A.8.1, A.5.9, A.5.12"
Star Wars,star-wars,fiction,"'Help me, Obi-Wan Kenobi'","Encrypted message, named recipient, delivered out of band by trusted courier: Leia's comms discipline is better than the entire Imperial Navy's",Secure Comms,PR,"A.5.14, A.8.24"
Star Wars,star-wars,fiction,The exhaust port review board,"The Empire's own analysis flags the flaw and leadership waves it off: 'any attack would be a useless gesture': risk assessment overruled by ego, station lost",Dismissed Findings,"GV, ID","A.5.8, A.8.8, A.5.25"
Star Wars,star-wars,fiction,The evacuation of Hoth,"Shield up, ion cannon covering, transports staged, phased withdrawal: the best-executed disaster recovery plan in the galaxy: they lost the base and saved the org",Disaster Recovery,"RC, RS","A.5.29, A.5.30, A.5.26"
Star Wars,star-wars,fiction,The probe droid,Recon device detected on the ice: but detected after it transmitted: detection without speed is documentation,Late Detection,DE,"A.8.16, A.5.25"
Star Wars,star-wars,fiction,Lando's deal,"'This deal is getting worse all the time': the coerced partner, terms altered unilaterally under duress: every vendor relationship should be read with Cloud City in mind",Coerced Partner,GV,"A.5.19, A.5.22, A.6.2"
Star Wars,star-wars,fiction,Boba Fett and the garbage,He tracks the Falcon by attaching to the discarded waste: following the trash: disposal is part of your attack surface,Disposal Surveillance,"DE, PR","A.7.10, A.8.10"
Star Wars,star-wars,fiction,'I allowed the Alliance to know the location',The Emperor leaks the Death Star II intel as bait: the fake vulnerability disclosure luring the attack into a prepared kill zone: the honeypot at battle-station scale,Honeypot,"DE, ID","A.5.7, A.8.16"
Star Wars,star-wars,fiction,The Endor shield generator,The station's entire defense depends on one ground facility: the external dependency as the attack path: your strongest system inherits its weakest dependency,Dependency Risk,"ID, PR","A.5.9, A.8.6, A.8.22"
Star Wars,star-wars,fiction,Ewoks,The underestimated local defenders with terrain knowledge and improvised tooling beat the professional force: never scope the defenders by their equipment,Asymmetric Defense,PR,"A.5.7, A.6.3"
Star Wars,star-wars,fiction,Padmé's decoy,"The queen and the handmaiden swap: executive protection via decoy assets, and it works repeatedly because attackers verify appearance, not identity",Decoy Assets,PR,"A.5.16, A.7.6"
Star Wars,star-wars,fiction,Kamino erased from the archives,"'If an item does not appear in our records, it does not exist': the librarian's total faith in a database someone already tampered with: data integrity failure plus institutional arrogance",Data Tampering,"DE, GV","A.8.15, A.5.33, A.5.28"
Star Wars,star-wars,fiction,Dooku tells the truth,"'The Republic is under the control of a Sith lord': accurate intel dismissed because of the source: evaluate the claim, not just the claimant",Dismissed Intel,ID,"A.5.7, A.5.25"
Star Wars,star-wars,fiction,Order 66,"The kill command pre-installed in every clone at manufacture, dormant for years, fired by one voice instruction: the supply chain backdoor activated fleet-wide simultaneously: the best logic bomb in fiction",Supply Chain Backdoor,"ID, PR","A.5.21, A.8.28, A.8.7"
Star Wars,star-wars,fiction,Palpatine runs both sides,"The threat actor manufacturing the war and selling the defense: he created the demand, supplied the response, and collected emergency powers as payment: audit who benefits from the crisis",Manufactured Threat,"GV, ID","A.5.7, A.5.19, A.5.3"
Star Wars,star-wars,fiction,Anakin's grooming,"Decades of patient cultivation of the org's most privileged user: flattery, secrets, us-versus-them framing, then the turn: insider radicalization is a long game and the signals were all there",Insider Radicalization,"ID, GV","A.6.1, A.6.3, A.8.16"
Star Wars,star-wars,fiction,The Jedi Council's blindness,The dedicated threat-detection professionals share a boardroom with the attacker for thirteen years: 'the dark side clouds everything' is the SOC that tuned out the signal sitting in front of it,Detection Failure,DE,"A.8.16, A.5.7, A.5.25"
Star Wars,star-wars,fiction,Holdo's need-to-know,"The plan withheld from the ranks triggers Poe's mutiny: over-compartmentalization creates the insider revolt it feared: need-to-know has a morale budget, spend it deliberately",Compartmentalization,GV,"A.5.12, A.5.14, A.5.3"
Fairy Tales,fairy-tales,fiction,Classic tale,"Straw, sticks, brick: three hardening tiers against the same attacker, and the wolf escalates to the chimney when the walls hold: patch every ingress",Hardening,PR,"A.8.9, A.7.1"
Fairy Tales,fairy-tales,fiction,Classic tale,"'What big eyes you have': the verification checklist runs, every check fails, and she proceeds anyway: anomalies noted are worthless if not acted on",Failed Verification,"PR, DE","A.5.16, A.6.3, A.5.25"
Fairy Tales,fairy-tales,fiction,Classic tale,Breadcrumb logging works until the birds eat the logs: retention failure strands you: and the candy house is the watering hole built for its victims,Log Retention,"DE, PR","A.8.15, A.6.3"
Fairy Tales,fairy-tales,fiction,Classic tale,"Unauthorized entry, brute forcing every config until 'just right', asleep in the asset when the owners return: dwell time ends at detection",Intrusion,DE,"A.8.16, A.7.2"
Fairy Tales,fairy-tales,fiction,Classic tale,"Services rendered, invoice refused, so he escalates and takes the children: ransomware economics, the second demand is always worse",Ransomware,"GV, RS","A.5.19, A.5.26"
Fairy Tales,fairy-tales,fiction,Nursery rhyme,All the king's horses and all the king's men: the most expensive incident response engagement ever assembled cannot restore what was never backed up,No Backup,RC,"A.8.13, A.5.30"
Fairy Tales,fairy-tales,fiction,Classic tale,"The name is the credential, and it leaks because he sings it in the woods: secret recovered by surveillance, contract voided: opsec on your own secrets",Credential Leak,"PR, DE","A.5.17, A.5.14, A.8.16"
Fairy Tales,fairy-tales,fiction,Classic tale,"Access expires at midnight sharp: the time-boxed token, and the glass slipper is the biometric that fits exactly one person",Token Expiry,PR,"A.5.17, A.8.5, A.5.16"
Fairy Tales,fairy-tales,fiction,Classic tale,"Repeated intrusions exfiltrating gold, hen, then harp: and the harp screams: the asset with a tamper alarm nearly ends him, so he destroys the access path behind him",Exfiltration,"DE, RS","A.8.12, A.8.16, A.5.26"
Fairy Tales,fairy-tales,fiction,Aesop,"Two false alarms burn all trust in the alerting, the real incident goes unanswered: alert fatigue kills response, and the sheep pay",Alert Fatigue,"DE, RS","A.5.25, A.8.16, A.5.26"
Fairy Tales,fairy-tales,fiction,Andersen,"Vendor sells an invisible product, every executive validates it to avoid looking foolish, one junior voice reports the finding: groupthink as a procurement control failure",Vendor Fraud,GV,"A.5.19, A.5.21, A.6.3"
Fairy Tales,fairy-tales,fiction,Classic tale,"One access method, one call phrase, and the prince replays it after observing the witch: 'let down your hair' is a credential spoken in cleartext",Replay Attack,PR,"A.8.5, A.5.17, A.5.14"
Fairy Tales,fairy-tales,fiction,Classic tale,"Every spinning wheel in the kingdom destroyed, except one in a forgotten tower: incomplete remediation, and the vuln finds her on schedule",Incomplete Remediation,"ID, PR","A.8.8, A.5.9"
Fairy Tales,fairy-tales,fiction,Classic tale,"Outruns every pursuer, then trusts the fox at the river crossing: evasion streaks end at the man-in-the-middle you asked for help",MITM,PR,"A.5.14, A.6.3"
Fairy Tales,fairy-tales,fiction,Classic tale,"The troll under the bridge taxes every crossing: man-in-the-middle on the only route, defeated by escalating to a bigger authority",MITM,"PR, RS","A.8.20, A.5.26"
Fairy Tales,fairy-tales,fiction,Classic tale,"The Marquis of Carabas doesn't exist: reputation fabricated claim by claim until the king believes the identity: build the legend, then spend it",Fabricated Identity,"ID, PR","A.5.16, A.6.1"
Fairy Tales,fairy-tales,fiction,Nursery rhyme,"Each remediation is bigger than the problem it fixes, spider to bird to cat to horse: the incident response cascade that kills the patient",Response Cascade,RS,"A.5.26, A.8.32"
Fairy Tales,fairy-tales,fiction,Aesop,The confident sprinter naps mid-race: sustained consistent monitoring beats brilliant intermittent effort every time,Consistency,"DE, GV","A.8.16, A.5.36"
Mythology,mythology,fiction,Greek,"The untrusted container opened out of curiosity, contents unrecoverable once released: and hope, the one thing left inside, is your recovery plan",Untrusted Container,"PR, RC","A.6.3, A.8.7, A.5.29"
Mythology,mythology,fiction,Greek,"Documented operating limits, a direct warning from the engineer, exceeded anyway for the thrill: thermal limits don't negotiate",Operating Limits,PR,"A.5.10, A.6.3"
Mythology,mythology,fiction,Greek,"Polyphemus screams that Nobody attacked him and no one comes: attribution destroyed by name spoofing: log poisoning, 800 BC",Log Poisoning,DE,"A.8.15, A.5.16"
Mythology,mythology,fiction,Greek,"Known social engineering vector ahead: crew gets wax (filtering), captain binds himself to the mast (pre-commitment): controls chosen before exposure, not during",Pre-Commitment,PR,"A.6.3, A.5.10"
Mythology,mythology,fiction,Greek,"The single unpatched spot on an otherwise hardened system, documented in exactly one place: the exception becomes the epitaph",Known Exception,"ID, PR","A.8.8, A.5.9"
Mythology,mythology,fiction,Greek,"Cannot be observed directly, so Perseus analyzes her in the mirror shield: indirect observation of the thing that kills direct lookers: sandboxing, mythologically",Sandboxing,"PR, DE","A.8.31, A.8.16"
Mythology,mythology,fiction,Greek,"The boulder rolls back down every single time: patch management as an eternal condition, not a project with an end date",Patch Mgmt,PR,"A.8.8, A.8.32"
Mythology,mythology,fiction,Greek,"Perfect threat intelligence, cursed to never be believed: the analyst whose accurate warnings die in the inbox: Troy burns on schedule",Ignored Intel,"ID, GV","A.5.7, A.5.25"
Mythology,mythology,fiction,Greek,The multi-headed gatekeeper at the one crossing: the actual namesake of Kerberos: authentication guarded this door before computers existed,Gatekeeping,PR,"A.8.5, A.5.15"
Mythology,mythology,fiction,Greek,"A hundred eyes, never all asleep, until Hermes bores every one of them shut with stories: the monitoring system socially engineered into downtime",SOC Fatigue,DE,"A.8.16, A.6.3"
Mythology,mythology,fiction,Greek,"Proprietary technology leaked to unauthorized users, punishment eternal: the insider exfiltration where the sanction outlives everyone's memory of the crime",IP Exfiltration,GV,"A.5.33, A.6.4, A.5.14"
Mythology,mythology,fiction,Greek,The wish executes exactly as specified with no exclusions list: poorly scoped automation turns food and daughter to gold: requirements are controls,Scoped Automation,"PR, GV","A.8.32, A.8.25"
Mythology,mythology,fiction,Norse,"Blood brother of Odin, shapeshifter, inside every hall: the polymorphic insider whose trusted status survives every incident until the last one",Polymorphic Insider,"ID, DE","A.6.1, A.8.16"
Mythology,mythology,fiction,Norse,"Everything on earth swore not to harm him, except one plant deemed too small to ask: Loki finds the gap by asking the owner directly: the allowlist exception enumerated by social engineering",Exception Enumeration,"ID, PR","A.6.3, A.5.9, A.8.8"
Mythology,mythology,fiction,Norse,"Needs no sleep, hears grass grow, watches the one bridge in: the ideal SIEM guarding a single ingress: consolidate the entry points and staff the watch",Single Ingress,"DE, PR","A.8.16, A.8.20"
Mythology,mythology,fiction,Norse,"The bound threat that breaks containment at the worst moment, and Tyr's hand is what binding cost: containment is not elimination, price it accordingly",Containment Limits,"RS, ID","A.5.26, A.5.8"
Mythology,mythology,fiction,Norse,They know exactly how the final incident goes and prepare anyway: Odin recruiting warriors for the known future breach: resilience under accepted residual risk,Accepted Risk,"GV, RC","A.5.8, A.5.29, A.5.30"
Drone Show Ops,drone-shows,real,Fleet ops,"The virtual perimeter every drone enforces onboard: the show boundary as a hard control, not a suggestion in the ops plan",Perimeter,PR,"A.8.9, A.7.1"
Drone Show Ops,drone-shows,real,Fleet ops,"Every airframe carries its own emergency stop and a default safe behavior on link loss: failsafe design as the first requirement, not a feature",Failsafe,RS,"A.5.26, A.8.31"
Drone Show Ops,drone-shows,real,Fleet ops,"One ground station commanding hundreds of aircraft: the command channel is the crown jewel: encrypt it, authenticate it, and assume someone's listening",C2 Security,PR,"A.8.20, A.8.24, A.8.5"
Drone Show Ops,drone-shows,real,Threat,Navigation integrity attacks against the positioning every drone trusts: RTK corrections and multi-constellation receivers as redundant truth sources,Nav Integrity,"PR, DE","A.8.16, A.8.20"
Drone Show Ops,drone-shows,real,Fleet ops,"The choreography file is the payload: hash and verify it before upload, because a tampered show file is a tampered flight path over a crowd",Payload Verification,PR,"A.8.24, A.8.32"
Drone Show Ops,drone-shows,real,Fleet ops,"One update pushed to every airframe: the supply chain risk of your own fleet: stage rollouts, verify signatures, keep a known-good version",Supply Chain,"PR, RC","A.8.32, A.5.21, A.8.13"
Drone Show Ops,drone-shows,real,Fleet ops,"Battery health, props, sensors, link, weather: the checklist is change control for atoms: no green sheet, no launch",Change Control,"PR, GV","A.5.37, A.8.32"
Drone Show Ops,drone-shows,real,Fleet ops,Wind and precipitation limits are documented operating boundaries: Icarus rules: the show that launches past minimums is the incident report writing itself,Operating Limits,"GV, PR","A.5.10, A.5.8"
Drone Show Ops,drone-shows,real,Fleet ops,Exclusion zones sized to failure modes: blast radius planning where the blast radius is literal: distance is the control that needs no power,Blast Radius,PR,"A.7.1, A.5.8"
Drone Show Ops,drone-shows,real,Compliance,"The license to operate: night ops, over-people ops, swarm waivers: compliance isn't paperwork, it's the permission structure the business stands on",Regulatory,GV,"A.5.31, A.5.36"
Drone Show Ops,drone-shows,real,Fleet ops,"NOTAMs, LAANC, coordination with everything else flying: the shared-environment protocol work that prevents the worst class of incident",Coordination,"GV, PR","A.5.14, A.5.31"
Drone Show Ops,drone-shows,real,Threat,Somebody else's aircraft entering your show box mid-performance: airspace intrusion detection and the abort decision tree it triggers,Intrusion Detection,"DE, RS","A.8.16, A.5.26"
Drone Show Ops,drone-shows,real,Fleet ops,Dark spots in the sky are availability incidents the audience can see: spares staged and slotted into the design: redundancy as showmanship,Redundancy,RC,"A.5.29, A.5.30"
Drone Show Ops,drone-shows,real,Fleet ops,"Every flight logged per airframe: the audit trail for incidents, warranty, insurance, and the FAA conversation you hope never happens",Audit Trail,DE,"A.8.15, A.5.28"
Drone Show Ops,drone-shows,real,Fleet ops,"Licensed, current, named on the ops plan: access control on the sticks: the person is a control surface too",Operator Access,PR,"A.5.15, A.6.1, A.6.3"
Sports Cheating Scandals,sports-cheating,real,"2017, MLB","Center field camera, live video room, trash can bangs relaying pitch calls: SIGINT plus a covert audio channel, in the postseason",SIGINT,"DE, GV","A.8.16, A.5.28"
Sports Cheating Scandals,sports-cheating,real,"2007, NFL",Videotaping opposing coaches' signals from the sideline: unauthorized surveillance of the adversary's command channel,Surveillance,ID,"A.5.7, A.8.16"
Sports Cheating Scandals,sports-cheating,real,"2015, NFL","Equipment tampering allegations, and the destroyed cell phone that mattered more: evidence destruction turns a question into a verdict",Evidence Destruction,"DE, RS","A.5.28, A.5.26"
Sports Cheating Scandals,sports-cheating,real,"1999-2012, cycling","Systematic doping program with enforced silence, whistleblowers sued and destroyed: suppressing your reporters works until it catastrophically doesn't",Whistleblower Suppression,GV,"A.6.4, A.5.35, A.5.28"
Sports Cheating Scandals,sports-cheating,real,"1919, MLB","Eight players bribed to throw the World Series: insider match fixing, lifetime bans, and a commissioner's office created as the response",Insider Bribery,"GV, RS","A.6.1, A.6.4, A.5.27"
Sports Cheating Scandals,sports-cheating,real,"1980, Boston Marathon","Wins via the subway: no checkpoint sightings, no split times, no sweat: telemetry gaps expose the integrity fraud in days",Missing Telemetry,DE,"A.8.15, A.8.16, A.5.28"
Sports Cheating Scandals,sports-cheating,real,"2000, Sydney","Most of the gold-medal roster faked disabilities: credential fraud at the eligibility layer, exposed by an insider journalist",Credential Fraud,"ID, DE","A.5.16, A.6.1"
Sports Cheating Scandals,sports-cheating,real,"1994, figure skating",Attack the competitor's availability instead of raising your own capability: the physical DoS on a rival asset,Rival Attack,ID,A.5.7
Sports Cheating Scandals,sports-cheating,real,"2002, Olympics","Judge collusion trading scores across events: the scoring system itself compromised, fixed by redesigning anonymity and panels",Corrupted Scoring,"GV, DE","A.5.3, A.5.28"
Sports Cheating Scandals,sports-cheating,real,"2006, Serie A",Club executives steering referee assignments by phone: compromising the assignment system beats bribing any single official,System Compromise,"GV, DE","A.5.3, A.8.15"
Sports Cheating Scandals,sports-cheating,real,"2000, cricket","The captain fixing matches: leadership as the insider, and the team follows orders it shouldn't: authority plus corruption compounds",Leader Insider,GV,"A.6.1, A.5.3"
Sports Cheating Scandals,sports-cheating,real,"1984, horse racing","Substitute a faster horse with a dye job: asset substitution with bad spoofing, the paint literally ran at the track",Asset Substitution,DE,"A.5.16, A.5.28"
Sports Cheating Scandals,sports-cheating,real,"1976, Olympics","A wired epee registering hits that never landed: hardware tampering to spoof the telemetry, caught mid-bout",Telemetry Spoofing,"DE, PR","A.8.16, A.7.10"
Sports Cheating Scandals,sports-cheating,real,"2019, admissions","Bribed coaches, faked athletic profiles, corrected test answers: credential fraud through purchasable insiders at every checkpoint",Insider Bribery,"GV, ID","A.6.1, A.5.16, A.5.28"
Video Games,video-games,fiction,2018,"The insider threat tabletop people play for fun: emergency meetings are IR huddles, venting is a covert channel, and visual tasks are attestable behavior: verification beats vibes",Insider Tabletop,"ID, DE","A.6.1, A.5.28, A.8.16"
Video Games,video-games,fiction,2005,A raid debuff escapes its zone via pets and NPCs and plagues the world: unintended propagation so realistic epidemiologists published on it: model your spread paths,Unintended Propagation,"ID, RS","A.8.31, A.5.26, A.8.22"
Video Games,video-games,fiction,2005,A year-long infiltration of a player corporation ending in simultaneous theft and assassination: the long con in a world where trust has real dollar value,Long Infiltration,ID,"A.6.1, A.5.19"
Video Games,video-games,fiction,Culture,"Glitch hunting is vulnerability research, routing is exploit chaining, TAS is automated exploitation: the friendliest offensive security community there is",Vuln Research,ID,"A.8.8, A.8.29"
Video Games,video-games,fiction,Series,Skipping the intended access flow to reach late-game areas early: authorization logic assumed an order the user never agreed to follow,Auth Flow Bypass,PR,"A.5.15, A.8.26"
Video Games,video-games,fiction,1996,"A memory corruption bug that duplicates items, beloved by users: the vulnerability the community refuses to let you patch because it's useful",Beloved Bug,PR,"A.8.8, A.8.26"
Video Games,video-games,fiction,1986,A developer backdoor shipped in production and passed down for forty years: up up down down is the most famous undocumented access path in software,Shipped Backdoor,PR,"A.8.28, A.8.9"
Video Games,video-games,fiction,2004,"Disabled content still present in the shipped binary, unlocked by modders: 'removed' meant hidden, and the liability shipped with the disc",Dead Code,"GV, PR","A.8.28, A.8.10"
Video Games,video-games,fiction,2006,A bug lets players kill inside safe zones during a party: the trust boundary fails exactly where users were promised safety,Trust Boundary,"PR, RS","A.8.26, A.5.26"
Video Games,video-games,fiction,Minecraft,"No rules, no admins, a decade of griefing, hacks, and player-built defense: the longest-running experiment in what zero governance actually produces",Zero Governance,GV,"A.5.1, A.5.2"
Video Games,video-games,fiction,Series,"Crowd-sourced hints where 'try jumping' means a trap: untrusted community intel, verify before you leap: praise the sun anyway",Untrusted Intel,ID,"A.5.7, A.6.3"
Video Games,video-games,fiction,2014,"A hundred thousand people share one controller, anarchy vs democracy modes: governance models as a live public experiment, and somehow Red still wins",Governance Experiment,GV,"A.5.1, A.5.2"
Video Games,video-games,fiction,Ongoing,Kid-targeted credential theft and resale for skins: the youngest users defending accounts with real value and no training: family MFA is a security program,Kid Credentials,PR,"A.5.17, A.6.3, A.8.5"
Video Games,video-games,fiction,2005,"The whole raid plans meticulously, one member charges in early: the teammate who bypasses the change window, at least he has chicken",Change Discipline,"GV, RS","A.8.32, A.5.26"
Real World Heists,real-world-heists,real,"2003, Belgium","Years as a tenant building trust, then heat, motion, and magnetic sensors defeated with hairspray and ingenuity: taken down by DNA in a discarded trash bag: entry was flawless, disposal wasn't",Long Embed / OPSEC,"PR, DE","A.7.1, A.7.4, A.5.28"
Real World Heists,real-world-heists,real,"1990, Boston","Two men in police uniforms buzzed in by the night guard: uniform-based authentication, thirteen works gone, still unsolved: the empty frames still hang",Uniform Auth,PR,"A.5.16, A.7.2, A.6.3"
Real World Heists,real-world-heists,real,"2015, London","Drilled through the vault wall over a holiday weekend: attack timed to the low-staffing window, then caught via license plates and pub bragging: comms discipline ends careers",Timing / OPSEC,"PR, DE","A.7.4, A.8.16, A.5.28"
Real World Heists,real-world-heists,real,"1971, USA","Ransom, parachute, night jump, gone: the clean exit remains the hardest part of any operation, and the only unsolved US hijacking proves it",Clean Exit,RS,"A.5.26, A.5.28"
Real World Heists,real-world-heists,real,"2005, Fortaleza","A landscaping company storefront, 78 meters of tunnel over three months: the cover business buying time and legitimacy for the dig",Cover Business,"ID, PR","A.5.16, A.7.1"
Real World Heists,real-world-heists,real,"1978, JFK","Inside tip from an airport worker unlocks the vault, then the crew is eliminated one by one: co-conspirators are loose ends in the attacker's threat model too",Insider Tip,ID,"A.6.1, A.6.2"
Real World Heists,real-world-heists,real,"1911, Louvre","A former employee hides overnight and walks out with it under his smock, missing for a day before anyone's sure: insider theft plus detection delay, recovered only when he tried to sell",Insider Theft,"DE, PR","A.6.5, A.7.2, A.8.16"
Real World Heists,real-world-heists,real,"2000, London","Police knew, swapped the diamond for a replica, and staffed the dome with disguised officers: the defenders ran the deception op and let the attack proceed into it",Defensive Deception,"DE, RS","A.5.7, A.5.26, A.8.16"
Real World Heists,real-world-heists,real,"2019, Dresden","Fire set at the electrical box first, then the window: disable the supporting infrastructure before touching the target",Infra First,PR,"A.7.5, A.8.6, A.7.4"
Real World Heists,real-world-heists,real,"1997, LA",The security officer robs his own facility with insider knowledge of cameras and schedules: caught years later by a serial number on a discarded strap,Guard as Thief,"ID, DE","A.6.1, A.5.28"
Real World Heists,real-world-heists,real,"2006, UK",Manager's family taken to coerce his access: duress against the privileged insider: the control set has to assume your people can be leveraged,Duress,"GV, PR","A.6.2, A.5.17, A.7.2"
Real World Heists,real-world-heists,real,"2016, Paris","Targeting built from her own posts: location, jewelry, schedule, security posture, all public: oversharing as the recon package",OSINT Oversharing,ID,"A.5.34, A.5.14"
Real World Heists,real-world-heists,real,"2025, Paris","Furniture lift to the balcony, angle grinders, out in minutes in daylight: speed beating response time, and deferred physical security upgrades presenting the bill",Speed vs Response,"PR, RS","A.7.1, A.7.4, A.5.26"
Real World Heists,real-world-heists,real,"2016, Bangladesh Bank",Cross-listed from the incidents workbook because it belongs here too: $850M of theft stopped by a misspelled word: sometimes the last control is luck,Luck as Control,DE,"A.8.16, A.5.25"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Twenty-five years, one objective, endless techniques: the advanced persistent threat with a 1% market share and infinite patience",APT,ID,A.5.7
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"The single trade secret the entire business rests on, locked in a safe: crown jewel identification done right, everything else is expendable",Trade Secrets,"PR, ID","A.5.12, A.5.33, A.5.9"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Obsesses over the asset, spends nothing on anything else: the owner who guards the safe and skips every other control to save a nickel",Underinvestment,GV,"A.5.1, A.5.2"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Plankton's robot Krabs nearly gets the formula handed over: executive impersonation, exposed by a behavioral tell (the coin slot): verify the boss acting weird",Exec Impersonation,"PR, DE","A.5.16, A.6.3, A.8.16"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Plankton befriends SpongeBob to get inside: recruitment via manufactured friendship, and genuine kindness almost turns the attacker",Insider Recruitment,PR,"A.6.3, A.6.1"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"The attacker's AI: better plans than her operator, routinely ignored: even threat actors have analyst retention problems",Attacker Tooling,ID,A.5.7
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"The fabricated defect claim: pickles hidden under his tongue: false quality complaints as reputation attack, defeated by inspection",False Claims,DE,A.5.28
SpongeBob SquarePants,spongebob,fiction,SpongeBob,Bad words learned off the dumpster: users discover the filter bypass strings in the wild and share them instantly: content controls vs community knowledge,Filter Bypass,PR,"A.6.3, A.5.10"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Door-to-door with escalating sales scripts, and the con man working the same street: social engineering is a volume business on both sides",Social Engineering,PR,A.6.3
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"POOP: People Order Our Patties: onboarding and awareness training as corporate theater, and the actual secret redacted at the end",Awareness Training,"GV, PR","A.6.3, A.5.37"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Krabs loses SpongeBob's contract in a card game: the employment contract as a transferable asset, read your own paperwork",Contract Risk,GV,"A.6.2, A.5.19"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Fully disengaged, phones it in daily, nobody manages the risk: security apathy at the register is a control gap with a nametag",Disengagement,GV,"A.6.2, A.6.3"
SpongeBob SquarePants,spongebob,fiction,SpongeBob,"Recruits every relative for one job: the unsophisticated botnet, high headcount, zero capability per node",Botnet,ID,A.5.7
SpongeBob SquarePants,spongebob,fiction,SpongeBob,Powerful legacy tooling in untrained hands shrinks half the town: capability without competence is an incident generator,Tool Misuse,PR,"A.6.3, A.8.2"
Shakespeare,shakespeare,fiction,Othello,"'Honest Iago': reputation as cover for the greatest insider manipulation ever written, and the planted handkerchief is fabricated evidence that ends everyone: whisper campaigns beat swords",Insider Manipulation,"ID, DE","A.6.1, A.5.28, A.5.14"
Shakespeare,shakespeare,fiction,Hamlet,"Hamlet won't act on the ghost's claim alone, so he stages a test and watches the reaction: intel verified by designed experiment before response: 'the play's the thing'",Intel Verification,"ID, DE","A.5.7, A.5.28"
Shakespeare,shakespeare,fiction,Hamlet,"Surveillance from a hiding spot in the wrong room at the wrong time: collection ops carry physical risk, and he pays it",Surveillance Risk,DE,"A.8.16, A.7.4"
Shakespeare,shakespeare,fiction,Macbeth,A threat feed that's technically accurate and completely manipulative: Macbeth acts on intercepted prophecy and self-fulfills it: consider the source's motive,Manipulative Intel,ID,"A.5.7, A.5.14"
Shakespeare,shakespeare,fiction,Macbeth,"Each murder covers the last, the conspirators unravel psychologically: cover-ups compound until the response costs more than any disclosure would have",Cover-Up,"RS, GV","A.5.27, A.5.26"
Shakespeare,shakespeare,fiction,King Lear,"Access handed out by flattery, the honest auditor exiled for an accurate answer: then the flatterers de-provision the old admin completely: succession by sycophancy",Succession Failure,GV,"A.5.3, A.5.2, A.6.4"
Shakespeare,shakespeare,fiction,Romeo and Juliet,"One message, one channel, no delivery confirmation, quarantine blocks the courier: the race condition resolves as tragedy: critical comms need redundancy and acks",Comms Failure,"PR, RS","A.5.14, A.5.29"
Shakespeare,shakespeare,fiction,Twelfth Night,"Forged handwriting, ambiguous content the victim completes himself, M.O.A.I.: the spear phish where the mark does half the work: yellow stockings follow",Spear Phishing,PR,"A.6.3, A.5.16"
Shakespeare,shakespeare,fiction,Twelfth Night,Sustained identity spoofing that works because nobody runs a second check: the disguise holds until the identical twin creates a collision,Identity Spoofing,"PR, DE","A.5.16, A.8.5"
Shakespeare,shakespeare,fiction,Merchant of Venice,"Contract terms read adversarially and enforced literally, defeated by finer print (flesh, but no blood): every agreement is an attack surface: read yours like Portia",Adversarial Contracts,GV,"A.5.19, A.5.31"
Shakespeare,shakespeare,fiction,Henry V,"The insider plot detected before departure, and Henry hands the conspirators their own indictments disguised as commissions: the sting that delivers its own evidence",Insider Sting,"ID, DE","A.6.1, A.5.28"
Shakespeare,shakespeare,fiction,Much Ado About Nothing,"A staged encounter performed to be overheard: fabricated visual evidence of infidelity, believed instantly: the deepfake, produced live with actors",Staged Evidence,DE,"A.5.28, A.5.14"
Shakespeare,shakespeare,fiction,The Tempest,"The ousted administrator retains root in exile and engineers the storm that brings his usurpers to him: the fired sysadmin's revenge, resolved unusually with restoration and forgiveness",Retained Access,"GV, PR","A.6.5, A.5.18, A.8.2"
Christmas Specials,christmas-specials,fiction,How the Grinch Stole Christmas,"Santa suit as uniform auth, and when tiny Cindy Lou runs the challenge, the pretext is smooth ('a light on this side won't work'): full exfiltration, then voluntary return: the attacker who gives the keys back",Impersonation,PR,"A.5.16, A.6.3, A.7.2"
Christmas Specials,christmas-specials,fiction,Canon,"Continuous behavioral monitoring on every endpoint, checked twice: annual audit with dual verification before any delivery decision",Monitoring / QA,"DE, GV","A.8.16, A.5.36"
Christmas Specials,christmas-specials,fiction,Dickens,"Three assessors in one night: past (log review), present (current state), future (risk projection): the full audit engagement, findings accepted, remediation immediate: and Marley is the peer who ignored his report",The Full Audit,"GV, ID","A.5.35, A.5.7, A.8.15"
Christmas Specials,christmas-specials,fiction,It's a Wonderful Life,"Eight thousand dollars misplaced by human error, kept by the adversary who finds it, bank run follows: one handling mistake cascades into an existential confidence crisis",Human Error,"RS, GV","A.5.29, A.6.3"
Christmas Specials,christmas-specials,fiction,It's a Wonderful Life,The consultant shows George the world without him: the business impact analysis as narrative: you don't know what a control is worth until you model its absence,Impact Analysis,"ID, GV","A.5.8, A.5.29"
Christmas Specials,christmas-specials,fiction,The Santa Clause,"Put on the suit, accept the terms: the clickwrap contract executed by physical action, obligations discovered after acceptance: read before you wear",Clickwrap Terms,GV,"A.5.19, A.5.31"
Christmas Specials,christmas-specials,fiction,The Nightmare Before Christmas,"Takes over another team's production service with enthusiasm and no runbook: the deploy is a disaster, rollback executed by the actual SME: stay in your lane or read the docs",Unauthorized Takeover,"GV, RC","A.5.2, A.8.32, A.5.30"
Christmas Specials,christmas-specials,fiction,Rudolph the Red-Nosed Reindeer,The anomalous node excluded by the team becomes the only one functional in degraded conditions: the misfit feature is your fog-weather failover,Failover,RC,"A.5.29, A.5.30"
Christmas Specials,christmas-specials,fiction,Gremlins,"Three vendor operating instructions: no water, no food after midnight, no bright light: every casualty in the film traces to ignoring the README: RTFM as survival",Ignored Instructions,"PR, GV","A.5.37, A.6.3, A.5.10"
Christmas Specials,christmas-specials,fiction,Frosty the Snowman,The containment chosen to protect the asset is exactly what destroys it: locked in with the heat: verify the safe room is actually safe for what you're putting in it,Bad Containment,RS,"A.5.26, A.5.29"
Christmas Specials,christmas-specials,fiction,The Polar Express,"The access token punched and validated in transit, blown out the window and returned: token lifecycle drama, and possession really is the whole factor",Access Tokens,PR,"A.5.17, A.8.5"
Christmas Specials,christmas-specials,fiction,A Charlie Brown Christmas,"The underestimated legacy asset everyone mocks: with a little support and the right framing, it carries the whole production",Legacy Assets,GV,"A.5.9, A.8.10"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"Every gadget from one vendor, none tested before production, no post-mortems, repeats failed tactics forever: the red teamer with an ACME dependency",Vendor Dependency,"GV, PR","A.5.19, A.5.21, A.8.29"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"Never engages, never stops, never clicks: the target that cannot be socially engineered because it does not interact: beep beep",Non-Engagement,PR,A.6.3
Looney Tunes,looney-tunes,fiction,Looney Tunes,"Disguises, misdirection, and the rabbit season/duck season debate: manipulating the adversary into arguing your position until he shoots himself",Manipulation,"PR, ID","A.6.3, A.5.14"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"'Mine mine mine': greed exceeding operational discipline, grabbing treasure until the genie catches him: exfiltration blown by refusing to leave",Greed vs OPSEC,PR,"A.6.3, A.5.10"
Looney Tunes,looney-tunes,fiction,Looney Tunes,'I tawt I taw a puddy tat': the small asset with a guardian who believes its alerts: Granny is the response function that always answers,Protected Asset,"DE, RS","A.8.16, A.5.26"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"'Where's the kaboom?': quiet, polite, and holding a planet-killer: the calm adversary is the dangerous one, volume is not threat level",Quiet Adversary,ID,"A.5.7, A.5.8"
Looney Tunes,looney-tunes,fiction,Looney Tunes,Overwhelms with talk while the dog's rope stops one foot short: the perimeter control with a hard range limit everyone knows to the inch,Control Limits,PR,"A.7.1, A.8.16"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"All volume, all signature moves, telegraphs everything: the noisy attacker whose TTPs are memorized by every defender",Noisy TTPs,DE,"A.5.7, A.8.16"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"Pure destruction with zero objective: the DoS attacker, no data taken, everything down: some threats just spin",DoS,RS,"A.8.20, A.5.29"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"Clock in, attack and defend all shift, clock out, walk home together: red team and blue team as professional counterparts: the whole industry in one gag",Red vs Blue Culture,GV,"A.6.3, A.5.2"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"The fastest node wins every race: latency as the deciding advantage, defenders included",Latency,"DE, RS","A.8.16, A.5.26"
Looney Tunes,looney-tunes,fiction,Looney Tunes,"'Be vewy vewy quiet': patient hunting, ruined every time by engaging the target in conversation: don't chat with the adversary mid-operation",Engagement Risk,PR,"A.6.3, A.5.14"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,"It's always an insider in a mask with a financial motive, usually real estate: attribution lands on the disgruntled local, every single time",Insider Attribution,"ID, DE","A.6.1, A.5.28"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,The haunting is FUD manufactured to scare people off an asset and crater its value: fear as market manipulation,Manufactured FUD,ID,"A.5.7, A.5.14"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,Every scheme fails to persistent investigators who keep pulling threads: sustained curiosity beats every costume,Persistence,DE,"A.5.28, A.8.16"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,"The whole team's analytical capability rides on one person, and hers rides on one fragile artifact: 'my glasses' is a single point of visibility failure",Visibility SPOF,"DE, GV","A.8.16, A.5.2"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,The lure roles: draw the monster into the trap by being irresistible targets: honeypot operations with snacks,Honeypot,DE,A.8.16
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,"Overengineered, mis-sprung, catches the team half the time: elaborate controls that fail their first live test, iterate until they hold",Control Testing,"PR, RS","A.8.29, A.5.26"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,Dividing the response team in a hostile environment: terrible IR doctrine that survives because the plot demands it: keep your responders paired,IR Doctrine,RS,"A.5.26, A.5.29"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,Finds every trapdoor by falling through it: the user who accidentally fuzzes the environment is your cheapest vulnerability scanner,Accidental Fuzzing,ID,"A.8.8, A.8.29"
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,"Attribution comes last, after evidence: the reveal only lands because the case was built first: name the actor when you can prove it",Attribution,DE,A.5.28
Scooby-Doo,scooby-doo,fiction,Scooby-Doo,The mobile SOC: whole capability rolls to the incident site: response goes where the haunting is,Mobile Response,RS,"A.5.26, A.5.29"