The notification does not come from your monitoring. It comes from a supplier, or from a journalist, or from a list on a leak site with your name on it, and the first internal question is one nobody can answer quickly: do we run that?
The pattern behind the summer's larger campaigns is the same. Rather than attacking many organisations, attack one product that many organisations run, and the victims arrive in a batch — dozens of large names from a single platform, hundreds of victims across unrelated industries from a single group. Nobody in those organisations was careless in a way that would have shown up on their own perimeter.
There is a very old piece of assessment doctrine that fits this precisely, and the half of it that matters is the half people skip.
The ledger has two columns and one of them is yours
The doctrine holds that the outcome of a contest is forecastable: lay both sides on the same ledger, honestly, and you can see it before anything starts. What gets remembered is the first column — know the opponent. What the text actually insists on is that the gaps matter on both sides, and that the harder gap to close is the one in your own column, because it is not ignorance, it is refusal.
Applied here, most defensive spending goes into the first column. Threat intelligence, indicators, briefings on which group is doing what this quarter. That work is real and it is also, for this particular failure mode, close to irrelevant: it does not matter which group is running the campaign if you cannot establish within a day whether you are exposed to the platform they are running it against.
The decisive column is the second one. The attacker, in these campaigns, holds an accurate enumeration of who runs a given product. That enumeration is often better than the defender's own, because the attacker built it deliberately and the defender never built it at all.
What has to be on it
Three things, and none requires a new tool.
Every third party that holds your data or can reach into your systems, with a named internal owner. Not the procurement list — procurement records who was paid, which is a different set from who has access.
For each, what happens if it is unavailable for two weeks. Extortion is not only a confidentiality event; the operational half is usually what decides the cost, and it is rarely the half rehearsed.
And what the contract actually entitles you to. Notice within what period, of what, and to whom. Most organisations discover the answer during the incident, which is the worst moment to read it for the first time.
The awkward finding, and the reason this stays undone, is that assembling this list is not a security project. It crosses procurement, legal and every business unit that ever signed something, and it produces a number that somebody will be uncomfortable owning.
Watch out for
This lens has a specific defect and it is directly in the way here. The text has no account of cooperation. Every party on the board is an opponent to be assessed, and applied to your suppliers — the people whose candour you most need — that framing produces exactly the wrong behaviour. A vendor questionnaire run as an interrogation gets you a compliant document and no disclosure; the supplier who tells you early that they are investigating something is doing you a favour that the assessment posture treats as an admission to be logged.
The same defect shows up between defenders. The reason these campaigns are visible at all is that organisations and agencies published what they were seeing, which is a positive-sum act the doctrine cannot recommend and can only ever read as revealing your dispositions.
And the transfer itself is loose. The received text is a compilation about agrarian-age warfare — chariots, grain, signal fires. Nothing in it concerns software, contracts or a shared platform, and the reason it survives here is a single structural observation about honest ledgers, not any tactical content.
Answer this next
Ask for the number: how many third parties can currently reach into your systems or hold your data?
If nobody can produce it this week, that is the finding — and it is the same finding whichever group is in the news.
