Every computer has doors — some visible, some hidden. Hackers spend their time looking for a door that was accidentally left unlocked.
Software sometimes has mistakes in it called vulnerabilities — tiny flaws in the code that let someone sneak in if they know exactly where to push. Every program has them; the difference between a safe system and an exposed one is usually just whether someone found and fixed the flaw before an attacker found it and used it. Companies release updates ("patches") specifically to lock these doors — which is why ignoring that little "update available" notification is genuinely risky, not just annoying.
The problem isn't a shortage of patches. It's that patches sit unapplied for months, sometimes years, on real systems. According to Verizon's 2025 Data Breach Investigations Report — an 18th-annual analysis covering more than 22,000 real security incidents worldwide — exploitation of known vulnerabilities was behind roughly 20% of breaches where the cause wasn't simple human error or misuse.1 And within that category, attacks specifically targeting internet-facing devices like VPNs and network edge equipment jumped from just 3% of vulnerability-driven breaches to 22% in a single year — a sign that attackers have shifted hard toward hitting the equipment sitting right at the edge of a network, exposed to the whole internet.
Sometimes the easiest way in isn't a broken door at all — it's asking someone, politely and convincingly, to open it for you. That's the essence of phishing: trick a real person into clicking a link, opening a file, or handing over a password, and the hacker never has to break anything technical at all. It works because it targets judgment under pressure, not a flaw in code — and judgment under pressure is something every human has, no matter how good the surrounding technology is.
Stolen or guessed credentials remain the single most common way attackers actually get in — used in about 22% of breaches in the same Verizon dataset, edging out phishing itself (16%) and vulnerability exploitation (20%) as the single biggest category on its own.1 Put those three together and they explain more than half of all breaches where the cause is known — and notably, none of them requires anything close to a movie-hacker level of sophistication.
If a password is short, simple, or reused across sites, a hacker's computer can try thousands — sometimes millions — of guesses per second until one works. How fast depends almost entirely on two things: how long the password is, and how many different types of characters it mixes in. The gap between a weak password and a strong one isn't small — it's the difference between "cracked before you finish reading this sentence" and "longer than the universe has existed."
According to Hive Systems' 2025 Password Table — an annually updated, widely cited benchmark of real brute-force cracking speed against modern hardware — an eight-character password using only lowercase letters can be cracked in about three weeks. Stretch that to ten characters mixing upper and lowercase letters, and it jumps to roughly 112 years — longer than a human lifetime. Push it to fourteen characters with the full mix of upper, lower, numbers, and symbols, and the estimate reaches roughly 52 billion years — meaningfully longer than the age of the universe itself.2
Sometimes hackers don't attack the front door at all — they find a forgotten, unmonitored device connected to the same network and use it as a way in. An old server nobody's logged into in years. A smart camera or thermostat with a default password nobody ever changed. A VPN appliance installed once, configured correctly at the time, and never looked at again since. None of these devices are "the target" in any meaningful sense — they're just the weakest, least-watched entry point into a network that's otherwise reasonably well defended.
This is why multi-factor authentication (MFA) matters so much as a practical defense, even against attacks that start with a stolen or guessed password. Industry telemetry on identity-based attacks suggests modern MFA is assessed to prevent more than 99% of them outright — turning a stolen password from "instant access" into "one useless piece of a puzzle the attacker still can't complete."3 It's one of the few defenses that meaningfully closes several different doors — phishing, credential stuffing, brute-force — all at once.
None of these methods require a sophisticated attacker or an exotic technique — they succeed because someone, somewhere, left a door unlocked and nobody checked. A few practical takeaways: