At Maturity Level One, the focus is on protecting against malicious actors who use widely available, low-sophistication tools and techniques to compromise systems. These attackers typically do not target specific organisations. Instead, they opportunistically scan for common vulnerabilities across many networks, looking for easy entry points.

For example, an attacker might:

• Exploit an unpatched vulnerability in a publicly exposed system
• Use stolen, reused, brute-forced, or easily guessed credentials to gain access
• Trick users into launching malicious applications through basic social engineering tactics

These actors are primarily interested in any vulnerable system, not necessarily yours. If they manage to compromise a user account with elevated privileges, they may use it to gain broader control or cause further damage. Depending on their motives, they might even delete or corrupt data—including backups.