J
Jacob Story
Guest
Cybercriminal groups have spent the past several years building something most defenders haven’t: a genuinely collaborative ecosystem.
They share infrastructure, sell each other access, and trade tooling across what used to be separate criminal specialties, so a phishing kit developer, a credential broker, and a fraud operation can all profit from the same compromised account without ever formally working together.
Economic volatility is likely to give that criminal ecosystem even more room to grow. Crime patterns have long shifted with economic conditions, and as the cost and expertise required to participate in online crime continue to fall, periods of instability could produce sharper spikes in phishing, scams, and fraud.
Defenders, meanwhile, have gone the opposite direction. Security organizations have built deeper, narrower specialties, with threat intelligence, fraud prevention, and communications teams each maturing in isolation.
That would be fine if attacks respected those boundaries, but they don't.
A phishing campaign that starts as a threat intelligence signal can become a fraud incident within days and a communications crisis within hours of that, and it's still common for the teams handling each stage to be working from separate playbooks.
A typical campaign against a large bank or retailer, for instance, might start with a fabricated LinkedIn profile impersonating a company executive, used to build rapport with a finance team member over several weeks. That relationship becomes the pretext for a wire transfer request, which is really just financial fraud wearing a social engineering costume.
If the attempt fails, the same infrastructure often pivots to a phishing kit spoofing the company's login page, harvesting credentials from customers or employees who never saw the original impersonation attempt.
Defense against these types of campaigns touch multiple teams: executive protection, fraud prevention, corporate communications, and threat intelligence. And in most organizations, those four teams have never sat down to discuss how they could collaborate to prevent such attacks.
Attackers have already figured this out
Defenders have spent the last several years building deeper, narrower specialties, but attackers have been doing the opposite: pooling resources, sharing infrastructure, and treating cybercrime as a genuinely collaborative enterprise. The World Economic Forum's Centre for Cybersecurity has described this shift plainly, noting that criminal ecosystems now function like professionalized supply chains, with distinct groups specializing in access, tooling, and monetization, then trading with one another to move faster than any single organization can track them.
That professionalization shows up in the numbers the industry has been watching for years: breach counts climbing, the window between vulnerability disclosure and active exploitation shrinking, and the cost of remediation rising well past what most budget cycles anticipate.
None of that is news to anyone who's sat through a board briefing recently. Attackers aren't just getting better tools; they're getting better at working together.
The silos are the vulnerability
It's tempting to frame this purely as an external, industry-level problem. But the same siloing that keeps banks from comparing notes with retailers is quietly happening inside individual companies, between departments that technically work for the same organization but rarely coordinate.
When departments operate in isolation, even a single procedural gap becomes an exploitable seam. Human error remains one of the most persistent drivers of security incidents, and much of that error traces back to teams that don't understand how their day-to-day decisions affect risk elsewhere in the organization.
Each potential gap between teams, such as physical security teams protecting on-site access and cybersecurity teams looking for threats online, is small. But together, they add up to exactly the kind of exposure attackers are counting on.
There's a useful distinction here between sharing threat data and actually collaborating. Organizations have spent years exchanging indicators of compromise with limited context, and that kind of static, disconnected sharing has become less useful as attacker tactics evolve faster than any indicator list can keep pace with. Real collaboration means shared context, shared situational awareness, and teams that treat each other as trusted advisors rather than separate departments filing separate reports.
What cross-functional resilience actually looks like
None of this requires abandoning specialization. Fraud teams should still be fraud experts, and threat intelligence teams should still be the ones parsing malware samples and dark web forums. The shift is in how those specialists connect to one another when an incident starts moving across boundaries, which, increasingly, is the default rather than the exception.
For organizations in banking, retail, telecommunications, and other sectors facing this kind of interconnected threat, a few practical shifts matter more than any single tool purchase:
The bottom line
Better detection tools will always have a place in the security stack, and they're not going away.
But detection alone can't solve a problem that's fundamentally about coordination.
As attackers continue to share infrastructure, tooling, and intelligence across an increasingly professionalized criminal ecosystem, the organizations that fare best won't necessarily be the ones with the most advanced individual tools. They'll be the ones that have broken down the walls between fraud, physical security, communications, and threat intelligence internally, and extended that same collaborative instinct to their industry peers externally.
Cybersecurity must become a cross-functional business discipline, not a departmental one, because that's already how attackers are treating it.
They share infrastructure, sell each other access, and trade tooling across what used to be separate criminal specialties, so a phishing kit developer, a credential broker, and a fraud operation can all profit from the same compromised account without ever formally working together.
Economic volatility is likely to give that criminal ecosystem even more room to grow. Crime patterns have long shifted with economic conditions, and as the cost and expertise required to participate in online crime continue to fall, periods of instability could produce sharper spikes in phishing, scams, and fraud.
Defenders, meanwhile, have gone the opposite direction. Security organizations have built deeper, narrower specialties, with threat intelligence, fraud prevention, and communications teams each maturing in isolation.
That would be fine if attacks respected those boundaries, but they don't.
A phishing campaign that starts as a threat intelligence signal can become a fraud incident within days and a communications crisis within hours of that, and it's still common for the teams handling each stage to be working from separate playbooks.
A typical campaign against a large bank or retailer, for instance, might start with a fabricated LinkedIn profile impersonating a company executive, used to build rapport with a finance team member over several weeks. That relationship becomes the pretext for a wire transfer request, which is really just financial fraud wearing a social engineering costume.
If the attempt fails, the same infrastructure often pivots to a phishing kit spoofing the company's login page, harvesting credentials from customers or employees who never saw the original impersonation attempt.
Defense against these types of campaigns touch multiple teams: executive protection, fraud prevention, corporate communications, and threat intelligence. And in most organizations, those four teams have never sat down to discuss how they could collaborate to prevent such attacks.
Attackers have already figured this out
Defenders have spent the last several years building deeper, narrower specialties, but attackers have been doing the opposite: pooling resources, sharing infrastructure, and treating cybercrime as a genuinely collaborative enterprise. The World Economic Forum's Centre for Cybersecurity has described this shift plainly, noting that criminal ecosystems now function like professionalized supply chains, with distinct groups specializing in access, tooling, and monetization, then trading with one another to move faster than any single organization can track them.
That professionalization shows up in the numbers the industry has been watching for years: breach counts climbing, the window between vulnerability disclosure and active exploitation shrinking, and the cost of remediation rising well past what most budget cycles anticipate.
None of that is news to anyone who's sat through a board briefing recently. Attackers aren't just getting better tools; they're getting better at working together.
The silos are the vulnerability
It's tempting to frame this purely as an external, industry-level problem. But the same siloing that keeps banks from comparing notes with retailers is quietly happening inside individual companies, between departments that technically work for the same organization but rarely coordinate.
When departments operate in isolation, even a single procedural gap becomes an exploitable seam. Human error remains one of the most persistent drivers of security incidents, and much of that error traces back to teams that don't understand how their day-to-day decisions affect risk elsewhere in the organization.
Each potential gap between teams, such as physical security teams protecting on-site access and cybersecurity teams looking for threats online, is small. But together, they add up to exactly the kind of exposure attackers are counting on.
There's a useful distinction here between sharing threat data and actually collaborating. Organizations have spent years exchanging indicators of compromise with limited context, and that kind of static, disconnected sharing has become less useful as attacker tactics evolve faster than any indicator list can keep pace with. Real collaboration means shared context, shared situational awareness, and teams that treat each other as trusted advisors rather than separate departments filing separate reports.
What cross-functional resilience actually looks like
None of this requires abandoning specialization. Fraud teams should still be fraud experts, and threat intelligence teams should still be the ones parsing malware samples and dark web forums. The shift is in how those specialists connect to one another when an incident starts moving across boundaries, which, increasingly, is the default rather than the exception.
For organizations in banking, retail, telecommunications, and other sectors facing this kind of interconnected threat, a few practical shifts matter more than any single tool purchase:
Build the internal bridges first. Before an organization can meaningfully collaborate externally, it needs communications, fraud, physical security, and threat intelligence functions that talk to each other regularly, not just during a breach postmortem. Regular cross-functional briefings on active threats go a long way toward closing the gaps that attackers exploit.
Treat industry peers as allies, not competitors. Banks sharing intelligence with other banks, telecoms comparing notes with other telecoms, and retailers pooling insight on branded scam campaigns all reflect a basic reality: The attacker groups targeting one company in a sector are very often the same ones targeting its competitors. Information Sharing and Analysis Centers exist precisely to formalize this kind of peer collaboration, and the organizations getting the most value from them are the ones contributing.
Invest in visibility that spans the full attack lifecycle. A brand impersonation attempt, fraudulent transaction, or a phishing kit are often chapters in the same story rather than three unrelated incidents. Digital risk protection and threat intelligence capabilities that connect these dots earlier give every downstream team, from fraud to comms to legal, a head start on response.
Support public-private partnerships where they exist. A number of cross-industry and cross-border initiatives now exist specifically to pool threat intelligence and coordinate takedowns at a scale no single company can match on its own. Participating in these efforts, even in a limited capacity, extends an organization's visibility well beyond what its own security stack can see, and contributes to a body of shared intelligence that benefits every participant, not just the ones with the biggest budgets.
The bottom line
Better detection tools will always have a place in the security stack, and they're not going away.
But detection alone can't solve a problem that's fundamentally about coordination.
As attackers continue to share infrastructure, tooling, and intelligence across an increasingly professionalized criminal ecosystem, the organizations that fare best won't necessarily be the ones with the most advanced individual tools. They'll be the ones that have broken down the walls between fraud, physical security, communications, and threat intelligence internally, and extended that same collaborative instinct to their industry peers externally.
Cybersecurity must become a cross-functional business discipline, not a departmental one, because that's already how attackers are treating it.