Stop Playing Goalie: Why Leaders Must Rethink Offence in Cybersecurity

A contrarian view on cyber defence in an age of escalating AI — by Wesley Paterson, CMC

I’ll start with a confession. Every time I sit with a leadership team to talk about cybersecurity, I notice the same posture. Shoulders up, back to the wall, waiting for the next punch. We buy more firewalls, run more phishing simulations, add another layer of multifactor authentication, and hope that this year the wall holds.

It is a goalie’s mindset. And in a world of rapidly escalating AI, I am not convinced the goalie wins.

Bruce Lee understood something most boardrooms have forgotten: action beats reaction. The fighter who only blocks eventually gets hit. The fighter who controls distance, timing and tempo decides how the fight goes.

So let me ask the question many security leaders are thinking but rarely say out loud in a board meeting: what if our cybersecurity was built to be offensive by design?

The Math No Longer Works

Here is the uncomfortable reality. Attackers have an AI-powered advantage, and they are using it.

KnowBe4’s latest research found that overall phishing volume grew 29.8% year over year, while spear phishing rose 41.1%, and attackers are now 5.4 times faster at turning breaking news into live phishing lures than they were in 2022. Earlier in 2026, the same firm reported that 86% of the phishing attacks it analyzed were AI-driven. Akamai found that the lifespan of a phishing attack fell from 48 days to 22 days in just two quarters, as attackers rotate infrastructure faster than blocklists can keep up.

And on the voice side, Mandiant reports that voice phishing is now the second most common way into an organization, and attackers have moved from first contact to full domain administrator access in about 40 minutes.

Forty minutes. That is shorter than most of our Monday management meetings.

Traditional defence rests on an old, lopsided equation: the defender has to be right every time, and the attacker only has to be right once. When AI makes each attempt nearly free, that equation becomes a losing proposition. You cannot out-block an opponent who can throw a million punches for the price of one.

Flip the Economics

Here is where I want to be contrarian. The goal of cybersecurity should not be only to stop attacks. It should be to make attacking you a terrible business decision.

Cybercrime is a business. It has revenue targets, cost structures, toolkits sold as a service, and managers checking productivity. Every business has a weak point, and for criminal enterprises it is time. Time is their inventory. When you waste it, you are attacking their margins.

MITRE, one of the most respected names in security, puts it brilliantly. Its Engage framework turns the old equation around: with traditional cyber defence the adversary only needs to be right once, but with adversary engagement the adversary only needs to be wrong once. The aim is to drive up the cost and drive down the value of an adversary’s operations.

That is an offensive mindset, and it is already working in the real world.

Meet Daisy, the Grandmother Who Fights Back

My favourite example comes from the UK. Telecom provider Virgin Media O2 built Daisy, an AI “granny” whose only job is to talk to scammers and waste as much of their time as possible to keep them away from real people. She tells long stories about her grandchildren, talks about knitting, and hands over fake bank details.

The results are delightful. Daisy has wasted the time of more than 1,000 scammers on calls lasting up to 50 minutes. O2 seeded her number onto the criminals’ own target lists, so the scammers came to her. One frustrated fraudster can be heard yelling, “It’s nearly been an hour!”

Think about that from a strategy perspective. Every minute a scammer spends with Daisy is a minute they are not spending with your mother, your employee in accounts payable, or your client. AI is not only the attacker’s weapon. It can be the defender’s tireless sparring partner, with, as Daisy says, “all the time in the world.”

Now picture that inside a company. AI agents that answer phishing emails with endless, plausible, useless replies. Fake credentials that lead nowhere except to an alarm. Decoy servers full of convincing but worthless data. Every hour a hacker spends there is an hour of their payroll, compute and patience burned for nothing, while your team watches and learns.

And Yes, the Glitter Bomb

You may have seen Mark Rober’s glitter bomb. The former NASA engineer built a package that sprays glitter and fart spray on porch thieves. Then he went further. Working with scam fighter Jim Browning, he used bait packages to track money mules and their supervisors working with scam call centres, and later his team released glitter, stink bombs, cockroaches and rats inside call centres in Kolkata.

Here is what most people miss about that story. The glitter got the views. The evidence got the results. After the videos, Kolkata police raided call centres, and one of the named companies was closed and 15 of its senior officials were arrested.

That is the real lesson for leaders. Offence wins when it gathers intelligence and puts it into the hands of people with the authority to act.

Where I Draw the Line

Now let me be the consultant in the room who protects you from your own enthusiasm.

“Hack the hackers” sounds heroic. For a private company in Canada, it is a crime. Under section 342.1 of the Criminal Code, anyone who obtains computer services or intercepts a computer system’s functions without authorization faces up to 10 years in prison. The law does not give you an exception because the other side started it.

Notably, some of the Kolkata operation involved gaining access to the call centres’ CCTV feeds and computers. It made great television. It is not a playbook I would hand to any board I advise.

There are three practical reasons beyond the law:

• Attribution is hard. The machine attacking you is often a hijacked computer in a hospital, a school or a small business. Hit back, and you may be hurting another victim.
• Escalation is real. You may poke an organized crime group or a state-backed team with far more resources and far less restraint than you.
• Liability lands on you. Your insurer, your regulator and your clients will not care how clever your retaliation was.

Even MITRE, the champion of adversary engagement, is clear: engage with the adversary, but avoid a hack-back.

Here in Canada, true offensive cyber operations already exist, with the right authority behind them. The Communications Security Establishment can conduct active cyber operations to disrupt foreign cyber criminals, hostile intelligence agencies and state-sponsored hackers, but only with ministerial authorization, the Foreign Affairs Minister’s consent, and independent review. That is the model: offence with rules of engagement, accountability and oversight.

Lawful Offence: The Model I Recommend

So what does a smart offensive posture look like for a company that is not a spy agency? I call it lawful offence. It has five moves.

1. Deceive. Plant decoy accounts, fake documents and honeypot systems inside your own environment. Anyone who touches them reveals themselves instantly. You own the ground, so you set the traps.
2. Delay. Deploy AI agents that engage phishers and scammers in long, pointless conversations. Make every attack slow, expensive and exhausting. Waste their time on purpose.
3. Detect and learn. Watch what attackers do inside your decoys. Their tools, timing and tactics become your intelligence, and your defences get sharper every time they try.
4. Dismantle through partners. Share intelligence with law enforcement, the Canadian Centre for Cyber Security, and your industry peers. Microsoft’s Digital Crimes Unit shows what this can achieve: through a court order and coordinated action with the US Department of Justice, Europol and private partners, it helped seize about 2,300 malicious domains behind the Lumma Stealer malware. That is offence with a warrant.
5. Discipline. Write rules of engagement before you need them. Decide in advance what your team may do, who approves it, and where the line is. Get legal counsel in the room early.

None of this requires breaking into anyone’s computer. All of it makes you a harder, costlier and far less attractive target.

The Leadership Question

In The Hero’s Rope, I write about the moment a leader decides to stop reacting to circumstances and starts shaping them. Cybersecurity is facing that moment now.

For years we have treated security as an IT cost centre, a wall to maintain and a compliance box to tick. That thinking was built for a slower world. AI has changed the tempo. Leaders who wait in a defensive crouch will spend more, worry more, and still get hit.

The leaders who win will do three things differently. They will treat attacker time as a target. They will use AI as a tireless defender, not only fear it as a weapon. And they will build offence on a foundation of law, ethics and partnership, because an offence without discipline is just another way to get hurt.

Bruce Lee was right. Action beats reaction. But the master is not the one who throws the most punches. The master is the one who controls the fight.

So here is my challenge to every CEO and board chair reading this: at your next meeting, do not ask, “How do we stop the next attack?” Ask, “How do we make attacking us the worst investment a criminal ever made?”

That one question will change your strategy.

---

About the Author

Wesley Paterson, CMC, is President of Paterson Consulting Inc., a senior management consultant, corporate trainer and speaker, and author of The Hero’s Rope. He helps leaders turn disruption, including AI-enabled transformation, into practical strategy and lasting advantage.

This article is intended as leadership commentary and does not constitute legal advice. Organizations should consult qualified legal and cybersecurity professionals before implementing any adversary engagement program.

References

1. KnowBe4 Phishing Threat Trends Report Vol. 8 (via Las Vegas Sun / Business Wire), October 29, 2026. https://lasvegassun.com/news/2026/oct/29/knowbe4-report-reveals-cybercriminals-abandoning-s/
2. KnowBe4, “KnowBe4 Research Finds 86% of Phishing Attacks are AI Driven,” April 30, 2026. https://www.knowbe4.com/press/knowbe4-research-finds-86-of-phishing-attacks-are-ai-driven
3. Akamai, “AI-Driven Digital Deception Is Escalating Enterprise Fraud and Shrinking Phishing Lifespans,” October 29, 2026. https://www.akamai.com/newsroom/press-release/akamai-report-ai-driven-digital-deception-is-escalating-enterprise-fraud-and-shrinking-phishing-lifespans
4. JD Supra, “AI & Emerging Cyber Risk: The Oldest Trick in the Book Just Got an Upgrade” (citing Mandiant M-Trends 2026). https://www.jdsupra.com/legalnews/ai-emerging-cyber-risk-the-oldest-trick-9408536/
5. MITRE, “MITRE Engage: A Framework and Community for Cyber Deception.” https://www.mitre.org/news-insights/impact-story/mitre-engage-framework-and-community-cyber-deception
6. MITRE Engage Handbook. https://engage.mitre.org/wp-content/uploads/2022/02/EngageHandbook.pdf
7. Virgin Media O2, “O2’s AI granny Daisy unveils what she’s learnt.” https://news.virginmediao2.co.uk/o2s-ai-granny-daisy-unveils-what-shes-learnt-from-her-time-on-the-phone-to-scammers-and-what-you-can-do-to-ruin-their-day/
8. Marketing Week, “How O2’s AI granny stopped 1,000 scammers targeting the public.” https://www.marketingweek.com/o2-ai-granny-scammers-public/
9. CBS News, “AI grandma fights back against scammers.” https://www.cbsnews.com/news/ai-grandma-daisy-uk-anti-fraud-scammers-virgin-media-o2/
10. CNN, “How an AI granny is combating phone scams,” November 26, 2024. https://edition.cnn.com/2024/11/26/business/daisy-ai-granny-scammers-o2-intl
11. Wikipedia, “Mark Rober.” https://en.wikipedia.org/wiki/Mark_Rober
12. AARP, “Former NASA Engineer Shares How He Gets Even With Scammers.” https://www.aarp.org/money/scams-fraud/mark-rober-glitterbomb/
13. Times of India, “How four international YouTube sleuths teamed up to expose call centre scams in Kolkata.” https://timesofindia.indiatimes.com/home/sunday-times/how-four-international-youtube-sleuths-teamed-up-to-expose-call-centre-scams-in-kolkata/articleshow/91859500.cms
14. Justice Canada, Criminal Code, s. 342.1 (Unauthorized use of computer). https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.html
15. Communications Security Establishment, “Cyber operations.” https://www.cse-cst.gc.ca/en/mission/cyber-operations
16. Microsoft On the Issues, “Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool,” May 21, 2025. https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/