Every device connected to the internet is a target. Here's how the most common attacks actually work, the defences that stop them, and the everyday habits that matter more than any single piece of software.
The internet article in this series explained how devices exchange data across networks, and the AI agents article covered what happens when software can take real action on its own. Both of those capabilities are exactly what make security matter: any system that can send data, receive data, or act on instructions can potentially be tricked or exploited into doing something harmful. This guide covers the most common threats, the defences built to counter them, and the habits that stop the majority of everyday attacks before any technical defence is even needed.
There's no single technique behind a security breach — it's a broad category covering many different methods that all share one goal: getting a system to do something its owner didn't authorise, whether that's revealing data, granting access, or running unwanted code. Understanding the handful of most common categories makes the everyday advice around passwords, links, and updates far more obviously useful rather than arbitrary rules to follow.
Malware is any software designed to damage, disrupt, or gain unauthorised access to a system. It comes in several common forms:
| Type | What It Does |
|---|---|
| Virus | Attaches itself to a legitimate file and spreads when that file is shared or run |
| Worm | Spreads on its own across a network, without needing a file to attach to |
| Trojan | Disguises itself as legitimate software to trick someone into installing it |
| Ransomware | Encrypts a victim's files and demands payment for the key to unlock them |
| Spyware | Quietly monitors activity and sends the collected data back to an attacker |
Many breaches don't rely on breaking software at all — they rely on tricking a person. Phishing is a message, often an email or text, disguised as coming from a trusted source, designed to get the target to click a malicious link, download malware, or hand over credentials directly on a fake login page.
Phishing works by exploiting urgency and trust rather than a technical flaw — a message claiming an account will be locked "in 24 hours unless you verify now" is designed to make someone act before they stop to check whether the link is genuine.
Spear phishing narrows this further, targeting a specific person using details gathered about them in advance to make the message far more convincing than a generic mass attempt.
A weak or reused password is one of the most common ways an attacker gains access, and the risk isn't limited to guessing. When one website's stored passwords are stolen in a breach, attackers immediately try that same email-and-password combination on other popular sites — a technique called credential stuffing — which is why reusing a password anywhere means a breach anywhere becomes a breach everywhere that password was used.
A password manager generating and storing a unique, long password for every site removes the need to remember dozens of passwords while eliminating the reuse risk entirely.
Multi-factor authentication (MFA) requires a second form of proof beyond a password before granting access — typically something the account holder has, like a code generated by an authenticator app, rather than only something they know. Even if a password is stolen, an attacker without that second factor still can't get in, which is why MFA is one of the single most effective defences against account takeover.
Banks and hospitals are frequent ransomware targets precisely because the cost of downtime is so high, making victims more likely to pay — which is part of why these sectors are often required by regulation to maintain tested backup and recovery plans separate from their main systems.
Encryption scrambles data using a mathematical key so that anyone without that key sees only meaningless noise. A padlock icon in a browser's address bar indicates the connection to that website is encrypted, meaning data sent between the browser and the site can't be read by anyone intercepting it along the way — a baseline protection every legitimate site handling personal information should have.
Most successful attacks don't rely on a sophisticated technical exploit — they rely on a reused password, an unpatched update, or one rushed click on a convincing link. The technical defences covered here matter, but the everyday habits matter just as much, because they close the gaps that most attacks are actually built to exploit in the first place.
10 questions. Select an answer for each, then submit to see your score instantly.