How silent reconnaissance works before the attack begins
Someone searched for your company’s name on Google this morning. It wasn’t a potential customer.
There’s a difference you can’t see between one search and another. Two people open a browser, type your company’s name, look at the results. One is deciding whether to become your customer. The other is building a map.
The map isn’t for buying. It’s for getting in.
Why you
A targeted attack doesn’t start with a technical vulnerability. It starts with an economic assessment.
Someone has decided your company is worth the effort. It isn’t a random choice: it’s a rational decision, based on precise criteria.
You hold data someone wants: customers, patents, contracts, ongoing projects. You supply someone bigger, and you’re the easiest path to them: large companies have strong defenses, their suppliers often don’t. You’re in a sector where ransoms get paid: manufacturing, healthcare, legal, finance. Or someone who worked with you, or for you, knows something about your infrastructure and has decided to sell it.
In every one of these cases, your name has ended up on a list. And before anything technical happens, someone has opened a browser.
Reconnaissance that leaves no trace
In an automated attack, the kind that hits thousands of companies a week without distinction, the reconnaissance phase takes seconds. In a targeted attack it can take weeks. And it’s carried out almost entirely from public, legal, unremarkable sources. It leaves no trace. It isn’t even illegal.
LinkedIn is the first stop. From your company’s profile and your employees’ profiles, a few minutes are enough to work out who works in IT and who doesn’t, who has access to critical systems, who has just joined and probably doesn’t know the procedures well yet, who recently left the company and might be resentful. Every connection, every post, every like on a technical article is a piece of the puzzle.
Job postings are the second. “Wanted: systems administrator with experience in Fortinet and VMware, Active Directory management, familiarity with Windows Server 2019 environments.” You’ve just described your technology stack to anyone who’s looking. Not to candidates: to whoever is building the map.
Your website, press releases, trade fairs. The suppliers you thank publicly. The customers you cite as references. The awards you’ve won. Every detail is a piece of the puzzle. Put together, they build a picture that no single element would suggest.
Then there are the less clean channels: a disgruntled former employee, or one still at the company but in conflict with it, can be approached with nothing more than a WhatsApp message and persuaded to sell information or credentials. This is where legality ends, but it happens more often than you’d think.
By the time whoever is building the map has finished, they know more about your infrastructure than your IT manager would imagine. They know what your systems are called. They know who has access to what. They know the right moment to strike and which door is easiest to open.
The decision you never see
There’s a point where whoever is preparing the attack stops and takes stock.
Do I have enough information? Does the value of the target justify the risk and the time? Are there realistic ways in?
It’s a rational decision, almost an entrepreneurial one. If the answer is no, they move on: there are other companies on the list. If the answer is yes, what comes next is tailor-made for you: the phishing imitates one of your real suppliers, the message reaches the right person at the most vulnerable moment, the credentials used belong to someone who really works at your company.
The difference from the automated attack isn’t the technique. It’s the intent, and the precision with which every stage is calibrated to what was found in the silent phase.
The clues almost nobody reads
A targeted attack, before it becomes visible, leaves traces. Faint clues, scattered, that look harmless one by one.
Login attempts at unusual hours on real accounts. Requests for information by email that seem legitimate but have something slightly off: a domain nearly identical to yours, a signature that doesn’t quite add up. Someone phoning the office to confirm technical details “to update our systems.”
The problem is that reading them together takes someone looking at the whole picture, not at individual events. And in most SMBs there’s nobody covering that level. Not through incompetence, but because it’s structurally impossible. Whoever runs IT runs everything else too, and these clues get lost in the noise.
What you can’t hide, and what you can do
There’s one thing you can’t remove from the public surface of a working company: it has to be findable, it has to communicate, it has to hire, it has to have suppliers and customers. Visibility is necessary to do business.
But there’s a difference between being visible and making every detail of your infrastructure readable to anyone who knows where to look. Job postings can describe skills without listing the technology stack. Published documents can be scrubbed of metadata before they’re uploaded. Employees can be told what not to share on professional social networks.
It’s not about disappearing. It’s about reducing the information density available to whoever is building the map.
And it’s about accepting that part of the surface will stay visible anyway, and that the question is therefore not only “how do my perimeter defenses protect me?” but “what happens when someone, despite everything, is already inside?”