Here’s the first part of my theory: cybercriminals are not the organized geniuses we implicitly imagine. Anyone building a criminal gang has to find candidates willing to forgo more stable opportunities in the formal economy. My modeling estimated that something like 720,000 people are involved in the online criminal economy, 90% of them in scam and fraud call-center type operations, some of them human-trafficked. Of the 76k or so actual hackers, the vast majority work for governments. Of the remaining few thousand criminal hackers, most work in ransomware. Some demographic estimates of these workforces are below.

Criminal organizations need to base themselves in middle and lower income countries, where they can pay less and hire people who have few formal-economy options. For scams and fraud, picture an illegal call center building in a small city in Nigeria. For ransomware gangs, picture kids working in the informal economy in Belarus. I think folks in the AI safety and cyber world sometimes imagine adversaries as their Waluigi twins, implicit MIT graduates; in fact, in cybercrime we’re dealing with a lower-skill demographic. The chart below estimates attacker wages relative to default economy wages…

Here is more from Joshua Saxe, very good throughoiut.  There are bottlenecks on the down side too…

The post Why are cybersecurity losses not worse? appeared first on Marginal REVOLUTION.

#cybersecurity #losses #worse