Attackers and users find themselves in a unique position online. System architecture has fundamentally embedded humans at the heart of it. This piece overviews how the human node faces specific challenges that attackers exploit, according to their desired goal and situation. Much like in game theory, both the attacker and the victim have an optimal move given their situation. This piece doesn't attempt to solve that game. It lays out a starting framework for thinking about it. While in practice strategies are used in combination, they are separated here for the sake of the analysis.

There's an innate relationship between the user and the machine that's rooted in its inception. We have to navigate the computer, so we require permissions and abilities to do so. But users can make mistakes, experiment, and break systems. This issue is what I call "The Operator Privilege." It's why we created system administration, so users could be users without the administrative privileges that have the ability to decimate their machine. But that distinction is the furthest we've gone to solve the operator privilege problem. Even as a user, the human still has the ability to receive an email from an impersonating, unverified third party and expose sensitive information. Digital items can be stolen.

An important caveat is that hackers rarely hack their target machines directly. They might start with a computer that belongs to an intern. Instead of forcing their way through resilient cybersecurity, attackers use the human node as a guided shortcut. This is simply because the human node is prone to errors and bias as we interpret our situations.

• Digital Dependence: sensitive data, info, or code existing online

• Contact Availability: the ability to be reached by anyone

• Operational Flaw: the ability to perform actions that can affect systems, data, or access

These issues show ways the operator privilege can be and has been exploited. People store digital items on servers. They can be called or emailed at any moment. And they can be instructed to produce desired behavioral outputs. So the attacker leverages these specific weak points.

First, it's important to note that in practice these strategies are hybrid rather than standalone. The game theoretic nature of these strategies lies in their subtle differences, their strengths in specific contexts, and how they are tailored to the attacker's goals and scenario. First I will overview the strategies, and then their game theoretic application.

All three are forms of influence. Persuasion and manipulation both rely on deception. What separates them is how much of the situation the attacker fabricates and how much pressure they apply. Coercion is different because it operates in the open.

Deceiving a target through a plausible pretext that fits their normal routine, with minimal fabricated context and no pressure, so the target decides at their own pace.

Openly using leverage the attacker already holds, threatening the target with consequences for noncompliance.

Deceiving a target by fabricating the circumstances around their decision, such as a threat, an emergency, or an authority figure, and applying pressure so the target acts before they can properly evaluate.

The following cases show how each tactic fit its respective scenario:

• The 2011 RSA SecurID breach exemplifies Persuasion. It began with attackers sending targeted spear phishing emails to low-level employees. The email was titled "2011 Recruitment Plan" with an Excel spreadsheet attached. Embedded in the spreadsheet was an exploit for a previously unknown Flash vulnerability. By exploiting our habit of routinely checking corporate HR updates, an employee opened the file, which installed a backdoor. From there, the attackers mapped and moved through the network undetected until reaching their target: sensitive information tied to RSA's SecurID two-factor tokens.

• Cyberleek exemplifies Coercion. In August 2026, Cyberleek began publishing footage from what appears to be a working build of Rockstar's biggest game to date, Grand Theft Auto 6. How they obtained it is still unknown. They posted the clips publicly, some watermarked with messages directed at Rockstar protesting its decision not to release GTA 6 on physical disc. They also published a manifesto of demands, including an end to digital preorders, an end to paid unlocks for content already in the game files, and offline fallbacks for single-player games. Cyberleek threatened to keep leaking, including story spoilers, unless Rockstar apologized and committed to change. The attack happened in two phases: the breach was how Cyberleek acquired leverage, and the coercion that followed targeted the people at Rockstar who make its decisions. As of this writing, Rockstar has not met the demands, and Take-Two has instead pursued the leaker's identity through the courts.

• Malone Lam and co-conspirators exemplify Manipulation. In August 2024 they pulled off one of the largest single-victim thefts on record without writing any malware. Posing as support staff for Gemini, the exchange connected to the victim's digital assets, they called the victim and told him his account was under threat and that they had been assigned to secure it because he was a premium client. The victim held about 4,100 Bitcoin, worth roughly $243M at the time. They instructed him to install AnyDesk, a remote desktop program that lets someone view and control another device over the internet. Once connected, they got the victim to reveal his private keys on screen, which was all they needed to transfer his Bitcoin into their own wallets.

Persuasion. In the SecurID case, the social engineering was only the beginning. The attackers leveraged the human node to gain further access toward their real target, and the backdoor let them move through the network undetected. Therefore, persuasion is best when:

• Stealth matters

• The attacker has no leverage

• The pretext fits the victim's routine, with little fabricated context and no pressure

Coercion. Cyberleek was forthcoming about their demands. They also already had leverage, the leaked build, to keep threatening Rockstar. So coercion is best when:

• There's no need to stay unnoticed

• The attacker already has leverage

• The immediate goal is typically the final target

Manipulation. Malone Lam created a fake scenario to induce specific emotions, making the victim's behavior easier to steer and predict. The crime also had a massive payoff, so achieving the desired behavior carried higher stakes. Manipulation is best when:

• The variables influencing the victim's decision can be fabricated

• The attacker is willing to apply extreme pressure

• Emotions can be weaponized to steer behavioral outputs

The takeaway I want to emphasize is that each strategy excels in its own environment. The SecurID attackers found persuasion attractive because they had no meaningful leverage over the victim, so coercion was practically unavailable. They could have manipulated in principle, but applying pressure would have sacrificed stealth. The same logic applies to the other examples. Cyberleek posted publicly without concern for being noticed and didn't begin the social engineering until after obtaining the build. Malone had one high-stakes chance to succeed, so he did whatever he could to pressure the victim. The strategy an attacker chooses depends on their environment.

Online, you should always exercise constant caution. This sentiment was much more common in the 2000s and early 2010s. But as the internet matured and screen time took over people's lives, we've become comfortable. People answer numbers they don't know and assume every email or text is legitimate. Companies store sensitive code on servers connected to the internet. But there are ways to fight back.

Every one of these attacks works by placing a carrot in front of the victim to steer them: a routine HR file, an urgent security alert, a chance to protect your account. The instinct is to chase it. The best defense is to stay skeptical of whatever you're being pulled toward.

It's very common for people to take the easy option: skip MFA, skip the password change, skip the security alert, skip that extra step. Attackers love that. As simple as it sounds, people taking that initiative, and developers making it easier and more intuitive to do, is how cybersecurity improves.

Another common mistake is not checking who's contacting you. If a company claims to be contacting you, find its official support contact and verify. If they truly are trying to reach you, that effort would be coordinated, and employees can confirm whether it was them. In Malone Lam's case, one call to Gemini's real support line would have ended a $243M theft. It's not just about being skeptical. It's about using that judgment to control your behavior and actively prevent attacks on yourself and others.

Ultimately, The Operator Privilege is why the human node is the most vulnerable attack surface in the entire architecture. Because the human node is so foundationally embedded, it faces unique risks. Unlike code, which executes deterministically, humans interpret information, make choices, and evaluate circumstances. Attackers choose specific strategies based on their environment. But ordinary users can also play the game and defend. Mapping and isolating these strategies can help security teams better understand, predict, and defend against attackers. This paper wasn't meant to solve the game theory of social engineering as we know it. It was meant to estbliash primitive concepts, the ideas, frameworks, that we can establish and iterate to maybe one day solve it.