There has been an obvious stagnation and hesitation for people to participate in DeFi, or go all in with their finances, myself included. Most professionals in the space wouldn't even say they're entirely financially involved in it, the market is still so new and rapidly developing. But a lot of that stems from the fact that people simply view decentralized finance as a cybersecurity Wild West for their finances, and that banks are simply superior. Whether it's refuting transactions, customer support, branding, familiarity, government regulation, there's plenty of attraction for the average person to settle with a bank. Humans are also stubborn, so they don't change unless the inclination is of their will. This is evident with the internet, those who adopted outperformed while those who didn't stagnated. This inclined the will of others to adopt similar behavior, and this example is applicable to decentralized finance, as it hasn't really had that same transition moment yet. This is "the custody comfort," the idea decentralized finance requires major research and development in the psychological perception of cybersecurity to incline the will of peoples behavior, and generally allow them to understand the trustless system.

Friction in Anxiety

There's multiple specific causes for the actual friction in regular people transitioning from traditional finance to decentralized finance that are all rooted in overcoming anxiety to build trust. The anxiety boils down to these two fundamental sources: not understanding trustless blockchain technological systems, and the responsibility of sovereignty. People are naturally anxious about the unknown, and this is rudimentary evolutionary psychology. That's why it's so easy to stay comfortable with banks, we know they have government regulation, some of us understand their business model, but people are generally familiar with the banking industry. Decentralized finance must create such familiarity, and continue educational efforts of blockchain technology the way education towards traditional financial systems are made. The second point is people don't like responsibility. They almost unconsciously choose the path of least resistance, and we see this consumer behavior in so much product development and marketing research. When an individual exits the confines of the traditional financial system, they're quickly faced with irreversible transactions, private keys, phishing, wallet drainers, and generally the responsibility shifts completely on you. If something goes wrong at the bank, the individual has someone else to blame. In decentralized finance, there is no one to blame but yourself. These two points are major causes of anxiety, and the subsequent friction in mass adoption.

Of course, there are other major user experience issues not outlined in those two points once users are actually participating in the market, such as The Bloating Issue. Those two points are meant to highlight causes in anxiety and how that perception influences their decision to participate in the market at all.

The Future?

There's been much debate recently about the direction of decentralized finance. Will it ever truly mature into an internet native self sovereign financial market? Or will it become the "Linux of finance" as I've heard it described by many, a technology only appreciated by its enthusiast while the general public dismisses it. Engineers build things that only other fellow engineers utilize, sidelining everyone else. Personally, I think demand for internet money will only evolve with the internet, but people will also want to distance themselves from the traditional financial system for reasons spanning philosophy, historical track record, or whatever it may be. Decentralized finance is a growing alternative to the current financial system to take control over your finances, and the market will continue to evolve through research and development of tokenization, user experience, and beyond to invite fresh capital and attract new users.

The human mind is an information vacuum that imitates its environment. We see this in our ability to speak language, as humans have brain regions dedicated to learning languages. Or social ques, norms, and general culture, these are other examples of learned mimicry. Humans are constantly consuming information, and we tend to mimic a large portion of that information. Of course, we imitate selectively, we aren't mindlessly copying animals behaving mindlessly. We typically imitate based on what has perceived utility, social acceptance, or positive associations with specific behaviors. This extends to things we cognitively consume like informative media, which exists in our environments. Following suite on this logic, we can infer that media consumption alters the individual which is consuming it.

The Loop

There's a feedback loop between the individual mimicking the environment, and the environment itself. The individual consumes information which they then mimic. The individuals mimicking behavior now in turn influences the environment. Since the initial environment has changed from the person and the person has remained the same, the person consumes new information which they can newly mimic, and newly changing the environment, and so on. This is the loop in which the environment giving information we consume changes us, and we change the environment. An easy way to conceptualize this is why we may struggle to feel gratitude. We tend to want things, and this wanting is rooted in our dopaminergic pathways. We have things, yet we struggle to naturally be grateful, we have to mindfully practice it to be happy with what we have. This evolutionary neuro-adaptability is a foundational component to our neurochemical architectures, because if the individual remained complacent, they may lose the edge that allowed them to gain the items they get to neglect their appreciation for. This exact loop mechanism of mimicking and editing the environment happens within digital environments, like social media algorithms.

Social Networks

Initially, social media was created so we could establish digital social networks, with each individual being a node in this network. As it has evolved, we've seen the creation of new and endless amounts of media injected into these social networking platforms. This constant inflow and increase of volume in digital activity has generated copious amounts of media, and in turn influenced how we navigate these digital environments. This alteration in which we navigate digital environments, is tolerating and accepting screen time. Society has slowly grown more tolerant overtime of screen usage, and even people who have never used screens before now use screens more and more. This slow societal tolerance and increased time usage is a direct exemplification of the feedback loop between us and our environment. As people began using mobile smartphones more frequently, others mimicked that to buy their own. As everyone got their own phones, the environment is now changing based on changing individuals mimicking that environment. This same cycle happens in other facets as well, including everyone joining and participating on social medias. People join these social networks, and directly message media to peers. People can mass distribute media to thousands like never before. As these social network apps gained more users, gained more content, gained more attention, it creates a compounding snowball effect, all working through the feedback loop frameworks previously established. As media became more abundant online, there was a user optimization and attention allocation problem. Someone may be seeing content they have no interest in, and that may discourage them to spend their time online. So, humans reactionarily created the algorithm as an attempt to optimize user experience against increasingly abundant media, to allocate their attention meaningfully.

Algorithmic Injection

The algorithm was most popularized by TikTok, put most simply by quantifying as much information relating to how much attention the media could capture your attention. Nearly every major social media company has followed suite in algorithms. Recent AI initiatives have only fueled its efficiency. We developed the algorithm as a response to increased time online, to fuel that time online to present the most optimized result, ensuring top quality personalization and entertainment value. The feedback loops outlined before didn't end, they persist in digital environments through the media we consume. They most subtly influence us in ways we can't even tell. But these small changes add up and compound. "You are what you consume" is a famous saying, for its practical legitimacy and contemporary relevancy. People who eat bad food, listen to sad music, etc. will likely feel worse emotionally, and we could assume the opposite for someone consuming positively. The polarity is meant to serve as a comprehensional aid, so setting that aside, it still exemplifies how what you consume influences you; you aren't some awareness independent and invisible to stimuli in reality. What you consume influences you. And this effect extends out to these digital environments. Jack Dorsey has talked about it as well. He has spoken about how our biological systems are hijacked, to which our free will is being interfered with when we start being subconsciously reprogrammed. His main point is that algorithms don't show us our genuine interests, they show us a corporate optimized black box that only seeks its own growth of information volume. And these will continue to hijack and rewire our regular, non-interfered minds.

Personal Interpretation

I think algorithms are good for some people, and can be bad for others, though I don't think the algorithm itself is inherently bad. I want to start with the main benefit, that the algorithm and social media networks in general have democratized the ability to create media, share ideas, and be seen. Prior, centralized institutions like radio networks, TV cables, etc. all could gatekeep distribution since they practically monopolized them. We can also assume consumers simply favored the algorithm. Whether that was the convivence of the apps being on the phones, or simply the utility being so efficient society quietly jumped ship to alternatives, this technology wasn't forced it was chosen. I think the early days of algorithms we're in today are probably like the early days of smoking. We don't understand the full effects, and we use them almost unapologetically. Yet, we've never had more social isolation, more political extremism, more bait media, etc. These symptoms are all arguments in favor of the idea algorithms don't show us our genuine interests, they border on the unethical to manipulate us, even if that's by using negative emotions, to stay online. Algorithms are programming our minds, so all we can do is try to limit the time we spend as consumers inside of it, and try to spend more time injecting our own media into it. Because it begs the question between consumers and creators, will you participate in the environment shaping our minds, or do you sit back and let others do that for you?

HackTheBox functions as a training lab, or otherwise a "hacker gym" where people can put their skills to the test, and enhance them through learning. As someone interested in offensive cybersecurity, especially in regards to human exploitation, I imagined, "why is there no 'gym' for social engineering?" Some obvious issues came to mind: how could someone be ethically manipulated? How can someone participate without knowing an attackers intentions? But, I knew there could be a way. I knew because events like DEFCON host Capture The Flags, and the Social Engineering village hosts their own CTF. Lastly, I had seen some video game called Vaudeville, which you basically play as a police officer trying to make an AI admit they committed a crime by dissecting their alibi. After realizing that humans couldn't actually be put to use, but an AI could functionally imitate them, the idea for Pond was made.

Pond

The idea is simple: pick your mode, achieve your goal. Based on the different modes, the user has different deliverables. The options that users can choose between with are 1. Mass Phishing 2. Spear Phishing, and 3. Vishing. After you select your mode, the user chooses their difficulty. The difficulty chooses what data is visible, such as suspicion meter, starting suspicion levels, timers, but also information regarding deliverables like target scores, target victim, etc., and are all difficulty dynamic. The goals and operations also shift depending on your task. For example, OSINT in mass phishing is minimalist compared to spear phishing and vishing, since you're targeting a broader population. Or in mass phishing, where the goal is to capture as many points as you can. Spear phishing and Vishing are much more targeted, specific instances. The idea behind Pond was to create spaces where social engineering could be experimented and played with, similarly and ethically akin to technical hacking platforms like TryHackMe or HackTheBox. Since it couldn't practically be made with humans, AI was the next best thing.

Technicals

The Github repo includes an MIT license so anyone can edit or interact with the code, improve it, play with it, etc. Besides lacking actual humans, another limitation I would have preferred is if Pond could function with the same technical sophistication of using actual real world tools. HackTheBox achieves this through allowing you to either run their cloud based virtual machine, or connect to their virtual private network through a local virtual machine. Since social engineering as the broader concept within human interaction isn't necessarily huge, I opted to not use that same heavy set up, or use real world tools for that matter. Perhaps that can be a future enhancement. Nevertheless, Pond is a project I made as the "TryHackMe / HackTheBox Social Engineering alternative."

Security teams whether that be physical onsite security or SOC Analysts are prone to psychological bias. What makes security particularly interesting, is there's sort of a mathematical game theory, alongside a behavioral psychology to it. Examining physical security first, someone watching cameras can be psychologically comprised if they're directionality subverted to a different room. The camera did its job, the person watching it was fooled. We depend on human judgement too, at least in the current day, since AI detection systems can be overly sensitive and lack can practical judgement. Even if that attempted subversion fails, adversaries can adapt strategies, learn the defense, and maneuver technical domains through clever behavioral subversion. One of the most common examples is when attackers send repeated low level messages to defenders, and within it slip the real payload, and analysts get alert fatigued. The technical component did it's job, the human was the weak layer. "Psychosecurity" is being used as an illustrative term here, to begin thinking about how cyber is fundamentally a medium in which our imperfect minds are interacting with.

Quantifying Tendencies

Imagine this scenario: security team A builds world class technical security. They have never been breached through offensive cyberattacks, but have no monitoring on how analysts make their decisions, no modeling of the situation at large, and are left in the dark with that information. Security team B has the exact same technical set up, but they quantify and measure behavioral tendencies. This can be done using mathematical game theory structures, applied behavioral psychology, and cyberforesnic analysis. For example, if a security analyst begins en masse dealing with low level alerts casually and quickly, the system may send an alert to inform the practitioner to consciously evaluate their situation handling, as a reminder or wake up call of sorts. Another possible example could be in regards to threat analysis, and how we exhibit sunk cost fallacy. Of course we can't necessarily probe into our emotional states to be recorded, but what we can record is behavior. So security team B creates these machines in which behavior could be quantified, exploitable human tendencies are minimized, and operations are optimized. Besides the fact they're doing more defensive work, we could still reasonably infer that that security team B would be have a better protected cybersecurity system.

Thinking About Intersectionality

There's a real cross discipline between psychology and cybersecurity that gets unveiled the more I continue to learn about analyst decision making, human factors, and cybersecurity. What makes security particularly unique is the defenders have biases which can be exploited, and the adversary is adaptable and intelligent. An easy critique regarding psychology's application could be "human factors is relevant to many fields, is psychology as "fundamental" to those fields as well?" They are not, because the key distinction is human factors is one element of psychology in cybersecurity, whereas the former will be the primary and typically only application of psychology to the field. Whereas here, psychology has many multifaceted applications. The internet is ultimately social because it digitally connects human nodes through cybercommunication mediums, and many technical payloads depend on psychological manipulation or some sort of behavioral initiation to operate functionally. Additionally, social engineering as its broadly used currently, like in phishing is one of the most common cyberattacks and heavily exemplifies the overarching point that a fortresses defenses are only as good as the mental resilience of the human at the gate. Cybersecurity is still in its infancy in the grand scheme, and further development on the human side as theoretically explored in this piece will illuminate such practical relevance.

Recently, there's been this weird obsession in Silicon Valley about escaping the "permanent underclass." This could be defined as a feudal structure where upward socioeconomic mobility becomes increasingly difficult. The reason we will enter this feudal structure, is because the working middle class will be gutted and replaced by the very software many of those middle class engineers built. The basic idea is that after getting replaced by AI, those who were middle class lose that social leverage they once had, whether that be education, familial guidance, etc. And those who are on the rich end of the economy, those who otherwise own the infrastructure, reap its benefits.

Marxist Nightmare & Market Cannibalization

Most pro market, pro innovation people would say that Marxist ideology is completely infallible, and communism isn't practical. On the other hand, Marx raises real concerns that even market supporters must acknowledge to make the system most efficient. Specifically, one of those concerns is in regards to the asset owners congregating wealth into their respective companies, and stifling innovation. Many AI companies talk a lot about democratizing the technology so everyone can benefit from intelligence, not just those with access to it. But it's important to consider the fact models require constant tuning, servers, and maintenance. This means that to participate in AI, you need enough capital to swallow the losses of managing servers, tuning, and more until an unproven demand catches up. Following that logic, that means the AI market is inherently becoming anti-capitalist. Not only are discussions of government bailouts being seriously considered, but that means there's no innovation to challenge the giants. They can get comfortable in their complacency, because no small company will have the capital so survive against the giants. We can see that AI advancement consequentially is leading innovation in practical application, rather than the sci-fi superintelligence investors expected.

Meta's Pivot

Since the superintelligence promise has started to lose steam, Meta, who's invested billions into their infrastructure, yet always lagging behind, exemplifies the issue previously outlined. A company can spend billions on R&D, without any clear path to success. As a result, Meta strategically pivoted to Muse, and other strategies many companies have followed suite with that aimed to increase day to day AI applications. But Meta's pivot is highlighting the key tension: billions don't ensure innovation. If capital can't even buy success, what makes a small start up think they have any chance besides going through the same investors, companies and people driving its technological advancement?

The K Will Grow

The Underclass

As previously stated, since dependence on success in AI depends on the recruitment and investment of a company made by the same wealth groups who believe in its success, there is no real growth potential. Companies can just buy out competition too, as we saw xAI do to Cursor, or the countless companies OpenAI and Anthropic have begun to swallow. And recognition, investment, and beyond would likely remain enclosed to the wealthy, since those in the "underclass" may be cognitively dependent on the very software the rich profited with, rendering their creative input redundant. It also touches on their other favorite idea, "agency."

Agency

Agency as I've come to understand it in Silicon Valley is the ability to autonomously take control over your actions and circumstances. In modern society, the idea of people asking permission and trying not to step out of line has become prevalent. Tech thinkers suggest that agency is one of the defining differentiating characteristics of those who will become successful today. Agency, as celebrated and normalized by the wealthy elite, will likely become an exclusivle luxury as those less wealthy sedate their situations through the cheap dopamine the wealthy are routing into their environments. And as the underclass grows more dependent on the wealthy, loosening that grip to retain the very agency that permits the possibility of socioeconomic mobility may become increasingly difficult to attain for the poor.

Clarification & Conclusion

Someone who doesn't know my views might read this post as anti AI, or anti technological progress. But I would pushback, because I highly support AI & tech development. This piece wasn't meant to critique technology, communities or industries. Rather, the point is outlining the issue is in the push towards the K economy. And whether that push is intentionally driven by select groups, or a natural result of human tendencies, it's worth acknowledging, including the potential negative impacts it could have on our society over the long term. It's easy to say societal wealth should be equitable, but noticing the K economy is also important in regards to the fact the middle class is foundational for our functionality. The middle class being gutted will only impact everyone else in society. In other words, the technology isn't the problem. The problem may rest in who owns that technology, how people depend on it, and how that dependence further reinforces economic and behavioral trends.

The term "hacker" makes people think of someone sitting in front of a terminal, scripting custom malware on the fly. While it's true most hackers, and most of the best use terminals and write programs, the modern day has evolved the term incrementally. When people try to explain their specialization in offensive security, it can end up going on a tangent. Additionally, current attempts at defining taxonomy overlap and can be vague, as distinctive as "pentester vs red teamer." I also found it difficult to navigate the "T-Shaped" learning model prevalently praised in the field when I first started myself. That was why I created the 'Offensive Security Archetypes', to identify the main attack domains in which hackers will congregate and specialize. But while the terms alone show where you hack, they don't show how you hack. So by taking an assessment, similar to how personality quizzes work, and you'll be provided with a tag to quickly and cleanly label your specialization. Welcome to 'WhoHacker.'

Assessments

One

Upon opening, users are prompted with two possible assessments. The first is meant for those interested in offensive cybersecurity but haven't yet started their journey, and and the end provides them a tag with guided instructions on how to pursue that specialty. The questions avoid using the terms directly, and tend to revolve around what the user finds interesting. For example, it might ask "which of the following sound most interesting?" Then the answers may be "how devices connect and communicate," "how pages online function," and similar. It works the same way for style as well. The idea here is for people to connect with the basic concepts rather than the words themselves, as evident without include the term network or website. It also asks other questions besides your basic interests, it centers around curiosity, related to concepts and gadgets, and asking how you think.

Two

The second assessment is meant for those in cybersecurity already, looking to get a tag. Instead of asking your interests, it asks what exact software and gadgets you used, and how specifically you did. The goal with these questions is to map your real, hands on experience level. But unlike the first assessment, the results here don't give a path on what to do next. Instead, it gives a much more detailed diagnostic analysis of your inputs, modeling and graphing your knowledge respectively according to the T shaped learning model. Because knowledge is expansive, it includes spider charts, histograms, axis, generally aiming to map your offensive cybersecurity skills rather than guiding them.

Tag

The tag functions very simply. It provides your Archetype & Style. So, some tag examples could be Web Operator, IoT Reverse Engineer, Human Toolsmith, etc. Archetypes can also be expressed through hybrids or secondary. For example, Binary x AI shows hybrid, which could be read "binary and AI." and Crypto (IoT) shows secondary, read as "crypto, then IoT." So some examples for tags are Networks Toolsmith, Crypto x Human Operator, Binary (AI) Researcher, etc. It's important to restate the fact that in practice, people can hyperspecialize into really specific things they find interesting. The goal of tags aren't meant to replace that tangent. They're meant for filling in those gaps, so people can quickly understand at a glance where you operate. But besides, helping the pros, it helps newbies enter the T shaped learning model with more structure.

"Hacker" is a broad term. Find your specialization, get your tag. With WhoHacker.

Most digital networks I've interacted with are wireless. Whether that be cellular, WiFi, it's not very common to establish a network connection physically. But I decided to do that. In this lab, I used an Ethernet cable to connect my Thinkpad T480, with Fedora Linux, to my Dell Inspiron, with Windows 11. I then virtualized machines on each computer, and had them communicate to analyze it.

Execution

Before anything, I disabled WiFi on both computers to prevent interference. I began connecting the wire into the Thinkpad, since it had the appropriate physical port. I then connected it to the Dell, using an adapter. After establishing the link, I manually configured the IPv4 addresses by using static IP's, since there was no router to automate the DHCP. I began this process by opening the Network Control Panel on Windows, and setting the static IP through the GUI. I then researched how to confgure static IPs through Fedora Terminal. After assigning static IPs, I then opened Windows Terminal to test packet transfers. After running 'ping' returning 100% packet loss, I decided Windows Firewall could be interfering with the connection, since this is an unknown, recently established network. I tested this theory by running 'ping' in my Fedora Terminal, and this returned 0% packet loss, confirming that Windows Firewall was interfering with the connection. So, I ran a command to disable my Windows Firewall. Of course, I subsequently reenabled my firewall to default settings after the lab. But once I confirmed there was 0% packet loss from either end, it was time to begin getting fancy.

Virtualization

This is where it get's interesting. After establishing a network connection using static IPs and a physical ethernet cable with no router, I began the virtual machines. I had already configured virtual machines on both my devices prior to this lab, but I used Kali Linux via QEMU/KVM libvirt, whereas on Windows I ran a Windows 10 Home machine on VMWare. I then also ran Windows 11 Home. After booting and running the virtual machines, it was time to connect them. I always knew that virtualization "tricks" your hardware, but I didn't assume that it influences network capabilities, but it makes clear sense in hindsight. I established a new network on VMWare, all through their GUI, to create a network between the Windows VMs. So on my Kali Linux, I created a bridge device and assigned it the static IP. Then, I made the endpoint a slave to that device, so now the physical port is owned by the bridge. So, the traffic goes from Kali -> bridge device -> ethernet -> Dell -> Windows VM. I basically did the same process from Linux to Windows, and bridged the Windows VMs through VMWare. I tested all virtual machines by sending 'ping' on each respectively, an received 0% packet loss for all of them. I have officially configured a real network connection.

Something I noticed about my own workflow in this lab, is that when I'm unfamiliar, its typically quicker for me to get lost in the GUI than research command syntax. But on the contrary, if I already know that command it is much faster for me to run that then use the GUI. After noticing this, I applied that strategy to the rest of the lab.

Exploit & Analysis

This was the fun part. Now that I had the connection, it was time to use the malicious tools and examine the traffic. I began by running the msfvenom exploit in the Kali Linux CLI. Certutil downloaded the payload from Kali's HTTP server, and ran it on the Windows 10 machine. As I ran the payload, Windows Defender did it's job by trying to protect the machine, since, msfvenom is not a unique malware. Anyways, I had to privilege escalate and disabled Windows Defender all together to allow the payload to be received. I went back to Kali, did it again, and this time the Meterpreter session opened in the terminal. The exploit worked, and the payload sent. I then analyzed the entire flow of traffic in Wireshark. I saw the HTTP GET, the SYN to port 4444, and session traffic.

Takeaways

I learned a good amount from this lab. This aided my reinforcement of the OSI model, networking, system administration, virtual machines, malicious frameworks, etc. I had fun doing this lab too. Configuring the virtual machines, creating a network, configuring IPs, configuring Windows Firewall & Defender, playing with malicious code, it was more extensive than I had imagined it would be. And finally, the funnest part was sending the exploit, then watching it in Wireshark in real time, as a real network analyst would see malicious traffic. Ultimately, this lab was really fun, and I learned a lot of valuable information about networks.

THIS PIECE IS THEORETICAL & HYPOTHETICAL

Abstract

The computer is debated as one of the most important or impressive inventions mankind has produced. It's a master machine, capable of being a teachers course webpage, a casino, a dictionary, and beyond.

Cyberpsychophysics asks what happens when we analyze the interdisciplinary nature of cyberpsychology, psychophysics, human factors, and human computer interaction. It analyzes how what we see and experience on screens influences how we think and behave, and how those actions influence the screens. There's a feedback loop between the human mind, our user experience with the machine, and the machine itself. Cyberpsychophysics explores that, which in contexts of human factors, virtual reality, and security all are very important. This piece is theoretical and not meant to propose rigorous taxonomies, but rather serve as a way to think about our future.

Definition

Put simply, psychophysics is defined as the study of the relationships between perceptual experience and physical stimuli. Cyber, can be defined simply as the interconnection and communication of information through digital devices. Digital is the nature in which the technology is built on, that being binary bits, so you can conceptualize 'cyberpsychophysics' exploring how the user experience of human computer interaction is fundamentally at a cross roads with our perceptual experience. Put simply, it studies the relationship between the perceptual experience and physical stimuli, but exclusively produced in digital environments.

Food for Thought

Digital Polymorphism & The Master Machine

Code, programming languages, and computers are debated as one of the most important inventions in mankind's history. We deeply understand its technical intricacies. And because code is so changeable, it produces a unique instance we've never seen before. We're able to rapidly edit the perceptual environment we're experiencing. Whether its a programmer editing files, a kid playing with inspect element, or Claude AI coding an artifact, the digital environment can be changed so much more rapidly than our physical environment, with way less resources, time, and energy. This is likely in part related to the physics, that being code is much easier to manipulate and create than physical matter. Ultimately, digital polymorphism is the idea that digital environments are extremely capable of change very rapidly.

Because the digital environment is so prone to change, the computer has become the master machine of society. Whether you're playing a video game at 3 A.M., trading inside the NYSE, a supercomputer, building a personal brand, the computer is the machine performing the task. It's so useful we carry a miniature one in our pockets. We can also use that same master machine to perform actions inside that digital environment. Scripts, whether that be malware or software can permeate protections, perform actions, move information, and participate in the polymorphic nature of the digital environment and the internet.

As brain computer interface technology becomes more advanced, slowly integrating into our minds, we're going to find we desire specific functions. Whether that's the ability to edit our perceptual visual experience to see certain colors, hear certain audio, feel certain sensations, etc. Software is so prone to adjustment, and software is inherent to the foundation of cybercommunication and digital perceptual environments.

Reinforcement Loops

A core point to think about is that we're constantly changing. Despite our sense of self feeling fixed, our biology is evolving, our brains are constantly changing how they feel right now, and countless processes are basically rewriting yourself constantly. The point is that we change, a lot more than we think. And what happens is since we're biologically wired for survival, we adjust ourselves accordingly based on learned experience, and internally feel no adjustment. If I saw a lion eat my friend, it would likely benefit my survival to edit my perceptual experience to adjust my belief about lions, how I react to one, etc. But I won't necessarily think about that stimuli as changing me, even though it practically did. Though you're not an entirely different person, you aren't who you were before the experience.

We're constantly living in these reinforcement loops between us and the environment. A loose hypothetical example, is the sudden increase in myopia. Researchers believe this could be caused by increased "close work." These physiological effects create psychological effects, such as myopic people possibly increasing the tendency in which they perform "close work" to compensate for their current state. Then doing more close work further damages eyesight, and the loop continues. This exemplifies how our environment shapes us, and that shaping influences how we react to our environment differently, creating this perpetual cycle of adjusting to the environment -> changes are made to how we feel about the environment.

This relates to cyberpsychophysics because we can see the advancements being made in our comfort levels already. We began with basic cell phones, eventually getting to smart phones, then virtual and augmented reality. We even have patients beginning clinical trials of Neuralink, which is only acceptable in the modern day as our comfort levels adjusted. This adjustment directly mirrors the feedback loop in the myopia example. Proposing the idea of Neuralink in the past would be seen with the same confusion, doubt, and worry that people believe about the future of the mind machine relationship. Or even ancient people being introduced to rocket ships, it wouldn't be something they're comfortable or excited about in the same way we are today. That's simply because we adjust what's normalized as we get exposed. But that's the fundamental concept. The digital environment is so rapidly changing, evolving for our respective needs. As technologies advance, including the capabilities of neurotechnology, cyberpsychophysics will be a fascinating subject matter as our reactions, tolerance, thoughts and perceptions are influenced by the stimuli.

The Merge: Perceptual Control & Ethics

This part gets much more theoretical and serve as additional ways to think about the subject. The Merge is the idea introduces some theoretically fascinating, yet pragmatically horrific circumstances. It's simply the idea that brains and computers will practically merge, and we'll create an artificial extension of ourselves. Whether its for enhanced cognition, virtual immersion, the possibilities are endless. In brain computer interface research, there's already an established concept known as nuerosecurity, essentially the digital security of the brain. If we can merge the computer and the brain, the brain becomes an attack surface itself.

If our brains are the biological computers creating our experience, and computers are the technology to edit that experience, nuerosecurity becomes a critical point of research. The theoretical capabilities are essentially limitless; since after all, so is the digital environment. The brain is our control center for everything. If our brains can connect to a network then there's inherent security compromises.

The cyberpunk nightmare is if hackers can control our behavior, vision, taste, consciousness, and entire perceptual experience. I believe if this technology comes to fruition, there may be pushback for the computer to get certain capabilities of that experience, which could prevent specific scenarios. A robotic ransom demand being repeated over and over, someone controlling your behavior or making you unconscious to take advantage of you, edit your entire vision, quite literally anything.

While this section was much more theoretical, it serves cyberpsychophysics by illustrating the horrific capabilities which could incur if the study is not realized by then. There is a serious feedback loop between us and our environment, and the extremely rapid and capable nature of our digital technology can greatly influence that. Though it could be a slow, multi generational transition, our societal tolerance and influence from the stimuli should be a point of observation.

Conclusion

Traditional psychophysics once asked how the human mind interprets the physical world. Cyberpsychophysics extends this to synthetic stimuli, examining the bidreictoal loop between perception, user experience, and digital technology. We are no longer just operating the master machine, we are letting it rewrite the rules of what it means to be human. Extending the brain with computers, paired with the infinite capability of the digital environment, opens endless possibilities. While highly theoretical today, this field will become much more prominent and deeply important to the future of humanity ethically, biologically, and psychologically, as these advancements are made and discoveries are realized.

Intro

People imagine cybersecurity purely as a computer or information technology field. Hacking is seen as a purely mechanical, technical action. Social engineering is treated as a separate folder within the broader attack surface as something attackers do sometimes, like psychology is this optional add on. But I beg to differ. Social Engineering and Psychology actually permeate through every single technical specialization, as a multi-dimensional component, and fundamental pillar of cybersecurity.

Reflected Cross Site Scripting (XSS)

Let's look at Reflective Cross Site Scripting (XSS), what many security professionals would consider a technical web exploit. But lets actually zoom in on what's going on here. The attacker crafts a malicious URL, which requires a user action: to click on it. No rational user is going to click on a naked URL being sent, so it's typically wrapped in some deceptive messaging. While there are other methods for delivering the payload, this example illustrates how the technical exploit was fundamentally social. While I will say there are 100% technical exploits, like smart contract reentrancy, and basic social engineering like face to face lying, the platform facilitating the communication, the internet, is inherently technical. The Reflected XSS would not work without some sort of interaction and deception of the victim. This shows how social engineering is not a subcomponent, but rather fundamentally embedded.

Approval Phishing

Another easy example, which is very prevalent in the crypto market, is deceptive UX hacks like Address Poisoning or Approval Phishing. Approval Phishing, is when the attacker creates a smart contract on some website that the users wallet interacts with. Because the transaction hashes are cryptographic, what it actually does is unreadable to humans. Attackers manipulate our perceptual limitation, while depending on the fault of the user to blindly trust the smart contract, and click approve. If the human feels uneasy about authorizing the smart contract, and declines the smart contract, the attack renders useless. While still technical to create and deploy the attack, this example highlights how embedded psychology is into the success of this attack type. And this pattern is consistent across many different attack types.

Defense Being Manipulated

Another concreate example of how relevant psychology is to cybersecurity, is that it isn't just applicable to attackers and individuals. Enterprise defense and prod teams are also at risk. Diversion attacks are when attackers create noise within a network for analysts to defend, while they send the real payload when defense is distracted. Log flooding to distort activity. Hiding backdoor malware under resource heavy cryptocurrency miners. Things like pattern matching, attention fatigue, assumptions, all undermine the efficacy of the defense.

Additionally, the point I believe drives this home most, is that a castle's fortress is useless when entrance is voluntarily handed over, or deceived when under attack. In cybersecurity, teams can build the absolute most resilient code man has ever seen. But it means nothing if a person doesn't patch entrances, maintain entry and exit traffic of the fortress, and preserve its stability. The technical layer is still a necessary component, it just isn't enough on its own. We operate interconnected on digital technology, so cybersecurity cannot be focused strictly on the theoretical and practical reliance of code and systems. We must also consider the fact that we the humans, are the ones using and building the very infrastructure being attacked and defended. So the behavioral and cognitive nature of humans, otherwise known as psychology, is directly applicable.

The Social & Technical Axis

Further Examination

Now that the groundwork is established, this is the best way we can think about how fundamental psychology is as a component to cybersecurity.

As outlined in the two previous examples, there was some sort of deception required for the attack to succeed. I mentioned psychology spans across the different domains. For example, DNS spoofing, a network exploit, is when the attacker injects a fake entry to their fake website. And while technical, it still requires some human participation for the attack to function. Or OAuth phishing, a cloud exploit where an attacker impersonates a trusted vendor, convincing victims to click a link granting access to sensitive software without any password. This is one of the clearest examples of how cloud infrastructure, otherwise a technical fortress, could be so easily compromised. These exemplify that while the attack is fundamentally technical in it's architecture, actually performing many attacks, whether against individuals or teams, can create an inherent social dynamic.

Hacking is a spectrum from purely social, to purely technical. I will be working with the OSA, a paper I previously wrote to An attacker who treats psychology as optional is inherently less dangerous. A security team who neglects psychology will inherently be less protected.

The Rubric

To keep scoring consistent, each attack will be calculated 0-2 in these two domains along the x axis:

Social: S(x)

0) No Human Involvement

1) Human as Passive Conduit

2) Human Judgement is Deceived

Technical: T(x)

0)No Skill Required

1)Off-The-Shelf Software

2)Custom Development

The Axis

|------------------------------|------------------------------|

-2 0 2

Social Technical

It is also important to clarify this axis serves as an illustrative, comprehensible and theoretical model rather than formal, empirical evidence.

Position = T(x) + S(x). A net technical score lands right, a net social score lands left, and a balanced attack sits at 0. Where an attack has more than one delivery method, each variant is scored and the result is given as a range, with the average as its center point.

The Axis

Web

SQLi

• sqlmap / automated: S(0) + T(1) = +1

• manual / WAF bypass: S(0) + T(2) = +2

  avg = +1.5, range [+1, +2]

XSS

• stored (passive): S(1) + T(1) = 0

• reflected via lure: S(2) + T(1) = −1

• reflected passive: S(1) + T(1) = 0

  avg = −0.33, range [−1, 0]

Networks

DDoS

• booter service: S(0) + T(1) = +1

• custom botnet / amplification: S(0) + T(2) = +2

  avg = +1.5, range [+1, +2]

Evil Twin WiFi

• captive-portal phish: S(2) + T(1) = −1

• rogue AP auto-associate: S(1) + T(1) = 0

  avg = −0.5, range [−1, 0]

Crypto

Smart Contract (EVM, Bridging)

• known class, PoC: S(0) + T(1) = +1

• novel logic flaw: S(0) + T(2) = +2

  avg = +1.5, range [+1, +2]

Perceptual (address poisoning, clickjacking)

• off-the-shelf drainer: S(2) + T(1) = −1

• custom drainer development: S(2) + T(2) = 0

  avg = −0.5, range [−1, 0]

Limitations & The Delivery

This axis is an illustrative and theoretical model, not formal or empirical evidence. The scores are reasoned judgments, not measurements, and the position of any technique shifts depending on which delivery variants are counted and how many. It is built to aid comprehension of how social and technical factors interrelate, not to prove a ranking.

With that said, the ranges point to the real argument. A payload is almost always inherently technical, and if you score only the payload, nearly everything collapses to the technical end and the exercise says nothing. What the ranges show is that the payload is not the whole attack. The delivery is, and delivery is what the payload-only view overlooks.

Delivery matters more because it can change or alter the payload in action. The same reflected XSS is a different attack depending on whether it arrives through a lure or an auto-submitting form, and the same firmware update swings across half the axis depending only on how it reaches the device. The payload is fixed; the delivery is where the attack actually takes shape.

And delivery is where the social aspects enter, because the connection medium is digital technology. Every attack has to traverse a human built, human used channel to reach its target, and that channel is where a person can be made a passive conduit or have their judgement deceived. The technical payload stays constant, but it is carried over a medium that is social at its edges, which is why the human element is embedded in cybersecurity rather than sitting beside it.

Conclusion

Ultimately, the point of this piece was to highlight how fundamental psychology is as a pillar of cybersecurity. The field is treated as an exclusive IT or CS domain, disregarding the human element as an optional add on. Whether it's individuals or enterprise teams being attacked, psychology helps better defend against the attacker's weaponizing it. Basic awareness campaigns can only do so much. Payloads are shaped by their delivery, so attacks should be viewed from that perspective rather than exclusively on the payload. The cybersecurity industry substantially appreciating and investing into the psychology of how we use and defend systems, will only enhance the modern digital infrastructures resilience.

During this lab, I virtualized Ubuntu for hosting the web application's server, and Kali Linux to run the IP in a browser. The specific exploits I experimented with where SQL Injection, Cross Site Scripting (XSS), Brute Force, and Server Side Request Forgery (SSRF). In this lab, I learned how to manage multiple virtual machine environments, how different web vulnerabilities function, how to configure a web application server, and the importance of web security. This paper is not to define the terms as I understand them, but rather outline my learning experience.

Previous Experience

I'm currently a Pscyhology B.S. major, so I have a good understanding of the biases, thinking and behavioral patterns that social engineer hackers exploit. I also have some experience with HackTheBox and TryHackMe, which platforms converge moreso around network hacking. I've read some PortSwigger articles, but I had never gotten into learning web vulnerabilities. So I decided to change that.

Web Vulnerabilities

Brute Force

The DVWA simply provides a log in text box to input a username and password. Experimenting, inputting random text, I was returned incorrect credentials warnings. I then thought to myself, perhaps there's a tool I can use. I'm familiar with John the Ripper, but that's for offline hash cracking. After some confusion and reading the official documentation, I realized I had slightly misconceived how the DVWA functioned. I thought I was trying to achieve a flag like HTB or THM. But I realized Brute Force isn't necessarily a coding limitation, it's a fundamental behavioral flaw embedded in how passwords work. Someone can literally try logging in over and over again, until it works. Seems primitive to someone in 2026, yet for something so simple we still haven't solved it.

SQL Injection

I was already familiar that SQL means Structured Query Language through my module learning. I knew SQL was a language designed to create and manage databases through queries. I was provided an input box saying "User ID." First, I began by inputting numbers. I noticed that these numbers stopped producing outputs after numbers 6+. I also noticed that it had no case handling for special charterers, returning an error 500. Another parellel I drew to enhance my concpetion, is that it's similar to prompt injection. The attacker is simply manipulating an AI (in this case the query language) to perform an unauthorized action by inputting code as data. I also learned about the different softwares that use SQL like PostgreSQL, SQLite, MariaDB, MySQL, and Microsoft SQL.

Cross Site Scripting (XSS)

While learning XSS I was suprised by how many versions it had. But after researching them, I realized they aren't as distinct as categorical isolation might make it initially feel. I also believed that because of the name, it had to do with multiple websites. But I was surprised to learn that some of them interact with a server. Reflective literally reflects an HTTP request from the victims browser off a server, Persistent saves to a server, and DOM happens entirely through the victims browser. I learned about the capabilities, such as the ability to deface a page, key log, perform actions as the victim, steal cookies and redirect the user. All XSS methods require user interaction to trigger the attack.

Server Side Request Forgery (SSRF)

SSRF is really interesting to me. it's important to clarify that though the DVWA didn't have a dedicated SSRF module, I still could conduct research. The first parallel I drew when understanding this exploit, was that it reminded me of XSS, is that you're manipulating the server in some sense. The main difference is that XSS stays client side, whereas SSRF is server side. Additionally, I decided to look up what else can occur, because independent I realized if someone has remote access to a server, that's an opportunity to begin analyzing the network, lateral movement, and ultimately moving from web exploitation to network exploitation. No user action is needed to cause an SSRF.

Additional

Before this, I had never configured a server to run on my computer. I also did not have Ubuntu configured as a virtual machine prior to this lab, only Kali Linux and FreeBSD. The primary operating system I used was Fedora Workstation on my ThinkPad T480.

To relate this to social engineering, it's interesting because XSS for example requires the user to perform an action. Attackers could leverage social engineering to explicitly design web pages in specific ways to produce those desired behavioral outputs.

Conclusion

By the end of this lab, I've enhanced my learning about server deployment and configuration, how servers relate to websites, and common web vulnerabilities. There's many more that I did not cover in this piece, but I plan to continue my education in web vulnerabilities. I hosted the The Damn Vulnerable Web Application server on an Ubuntu virtual machine, and ran the website on a Kali Linux virtual machine. I experimented with multiple different web vulnerabilities, taking notes and conducting addiional research as needed.

Attackers and users find themselves in a unique position online. System architecture has fundamentally embedded humans at the heart of it. This piece overviews how the human node faces specific challenges that attackers exploit, according to their desired goal and situation. Much like in game theory, both the attacker and the victim have an optimal move given their situation. This piece doesn't attempt to solve that game. It lays out a starting framework for thinking about it. While in practice strategies are used in combination, they are separated here for the sake of the analysis.

The Operator Privilege

Definition

There's an innate relationship between the user and the machine that's rooted in its inception. We have to navigate the computer, so we require permissions and abilities to do so. But users can make mistakes, experiment, and break systems. This issue is what I call "The Operator Privilege." It's why we created system administration, so users could be users without the administrative privileges that have the ability to decimate their machine. But that distinction is the furthest we've gone to solve the operator privilege problem. Even as a user, the human still has the ability to receive an email from an impersonating, unverified third party and expose sensitive information. Digital items can be stolen.

An important caveat is that hackers rarely hack their target machines directly. They might start with a computer that belongs to an intern. Instead of forcing their way through resilient cybersecurity, attackers use the human node as a guided shortcut. This is simply because the human node is prone to errors and bias as we interpret our situations.

Misuse and Issues of the Privilege

• Digital Dependence: sensitive data, info, or code existing online

• Contact Availability: the ability to be reached by anyone

• Operational Flaw: the ability to perform actions that can affect systems, data, or access

These issues show ways the operator privilege can be and has been exploited. People store digital items on servers. They can be called or emailed at any moment. And they can be instructed to produce desired behavioral outputs. So the attacker leverages these specific weak points.

Game Theoretic Exploits

First, it's important to note that in practice these strategies are hybrid rather than standalone. The game theoretic nature of these strategies lies in their subtle differences, their strengths in specific contexts, and how they are tailored to the attacker's goals and scenario. First I will overview the strategies, and then their game theoretic application.

All three are forms of influence. Persuasion and manipulation both rely on deception. What separates them is how much of the situation the attacker fabricates and how much pressure they apply. Coercion is different because it operates in the open.

Persuasion

Deceiving a target through a plausible pretext that fits their normal routine, with minimal fabricated context and no pressure, so the target decides at their own pace.

Coercion

Openly using leverage the attacker already holds, threatening the target with consequences for noncompliance.

Manipulation

Deceiving a target by fabricating the circumstances around their decision, such as a threat, an emergency, or an authority figure, and applying pressure so the target acts before they can properly evaluate.

Examples

The following cases show how each tactic fit its respective scenario:

• The 2011 RSA SecurID breach exemplifies Persuasion. It began with attackers sending targeted spear phishing emails to low-level employees. The email was titled "2011 Recruitment Plan" with an Excel spreadsheet attached. Embedded in the spreadsheet was an exploit for a previously unknown Flash vulnerability. By exploiting our habit of routinely checking corporate HR updates, an employee opened the file, which installed a backdoor. From there, the attackers mapped and moved through the network undetected until reaching their target: sensitive information tied to RSA's SecurID two-factor tokens.

• Cyberleek exemplifies Coercion. In August 2026, Cyberleek began publishing footage from what appears to be a working build of Rockstar's biggest game to date, Grand Theft Auto 6. How they obtained it is still unknown. They posted the clips publicly, some watermarked with messages directed at Rockstar protesting its decision not to release GTA 6 on physical disc. They also published a manifesto of demands, including an end to digital preorders, an end to paid unlocks for content already in the game files, and offline fallbacks for single-player games. Cyberleek threatened to keep leaking, including story spoilers, unless Rockstar apologized and committed to change. The attack happened in two phases: the breach was how Cyberleek acquired leverage, and the coercion that followed targeted the people at Rockstar who make its decisions. As of this writing, Rockstar has not met the demands, and Take-Two has instead pursued the leaker's identity through the courts.

• Malone Lam and co-conspirators exemplify Manipulation. In August 2024 they pulled off one of the largest single-victim thefts on record without writing any malware. Posing as support staff for Gemini, the exchange connected to the victim's digital assets, they called the victim and told him his account was under threat and that they had been assigned to secure it because he was a premium client. The victim held about 4,100 Bitcoin, worth roughly $243M at the time. They instructed him to install AnyDesk, a remote desktop program that lets someone view and control another device over the internet. Once connected, they got the victim to reveal his private keys on screen, which was all they needed to transfer his Bitcoin into their own wallets.

Theoretical Application

Persuasion. In the SecurID case, the social engineering was only the beginning. The attackers leveraged the human node to gain further access toward their real target, and the backdoor let them move through the network undetected. Therefore, persuasion is best when:

• Stealth matters

• The attacker has no leverage

• The pretext fits the victim's routine, with little fabricated context and no pressure

Coercion. Cyberleek was forthcoming about their demands. They also already had leverage, the leaked build, to keep threatening Rockstar. So coercion is best when:

• There's no need to stay unnoticed

• The attacker already has leverage

• The immediate goal is typically the final target

Manipulation. Malone Lam created a fake scenario to induce specific emotions, making the victim's behavior easier to steer and predict. The crime also had a massive payoff, so achieving the desired behavior carried higher stakes. Manipulation is best when:

• The variables influencing the victim's decision can be fabricated

• The attacker is willing to apply extreme pressure

• Emotions can be weaponized to steer behavioral outputs

Clarification

The takeaway I want to emphasize is that each strategy excels in its own environment. The SecurID attackers found persuasion attractive because they had no meaningful leverage over the victim, so coercion was practically unavailable. They could have manipulated in principle, but applying pressure would have sacrificed stealth. The same logic applies to the other examples. Cyberleek posted publicly without concern for being noticed and didn't begin the social engineering until after obtaining the build. Malone had one high-stakes chance to succeed, so he did whatever he could to pressure the victim. The strategy an attacker chooses depends on their environment.

Defense

Constant Caution

Online, you should always exercise constant caution. This sentiment was much more common in the 2000s and early 2010s. But as the internet matured and screen time took over people's lives, we've become comfortable. People answer numbers they don't know and assume every email or text is legitimate. Companies store sensitive code on servers connected to the internet. But there are ways to fight back.

Every one of these attacks works by placing a carrot in front of the victim to steer them: a routine HR file, an urgent security alert, a chance to protect your account. The instinct is to chase it. The best defense is to stay skeptical of whatever you're being pulled toward.

Verify & Protect

It's very common for people to take the easy option: skip MFA, skip the password change, skip the security alert, skip that extra step. Attackers love that. As simple as it sounds, people taking that initiative, and developers making it easier and more intuitive to do, is how cybersecurity improves.

Another common mistake is not checking who's contacting you. If a company claims to be contacting you, find its official support contact and verify. If they truly are trying to reach you, that effort would be coordinated, and employees can confirm whether it was them. In Malone Lam's case, one call to Gemini's real support line would have ended a $243M theft. It's not just about being skeptical. It's about using that judgment to control your behavior and actively prevent attacks on yourself and others.

Conclusion

Ultimately, The Operator Privilege is why the human node is the most vulnerable attack surface in the entire architecture. Because the human node is so foundationally embedded, it faces unique risks. Unlike code, which executes deterministically, humans interpret information, make choices, and evaluate circumstances. Attackers choose specific strategies based on their environment. But ordinary users can also play the game and defend. Mapping and isolating these strategies can help security teams better understand, predict, and defend against attackers. This paper wasn't meant to solve the game theory of social engineering as we know it. It was meant to estbliash primitive concepts, the ideas, frameworks, that we can establish and iterate to maybe one day solve it.

This lab, I conducted a phishing campaign on myself to gain familiarity with the tools attackers use. I began by searching online for publicly available datasets of real phishing emails and real ordinary emails. After downloading them, I ran a virtual machine of Kali Linux on my host device, which runs Fedora Linux. Kali Linux is a cybersecurity Linux distribution that comes equipped with cybersecurity tools and systems alike, including GoPhish, the most popular phishing campaign dashboard and campaign manager.

I then also searched for the commands to download the MailHog repository and run the instance locally through my Firefox web browser. After testing to ensure communication, I was ready to begin. I fed both datasets to Grok LLM, with explicit instructions to preserve all wording and simply keep track of which emails were legitimate versus which were not. I then asked it to return each one in randomized order, which I would then implement into its respective template. After that, I initiated the campaign. All emails from the GoPhish dashboard successfully reached my desired MailHog destination. The campaign was successful.

Test & Results

After ensuring I received the 10 legitimate emails and 10 fake emails, I tested myself to see if I could identify which were which. I went through and rated each one either "Real" or "Fake," recorded my confidence as "Low," "Medium," or "High," and explained my reasoning. After going through all 20 emails, I took my results and copied them back into Grok to cross-verify which I had correctly identified (losers), or mistakenly missed (winners). The results are as follows:

• Out of 10 phishing emails, I identified 6 correctly and missed 4.

• Out of 10 legitimate emails, I identified 7 correctly and missed 3.

Analysis

After gathering the results, I collected the specific messages that I successfully identified as phishing, and the ones I didn't. I did not collect any of the legitimate emails, since I was measuring my ability to recognize phishing, and they are now irrelevant. I then ran each respective group into Hellhound, a social engineering meta-analysis tool. I ran each one, downloaded their .json files, and then cross-analyzed them through Hellhound again.

Some insights we can derive from these data points are that threat framing, urgency, call to action, and emotional pressure were recorded consistently higher among the winners, whereas losers had higher surface quality and personalization. There is a caveat for personalization, as it was high for both groups, but scored higher on average in the loser group. I identified messages more often when the attack was perceived as personalized, and classic strategies like urgency and threat framing were used in non-obvious ways, enough for the message to go undetected.

During the next offsec security awareness campaign, I would use this new information to eliminate all loser templates that used extra personalization and surface quality. I would also double down on the winners, which used more emotionally manipulative strategies like urgency and threat framing.

Conclusion

In this lab, I learned how to use GoPhish inside of a Kali Linux virtual machine, create templates, create a MailHog instance, and execute a phishing campaign. All network activity and digital behavior was executed 100% on myself. I also used Hellhound to exemplify its practical utility, the data it could provide, and the insights we could derive from said data.

Most hackers try to gain as much knowledge as they possibly can across many different domains. But the world of tech is such a rapidly evolving, unfathomably large body of information that learning every single aspect is impossible. That is why I created the "OSA": to standardize umbrella attack vectors (archetypes) and their specializations within each one (classes).

This list is best imagined as a skill tree, not a checklist. Hackers tend to follow a "T-shaped" learning model: knowledge starts broad and general, but due to the sheer volume of information, hackers zone in on specific classes as they improve. OSA aims to make that natural mental model easier to navigate and standardized.

An archetype earns its place on this list by one test: does it represent a distinct enough surface, toolset, and practitioner identity that people specialize in and build reputations around it? If a skill supports multiple archetypes rather than defining one on its own, it's a tool that travels, not an archetype itself. Every archetype below is a vector, something acted upon or exploited. This is not a ranked list, and no archetype is ordered above another.

The Hacker Archetypes & Classes

Web

• Client Side — exploiting browser side trust and logic, like XSS or DOM based attacks

• Server Side — exploiting backend logic and data handling, like SQLi or SSRF

• API — exploiting programmatic interfaces through broken auth or schema abuse

Networks

• Radio/Wireless — attacking Wi-Fi, Bluetooth, and RF communication

• Active Directory — compromising enterprise identity and domain infrastructure

• Protocol — manipulating routing and protocol level behavior, like ARP or DNS attacks

Cloud

• IAM/Access — abusing permission and role misconfigurations

• Container/Orchestration — escaping containers or exploiting Kubernetes

• Serverless/Control-Plane — attacking cloud functions and provider level APIs

Social Engineering

• Phishing/Vishing — mass remote manipulation through email or voice

• OSINT - deep reconnaissance to build highly convincing attacks

• On Site - live, in person manipulation and pretexting

Mobile

• iOS - exploiting sandboxing, entitlements, and platform specific flaws

• Android - exploiting the app layer and native code on Android

• Mobile Web - exploiting hybrid and WebView based mobile apps

Crypto

• Solidity/EVM - finding logic flaws in smart contract code itself

• Bridge - exploiting cross chain and interoperability systems

• Perceptual - Address poisoning, approval phishing, poisoned air drop

IoT

• Firmware - extracting and analyzing device firmware

• Hardware - attacking the physical device directly, like JTAG access or chip off

• Embedded Protocols - exploiting device level communication like Zigbee or MQTT

Binary

• Memory Corruption - weaponizing low level bugs like buffer overflows

• Kernel - Kernel level exploitation

AI

• Prompt Injection - prompt injecting an AI to perform unauthorized actions

• Model Poisoning - corrupting weighting and training data sets to skew actions

Conclusion

Hackers use the T shaped learning model to stay generalists across archetypes, while zoning in on their respecting archetype and class. This list is also not fixed, it will evolve as the field does, and is open to pruning, editing, or enhancement from any reader. The OSA is to help conceptualize the distinct roles hackers can take, encounter, and how to help conceptualize their own T shaped learning model.

It was any other day. Out of the blue, I received a message from "Kamarii," an alleged aspiring painter. She sends a message explaining her dream to become an artist, and felt as if the picture on my post was one which she would want to paint. I accepted her offer, figuring there was low stakes, and high potential payoff. As the conversation continues, she asks questions which make the conversation feel more collaborative than transactional.

Framework - The Attack

1) Research & OSINT - The account seemed well polished. Roughly 300 followers, posts, highlights, and results from other paintings. She also sent me a post from my own account to use for the painting. Though there's not much we can know for sure about her independent research in this stage, but there was clearly preparation put into the perception of the account, which I will circle back to later.

2) Establish Trust - She sends me the initial message. Questions are low ask, easy to respond to. "Would you mind...?" "What's your favorite color?" She also would continue to flatter, by saying the opportunity to do a picture like this would be amazing, and that she is excited and passionate to begin.

3) Exploit - She initially asked me for my email and name, which was low ask. So I did it. She then also mentioned that I would be getting the check via email. Before I could respond, she asks for the name of the bank I use, and specifies that she isn't asking for my "bank information," but rather just the bank name.

4) Exit - By then, I had responded and said this was suspicious, and I was almost honored. She replies with a final act to seem confused, stating "I don't understand." I then replied "I won't be cashing any checks, thanks though." The conversation then immediately ended, with no further follow up.

Psychological Tactics - My Rationale

Foot in the Door Phenomena - This is the instance in which she slowly introduced the ask, to get more subsequently. By beginning with the entire set up of pretending to be an artist, raising it to my favorite color, to eventually my name, email, and bank. I felt comfortable giving my email and name, since my name is in my email, and my email is in my link tree. Nothing confidential i figured, it's low stakes to respond. That's an exploit I fell for, allowing the conversation to develop.

Social Proof - By having 300+ followers, posts and apparent activity, it quickly clears the suspicion of a bot account. There's also alleged before and after pictures becoming paintings. I've also heard of legitimate instances in which small artists will collaborate with other people to get their work more in the public eye. This led me to believe some sort of legitimacy. She also said the painting would be shown at a venue in the Brookline area, likely leveraging the "Boston" in my bio.

Subtle Urgency Bias - Stating that the check had to be cashed before the painting could be made creates a sense of urgency to accept the "offer." I wanted to see the painting's end result, and felt a need to "repay" her deed through support

Reciprocity Norm - This is reinforced when she would continue to send messages about how she hopes to sell art for a living someday. It exploits the reciprocity norm, the idea that since she is creating or doing something for us, we internally feel we owe it to reciprocate support to her endeavors.

Conclusion

Ultimately, you should always be skeptical when receiving direct messages from strangers online. Even if their account seems authentic, conversation genuine, cyber criminals are always looking for their next victim. I knew I was correct in my hypothesis when she did not attempt to salvage the conversation after playing confused, and I refused to cash the check. The transition to money was also what alerted me as well. I asked if the payment could be received in person at the gallery, and she outright refused, stating deposits must be made before the craft can begin; which I took a mental note of. So, I was socially engineered, almost. And being fascinated with this field, I realized I became my own guinea pig of sorts. I've never fell for phishing, bait, or any other social engineering cyberattack outside of this one, but this most recent attack executed with solid precision.

This study was executed & written up in March-April 2026

Problem

DeFi interfaces are built for technical users. Data is presented without interpretation to people who have no framework to evaluate it. The result is inaccurate risk assessment, poor decisions, and dropout. Curve Finance's liquidity pool interface exemplifies this. Every data point is present, none of it is communicated.

Solution

I tested whether simplifying information presentation and adding explicit risk framing could improve risk perception accuracy among DeFi newcomers. Interfaces should default to simplified data, not raw metrics, if the goal is accurate risk assessment.

Research Method

Participants were randomly assigned to one of four versions of a DeFi liquidity pool interface. The only differences between versions were how the information was presented and whether a direct risk warning was included.

After reviewing their assigned interface, participants answered a questionnaire measuring how accurately they assessed the pool's risk, how confident they felt in their judgment, and how mentally demanding the interface was to process.

Interfaces prototyped in Lovable, surveyed via Tally, analyzed in Python with AI assisted scripting. Pool UI was modeled from an existing Curve Finance pool to preserve realism.

• Insight 1 - Participants assessed risk 39% more accurately with the minimalist interface than with the technical interface.

• Insight 2 - Adding an explicit risk warning reduced perceived cognitive load by 27%.

• Insight 3 - Risk warnings improved accuracy in technical interfaces but reduced accuracy in minimalist ones.

Learnings

Plain language had more impact on risk accuracy than explicit warnings.

How information is presented matters more than explicit warnings.

Warning banners had opposite effects depending on context.

They improved accuracy in technical interfaces but reduced it in minimalist ones.

Cognitive load was the clearest predictor of poor risk assessment.

The harder the interface was to process, the worse users judged risk.

Next Steps

Simplify pool detail pages to plain language by default.

Add explicit risk tier labeling specifically to technical interfaces where the data shows it has the most impact on user accuracy.

Replicate with a larger sample to test whether the interaction between interface complexity and risk framing is statistically significant.

Hellhound is a meta-analysis tool built for social engineering artifacts. It's a standalone desktop tool that opens with a single terminal command, runs fully offline, and never sends a single byte of the corpus you feed it anywhere. Instead of trying to answer "is this message malicious," which is really a detection problem, Hellhound answers a different question: what psychological techniques is this message using, how strongly, and how does that compare across a whole batch of attacks. That shift, from detection to pattern analysis, is really the whole point of the tool.

Functionality

Every message gets scored against a fixed, published rubric. It's not a model and it's not a black box, it's deterministic keyword and regex scoring, meaning the same input produces the same output every time and every score traces back to something you can actually point to in the text. It looks at emotional pressure like urgency and fear, persuasion principles pulled from Cialdini like authority and social proof, personalization based on how much specific data the message throws at you, linguistic clarity, and how much friction the message creates against someone trying to verify it out of band before acting. Matching runs on whole words now, not raw substrings, so a term like "irs" won't quietly match inside "shirts," and if a message says something isn't urgent instead of that it is, the tool catches that and doesn't score it as urgency. It's not perfect negation handling, it's a fixed window that looks a few words back, so it can still miss negation coming from earlier in the sentence, but it's a real improvement over just counting keywords blind.

Defensive Application

Imagine a company getting hit hard enough with social engineering that catching every attempt by relying on employees alone isn't realistic anymore. A SOC team can pull together the messages that actually worked, whether that's from HR, Finance, wherever, and run the batch through Hellhound. The value isn't flagging one email as bad after the fact, it's comparing the score distributions across departments. If HR's successful messages keep scoring highest on emotional pressure and liking while Finance's keep scoring highest on authority and urgency, that's not just a hunch anymore, it's a measurable pattern across the messages that actually landed. Now the company can see which persuasion techniques consistently show up in successful attacks against each department and build training and verification steps around those patterns instead of running generic awareness sessions.

Offensive Application

The same rubric works in reverse for authorized red team and pentest work, under proper scope and client consent. A tester looking at which pretexts succeeded in a sanctioned phishing simulation can use Hellhound to see which techniques, authority, urgency, personalization, actually showed up most strongly in the messages that worked for that specific group of people, and which ones flopped. Hellhound provides insight into which strategies performed the best and worst in a given simulation, creating a self-reinforcing feedback cycle where the results of one engagement can help inform the next.

Limitations

Worth being straight about what this tool can't do. It's keyword and regex based, so there's no real semantic understanding, a message can be manipulative without ever using manipulative sounding words and it'll still score low. The negation handling only looks a handful of words back, so it can miss negation sitting further up in a sentence. And the weights behind the composite score, how much emotional pressure counts versus personalization versus everything else, were chosen by hand to be interpretable and adjustable, not fit against a labeled dataset or validated against real click and report rates. So the score is a structured, reproducible way to compare messages against each other, not a calibrated probability of anything. Anyone quoting a number out of this tool should read this part before treating it as gospel.

Conclusion

Social engineering keeps being one of the most successful attack vectors in cybersecurity because it goes after judgment instead of code. You can harden a system almost indefinitely, but a person under pressure in the moment can't be patched the same way. Hellhound doesn't close that gap, nothing really does, but it makes the gap measurable. By meta-analyzing the psychological patterns sitting inside a corpus of real attacks, it gives defenders and testers a reproducible way to actually see which manipulation techniques consistently show up in the messages that succeed or fail, how those patterns differ across campaigns or groups, and where those patterns are worth investigating further.

https://github.com/0xQuotient/Hellhound

The largest single vector attack didn't exploit a code vulnerability. It was human psychology. The victim, an unnamed investor from Washington, D.C., was seemingly alerted by an alleged Google employee who was, in actuality, the main perpetrator, Malone Lam. The attack was a Spear Phishing attack, a deliberate targeting of a specific individual. The victim had a public claim to a large crypto payout, identified through the Kroll data breach that leaked creditor info.

Analysis

The Social Engineering Attack Cycle is the framework institutions use to breakdown how most cybercrime functions. The first phase is (1) Research. By obtaining the data of the holdings made by the Kroll breach, the attackers found their victim. Phase (2) is the Hook, which in this case was the perpetrators impersonating Google. They convinced the victim his account was at risk of being breached, and to reset his password at the spoofed URL they sent. They exploited the authority bias phenomena. Phase (3) is Trust, which they gained by in this case, instating manufactured urgency, to exploit the victim's decision making. This tension piled on top of urgency and authority bias, inhibits their skeptical judgement. Phase (4) is the exploit phase. Before they took the kill shot, they repeated the cycle but this time, as a Gemini employee, the cryptocurrency exchange. He was instructed to download the software AnyDesk, convinced that was how the alleged employees could safely monitor his account from hackers. This software permits screen sharing, which they then obtained the most sensitive information of a crypto wallet, his private key. With this, they drained his entire wallet. Finally, they hit the final (5) exit phase. They cut all contact with the victim, wiped their trace, and achieved one of the largest heists in the modern day.

Revelation

At every possible attack vector, there was no coding exploit, network breach, or technical shortfall. The victim willingly handed over every vulnerability. Cryptography did its job. Cybersecurity did its job. The issue was the exploit of the human mind, the deception of trust, and the weaponization of bias. The security worked, the human cognition failed. This case study remains an extensive example of how cybersecurity reaches beyond building secure firewalls, antivirus detection, or 2FA. The human element, the ability to recognize malicious actors, read security protocol, remain aware and skeptical, could have been what stopped this attack from ever occurring.

The crypto industry creates a unique vulnerability in cybersecurity. Crypto culture is fairly liberal. A distrust of institutions, self sovereignty, and high stake irreversibility in blockchain transactions permit these types of attacks with high susceptibility. Though the attack was made on a CEX, the principles instill. Not every attack is downloading malware or searching for code weakness. Sometimes, the human will disable every step of cybersecurity when deceived.

Intro

Decentralized Finance is like Linux. Technical, philosophical, putting power and reasonability back into the user's hands. Linux has a notoriously small market share. Not because of its capabilities, features, or philosophy, but because it assumed users already spoke its language. DeFi is making the same mistake. By building infrastructure for its own user base, it slowly constructs a wall outsiders must climb to participate, rather than a door they can walk through. The specific failure isn't complexity. It's the missing guardrails.

Real World Analogies

In Linux, newcomers start with Mint or Ubuntu. They're called distributions, or distros, which are essentially versions of Linux. They don't dumb down the system or sacrifice its capabilities, they add guardrails so rookies don't accidentally nuke themselves. In bowling, bumpers exist so beginners can learn mechanics and strategy before the gutters become a punishment. Both create a starting point for building expertise, rather than throwing users into an overwhelming environment where every mistake is final. Mint is the entry point. Arch, another distro, is expert territory. DeFi right now sits at Debian, functional and principled, but a firmly intermediate point.

Entering DeFi Today

Before a user interacts with a single dApp, they face the fragmentation of the ecosystem. You need a wallet. To fund the wallet, you need a CEX. After obtaining crypto, you must send it to the exact wallet address on the correct network. Each step requires prior knowledge the interface doesn't provide. And if you mess up, that mistake is final. The entry path isn't one door, it's a hallway of unlabeled doors with no map. There's a lot of hoops to jump through, and walls to climb, and research required to continue. This manifests as users making costly uneducated mistakes, giving the space bad reputation, or users outright abandoning it.

The Black Hole of Mistakes

Network Mismatch

After obtaining crypto, a user must send it on the correct network. To the experienced, this is reflex. To the newcomer, all they see is "Ethereum, 10 min, $5 Gas" and "Solana, 10 sec, $0.01 Gas." The cheaper, faster option is the obvious choice, except the token may be incompatible. The funds don't arrive. They don't bounce back. They disappear into the blockchain with no recovery path, avoidable with a fluency the user doesn't have yet. The interface offered a choice without communicating the stakes of choosing incorrectly. That's not a user error. That's a missing guardrail.

The Illegible Request

MetaMask pops up in the extension section. "Approve" or "Deny." Underneath, a cryptographic hash the average user cannot parse. Two things happen here, and they're both caused by the same interface failure.

The first: the rookie assumes everything is fine, clicks approve, and can get their wallet drained. The second: the rookie sees something they can't read, grows uncertain, closes the tab, and never comes back. Opposite behaviors, but the same root cause. The request is illegible.

This compounds with the broader problem of duplicate sites, drainer airdrops, and malicious smart contracts that are, to the experienced user, routine noise to filter. To the newcomer, one wrong step is a cliff. The interface provides no signal for which step that is. If the hash were translated, permissions stated plainly, or risk surfaced visibly, the user has something to evaluate. Right now they don't. Even something as simple as built in noise filters for complete rookies could be a practical guardrail. Approving a drainer isn't a bad decision. It's the only decision the interface equipped them to make.

Conclusion

Right now, DeFi is in a state like Debian. Functional, philosophically sound, principled. The Ubuntu moment is what comes next, the point where absorbing technical complexity and preserving digital autonomy stop being treated as opposites. They become priorities to find a balance between. Ubuntu didn't sacrifice what made Linux what is is. It just stopped making the user pay for every mistake while learning it. That's the balance. It won't come from a better whitepaper. It'll come from whoever builds the interface that stops offloading responsibility and starts absorbing it. The technology is ready. The user experience is not.

For More: Portfolio · LinkedIn

The Friction Point

Web3 apps treat financialization like a feature, but users experience it as friction. The apps misalign with the user's intended use case, and adoption suffers as a result.

The Stakes

• Users: Cognitive Load - Every visible wallet, token balance, and coin launch pulls the user out of their primary task. The user came to post, read, or message, not to manage a portfolio. That causes a learning curve and costs more mental effort.

• Businesses: Adoption Ceiling - When the mental cost exceeds a user's tolerance, they fall back to their Web2 app because it feels mentally easier, especially once they're familiar with it. Apps that refuse to separate ownership from financialization cap their own growth at the crypto native audience.

Evidence

Category A - Apps where financialization is the product (the appropriate case):

• Uniswap, Aave, Polymarket:

  These apps are definitively financial at their core. No issues here.

Category B - Apps where financialization is bolted onto a nonfinancial product:

• Farcaster: Embedded wallet in the bottom navigation bar, pulling attention away

• Paragraph: Creator cryptocurrencies turning reading articles into an investment

Category C - Apps that drifted from a core utility into a financial supermarket:

• Phantom: Once a wallet, now has memecoins and perps trading on the homepage

• MetaMask: Buy button precedes any other action with popups for tokenized stocks

The Cost

Apps in Categories B & C face a core structural issue: lack of guidance and distinction. To a newcomer, they fundamentally cannot understand the purpose of each app. Whether it's a wallet, dApp, or game, the user feels paralyzed by too many possible directions disguised as utility. Users cannot tell what an app does, and adoption stalls. Every new feature adds mental effort the user didn't sign up to spend. The app gets bigger, and its reason to exist gets harder to find.

Principles Being Violated

• Sweller's Cognitive Load Theory: Every interface element competes for the user's limited working memory. Web3 apps treat working memory as infinite. It isn't.

• Norman's Invisible Computer: Good tools disappear into the task. IP, HTTPS, DNS, are invisible. Web3 infrastructure is aggressively visible, by design, which creates an immediate learning curve that users do not want to face.

• Tesler's Law of Conservation of Complexity: Complexity can't be eliminated, only moved. Web3 has chosen to move complexity onto the user. Web2 chose to absorb it into infrastructure. The choice to offload responsibility to the user rather than absorb it into infra inherently creates a learning curve requiring mental effort.

How Web2 Wins

Users downloaded Instagram to post, Spotify to play music, Snapchat for invisible chats, and so on. Another example of this is Apple Pay. The user taps, and done. They do not see or feel IDs, settlements, intermediary fees, etc. The infrastructure is completely invisible. Apps have a clear distinction for why someone would use them, without overwhelming the user with responsibilities to navigate and decisions to make. Each app has one job, and the infra is invisible. Web3 currently achieves neither.

Research Inquiries

At what point does ownership interfere with user navigation success?

When a user can swap tokens on Phantom, use a wallet on Farcaster, and buy cryptocurrency on Paragraph, the terminology loses its meaning. Wallets become exchanges, dApps become wallets, and distinction of purpose blurs. A study here would show users variants of the same app with progressively more financial UI surfaced, from none, to optional, to default, and ask them to describe what the app is for. Comparing their answers to the app's actual core utility reveals the point where ownership stops sharpening the user's mental model and starts blurring it.

How does making infrastructure invisible interfere with user trust?

Critics argue that hiding infrastructure strips users of meaningful autonomy. While I do not refute this philosophy, setting it as the primary default directly imposes a learning curve that users do not want. Finding this balance is important. A study here would compare two interface variants, one with transaction details fully exposed, one with details collapsed behind a toggle across crypto natives and Web2 defaulters. Measuring where users hesitate, abandon, or misinterpret what they're seeing reveals where that balance lies.

Web3's adoption problem isn't that users don't understand the technology. It's that the technology refuses to get out of the user's way. The winners of tomorrow won't be the apps with the most features. They'll be the apps that know which features to hide.

For More: Portfolio, LinkedIn

I want to thank my family, my mother, brother, grandmother, grandfather, and uncles.

I thank and deeply respect the philosophers and mentors who have shaped my thinking, from Friedrich Nietzsche, Baruch Spinoza, Dr. Theodore Locke, Ian Drinkwater, and many others I cannot name here.

I also want to thank thinkers like Peter Thiel and Marc Andreessen, along with others who have challenged the status quo of the entrepreneurial and societal perspective.

To you, the reader, I thank you for choosing to engage with this material.

A human being is a part of the whole, called by us 'Universe,' a part limited in time and space. He experiences himself, his thoughts and feelings as something separated from the rest, a kind of optical delusion of his consciousness.

— Albert Einstein

Preface

Political theory shapes the world as we encounter it. The decisions of a few can impact many. It's important to understand the interrelation of how the other can impact the individual, and vice versa. The agency of the individual is one of our greatest perceived benefits of the human condition against nature. I encourage every reader, if they haven't already, to practice cultivating an urgent capacity to explore yourself, knowledge of the universe, and our interpersonal relations as humans.

Part I — The Anatomy of The Shard

Chapter 1

Mirror & The Cracks

Biology has shown that we all root from something. We all share a common ancestor. Life has evolved from single celled organisms to complex entities, such as ourselves. We have grown so advanced, we question our existence, motives, consciousness, and the fundamental fabric of itself. Over time, we create explanations for our existence. Traditional theology perceives a creator, as an entity similar to ourselves. Philosophers in more contemporary times have thought of more nuanced alternatives. Cosmosphysicism, is a perspective that the universe itself is God, not something beyond it. Additional interpretations go as far to think that the universe isn't a conscious entity, but rather the collective of all within the fabric itself. Through this, we understand humans as part of this fabric, not separate. Although we perceive things as externalized, it roots from our primal nature, which needs to externalize threats and its environment for basic survival. But under the lens of collective interconnection, life is not separate from the universe, but a component within it capable of self observation.

Think of reality as a mirror. All material, quantum properties, ideas, everything to ever possibly exist within contained into this mirror. We, as individuals, externalize ourselves from our environment. This can be imagined as cracks in the mirror. To the crack, it is an independent, separate component. But from an outside view, the crack is a mere component within this larger mirror. Life is directly parallel. We are the cracks as individuals within a larger fabric of reality, the mirror.

Chapter 2

99% Blueprint

As mentioned, we share a common ancestor. All life can trace back to single sources, molecules, to single cell life, to beings and eventually us. Through this perspective, we begin to understand we are more alike than we are different. If you never knew what an octopus was, and saw it for the first time, it would appear alien. This makes sense because our basic nature as pack mammals serves this for survival. But under the lens of the common ancestor, the octopus is simply a distant cousin that took its own path. We still share the same ancestor, and the same biological pillars. When you zone this into humans, we become even more similar. Humans are genetically proven to be around 99% the same DNA. Under this perspective we can view humanity much more as a collective unison than different entities.

Chapter 3

The Universal Fuse Box

Humans have a clear strive to achieve, likely rooted in our nature to survive. Conquest, power, material, all aiding societal longevity, one of our most primal desires. When we understand humans as 99% similar, we can understand we all share something. This is ambition. People today have argued that through recent times, the acceleration of comfort, has killed the ambition of the common man. Some go as far to argue that those with no ambition are jealous, or envious of individuals with high agency and ambition. I directly refute this. Ambition is like a fuse box, located within all of us. No person is born with a gene that separates them beyond the masses in a superior context. I don't reject the natural hierarchy of nature. I don't reject biological predisposition either. It's a matter of how we logically interpret these realities to where we ideologically arrive. We are biologically dominant over the animals of the Earth. That is not a justifiable reason to proclaim our moral superiority for exploitation and sufferage. We kill animals to eat, because it's the cycle of nature. We even kill animals for our leisure, like a cow's leather. But it doesn't create sufficient reason as such beyond our simple power dynamic. That is exactly why people will protest unsustainable fashion industries, but the meat industry is only challenged by a much smaller sect, typically driven much more by emotion. This can be applied to those who believe the masses are lazy, envious or incapable. Superior ability is not justification for exploitative dominance. When applied in the context of the 99%, we see the elite not as better or superior, but the few which enabled the switch of their fusebox.

Part II — The Framework

Chapter 4

Liberalism & The Shield

As political theory advanced, we would argue which model best suits the human condition. Capitalism, Communism, Authoritarianism, Libertarianism, etc. I think humans are naturally free beings. We, in our roots, find limitations on our expression or mobility of the self to infringe on our quality of life. The question then begs: what's more valuable, the individual's life or the functioning of society? I would argue that those who favor functionality, are not in on the "cosmic joke" that is life. We could have been in an accident. I'm not advocating for us to be passive about our existence, we should continue to strive to learn about everything we can. But, when we approach the cost reward ratio that prioritizes the functionality, we are taking ourselves too seriously. Throughout history, and observed in life, we see that life and nature is a cosmic joke. We rise and fall, life is filled with death and despair, & the universe is a silent mystery. Liberalism inherently enables the human condition to achieve ultimate flourishing, which in a life we can't explain, is one of our most fundamental priorities. Those who find scientific exploration fulfilling should be enabled to do so. On the contrary, the same applies to those who find fulfillment in the small things, like a morning coffee, community relationships, etc.

Under capitalism, we can observe the optimized function of supply & demand. We observe its rudimentary drive nature flourished in, that being pursuit of resources for individual survival. But, capitalism in a true free market, invites key issues. Firstly, the predatory monopoly. I am not anti monopoly, I am anti predatory monopoly. For example, Steam consolidates power, which George Orwell would not have been a fan of, for not much reason besides personal bias rather than logical reasoning. But, they provide the best service, a library of collective contribution, and a feedback loop of customer satisfaction. I find no issue here. But, standard oil or Visa Mastercard, are prime examples of expletive monopolies. Their market dominance is not a result of consumer choice, but the lack thereof. They undercut competitors, exploit their dominance, ultimately hurting the consumer. By regulating the market to prevent these issues, they don't act as a wall. They act as a shield. I am not an anti innovation regulator. I am just pro safety. Seatbelt regulation didn't infringe the success of motor vehicles, they enabled further collective protection. This is the perspective the regulator should undergo. I don't enjoy the word regulator anyways. It has the connotation of stifling, but that's not my belief. I'm not conservative, I'm actually very progressive. But the shield serves to protect us from things we don't understand, like motor vehicle collisions mangling humans. We can also avoid turning regulation into the thing Thielism fears, and I think we do that by balancing the cost reward ratio. The innovation of cars incredibly altered the course of human development. Seatbelt regulation isn't a wall that will stifle the innovation of making better, faster cars, it's the shield that protects the human using it.

Chapter 5

The Lego Scaffold

Now, think of human progress like a lego. Each stack was contributed by the individual. But together, we create the experience we live. As Steve Jobs famously said, "I didn't invent the language or mathematics I used. I make little of my own food, none of my clothes. Everything I do depends on the other members of our species and the shoulders that we stand on." This perspective highlights the collective action of our species. If it were not for the horse, we would not have imagined the car. If it were not for the lantern, we would not have created the flashlight. Every idea we perceive as an absolute original idea, is merely a collective influence combined with the uniqueness of the individual to create novel ideas. Nevertheless, every idea manifested, had to draw inspiration, absolute fundamental structure from preexisting systems, ideas, notions. This allows us to understand human progress as a collective effort. Every contribution, every lego piece to the scaffold, consciously builds our development upward.

Part III — Illusion in the Escape

Chapter 6

The Spider's Delusion

Unfortunately, we see that some individuals believe in their novelty as completely originality. Peter Thiel, famously believes the masses are issued in mimesis, copying each other. Under the lego scaffold, we can deconstruct his n=1 ideology. There is no novel idea without the precursor within the scaffold. We could not have had the internet without algorithms. Thiel could not have made PayPal without the internet. This argument, that the elite are inherently separate, independent, superior to the masses, is fundamentally flawed. If it were not for the arms of humans who are forgotten, adding their contribution to the lego, the visionary elite Thiel proclaims himself to be wouldn't exist. I myself would consider myself high agency. I love business, building, learning, reading, and hate wasting my time. That does not suffice as justified reasoning for my intellectual or moral worth above my fellow humans; & I find it egotistical to think otherwise. I find it similar to a spider and web. The collectivism of humanity is the string, which holds the house together. Though the spider may have more agency, it cannot survive without the web. It would be deluded to think it could otherwise. When analyzed as such, we can begin to break down Thielism's perspective on the masses, in the framework established.

Every human has a switch of ambition. Whether they choose to enable it, is not a result of biological chance. It's a result of complex factors, like socioeconomic conditioning, akin to Orwell's learned helplessness for favorable survival in the poor. It's not entirely a conscious choice to keep the switch off. Nevertheless, to think that those without it are less, is inherently illogical. Thiel clearly exemplifies he is not prone to the mimicry of the masses, through his influence from the scaffold, to business names, to the flick of the switch. Thiel is one of many, and to establish the elite as what he explains as nearly a separate species, is ideologically egotistical and paradoxical. The spider would be deluded to try and get food without the web.

Chapter 7

Paradox of Antichrist

Thielism states the antichrist manifests as a regulator against technological progress. I would argue Thielism is purely coercive and manipulative. He states that since people are the biggest drag on political influence, a means to technological innovation is how to achieve total escape from the democratic process. Thiel's ultimate fear, deeply rooted in his interpretation of philosopher René Girard, is that the "Antichrist" will arrive not as a monster, but as a global, totalitarian regulator who enforces absolute "peace and safety" by halting all technological progress. He believes the masses, driven by envy and mimicry, will eventually vote to pause the future, preferring safe stagnation over the chaotic leap of the visionary.

But let us examine the reality of what Thiel and his ideological peers, like Alex Karp, or Marc Andreessen, are actually building. To escape the so called "tyranny" of the democratic masses, they advocate for a system where tech founders operate above the law, above borders, and above regulation. They are building surveillance apparatuses like Palantir, tools capable of tracking and mapping every movement of the common citizen. They push for a society where algorithms dictate the flow of information, and where a few billionaires hold the keys to artificial intelligence and financial infrastructure. To be clear, I am not anti AI, anti innovation, or anti tech. I am a big proponent of blockchain, AI & the internet. I am against sacrificing the cost reward ratio when it doesn't sting the perpetrators enabling the disruption. It directly violates the harm principle established in liberalist ideology.

This is the grand Antichrist Paradox of Thielism: In his paranoid quest to avoid a global, totalitarian regulator, as he described the antichrist, he is actively constructing a privatized, technototalitarian regime. He is building the Chrome Throne. It is a system that strips away the horizontal nature of the web and replaces it with a vertical hierarchy of "Admins" and "Users." The 99% are reduced to a user base to be managed, monetized, and ultimately surveilled, while the 1% Admins hold absolute root access to the future of the species. It forces the masses that produced their very being into those above and below the permanent underclass, a cyberpunk technofeudalism. Continued with their push for virtual reality onto the masses, it directly parallels into the Matrix where users live in a false reality; controlled by the admins in the real world who are directly killing the possibility of the people to enable their fusebox. Without a decentralized model of socioeconomic mobility, it concentrates the fusebox to the elite, stifling innovation from the common man that produced their very being. He claims the antichrist is anti innovation, but the very act of suppressing the common man that helped build the scaffold that is human progress, he is directly enabling that stifling. He claims to be fighting the ultimate tyrant, but in severing the Spider from the Web, he has simply applied for the job.

Chapter 8

A Redundant Exit

The ultimate goal of this technofeudalist movement is what they call the "Exit." If they cannot control the masses, they want to leave them behind. We see this in their obsessions with seasteading (building sovereign cities on the ocean), fleeing to Mars, and most tellingly, their pursuit of biological immortality. To the Silicon Valley accelerationist, aging and death are not natural laws; they are simply software bugs waiting for a patch. They view the biological human condition as a prison.

But this desperate sprint to escape our biology is heavily flawed. It is an illusion. Thiel claims that by seeking immortality and exiting the natural order, he is transcending primitive human nature. I argue the exact opposite: running from death is the most primitive, primate ego response possible. It is the biological survival instinct running rampant, dressed up in digital chrome and billions of dollars. Thiel claims accepting death is passive surrender, that humanity has developed a Stockholm Syndrome for nature. But he is a first class example that acceptance is not the easy path. Pouring billions into longevity research, refusing the very limitations that make us human, that is not heroism. That is the primal ego grabbing for straws dressed in the language of courage. Death is not easy to accept. That is precisely the point. It is the ultimate sacrifice of the ego, a reunification with the source that produced its very being. The brave act is not to rebel against nature. It is to recognize that nature is not your captor. It is your origin. And to return to it, fully and without condition, is the harder choice Thiel has never been willing to make. But, even if the elites can achieve this immortal hyper technointelligent state severed from nature, it raises a lot of issues.

The accelerationist creates an existential threat for the current homosapiens if the elite diverge. Throughout Earth's history, when two species occupy the same environment and one gains a massive technological or biological advantage, the "lesser" species is never just left alone, it is subjugated, exploited, or driven to extinction. If the 1% successfully diverge into a post human, immortal caste, the 99% don't just become obsolete; they become a disposable resource. They frame the masses as stagnant conservationists afraid of change, while being fundamentally disconnected from the practical reality of humanism. Of course not everyone is going to examine life philosophically, but it's a disservice to both the species and themselves to instate these negative propositions onto the masses. They are both a part and the product from the model they aim to kill.

When you try to absorb beyond your place in the mirror, attempting to become a permanent, unchanging shard that never recycles its energy back into the whole, you commit spiritual suicide. You stop being a living participant in the web of humanity and become a stagnant statue. If an elite class successfully "exits" the human condition, never dying, hoarding the Lego scaffold of resources forever, they destroy the very mechanism of progress they claim to be conserving. They prevent the new generation from flipping their own fuse boxes. The very thing that Thiel claims is the antichrist, is perfectly suited through this framework. The Exit isn't a transcendence of the human story; it is the cancellation of it. This is the inherent paradox of Thielism. In the pursuit of trying to escape the totalitarian regulator, they are directly rolling out the red carpet for its arrival.

Part IV — A Sacred Theory

Chapter 9

Aristotelian Plot

If the unchecked acceleration of the elite is a sprint off a cliff, how do we properly direct our momentum? To answer this, we must look back to ancient Greece. Aristotle wrote heavily about the concept of Telos, the inherent purpose or goal of a thing. A seed's telos is to become a tree. For humans, Aristotle argued our telos is Eudaimonia, which roughly translates to ultimate flourishing, or fulfilling our highest potential. He believed we should strive to be like the gods: to seek wisdom, beauty, and the stars.

But here is where the accelerationists lose the plot: Aristotle knew that to reach for the divine, you must remain rooted in what makes you human. Our soul, our biology, our empathy, and our connection to the collective web are what define us. What makes us human, being a component within this larger web of collective unison through the fabric of reality, the crack within the mirror, is precisely what Thielism seeks to dismantle. If we build artificial superintelligence, colonize the galaxy, and achieve ultimate power, but we do it by stripping away our humanity, by becoming cold, posthuman machines, we haven't won.

Sending consciousness to the stars means nothing if that consciousness is no longer capable of feeling the profound beauty of a morning coffee, the warmth of community, or the shared cosmic joke of our existence. If the posthuman seeks to maximize agency, through separating their being from the larger fabric, and reject their place within it, we've lost our humanity. A rocket without a hull is not a vessel, it's just an explosion. If we sacrifice the human soul to achieve god like power, we arrive at the destination with no one left to enjoy it. Instead of propelling ourselves off of a cliff, we must strategically coordinate our movement forward. I am not arguing we halt progress. I am arguing we accelerate with intention rather than blind faith in an optimism that justifies reckless speed. We preserve what makes us human while enhancing what exists within it. Not a radical transformation that severs the thread between the biological primate and whatever technological being follows. Enhancement, not replacement. Evolution, not escape. If we stray too far from our roots, we do not arrive at a destination. We arrive at an artifice. And an artifice, however sophisticated, has no soul to enjoy what it has built.

Chapter 10

The Sacred Duality

This brings us to the core of A Sacred Theory. We must accept and honor the Sacred Duality of life. The universe is a delicate balance: growth and decay, light and dark, life and death. Death and suffering are not net negatives; maybe from the perspective of the ego, but they are the gravity that gives our actions weight. Death as Steve Jobs describes, is to shed the old to make way for the new. If humans, and life can achieve a posthuman state of immortality, embedded artificial intelligence, at what point are the confines that create our humanity severed in the pursuit of more? At what point within the radical transformation is replacing the thing that makes us human? At what point do the immortal elite hoarding the power, wealth, and resources, centralizing the fuse box of ambition, kill the innovation that the masses have built throughout history? We must ask these questions with mindfulness and acknowledgement to stray the direction of the species in favor of it, not to the exclusive elite.

While it may seem like I am a proponent of stagnation as Thiel argues the masses favor, this does not mean I think we should roll over and accept preventable disease. As a progressive, I strongly support upgrading the human experience. We should cure cancer, extend healthspans, and build technologies that alleviate the burdens that people face. But there is a massive philosophical chasm between upgrading the human species and abandoning it.

We are shards within the mirror. We advance consciousness in the pursuit of understanding itself, observing the reflection of life and the fabric of reality. But, if we sacrifice the very nature that makes us human, we lose the point of why we did any of this in the first place. The beauty, curiosity, mysticism of life are defined by our limitations. If we disrupt the duality, what Thielism perceives as mindless and cruel, I argue it's one of the greatest threats to consciousness's understanding of reality. We are shards within the mirror. Our deepest purpose is to advance consciousness so the universe can understand itself through us. Yet if we remove the limits that make us human like death and vulnerability, we lose the very things that give that understanding meaning. Beauty, curiosity, joy, and wonder all depend on finitude. Without them, greater power or knowledge becomes empty. We become a cancer cell that grows for the sake of itself, and nothing more of substance. Preserving the Sacred Duality is therefore not optional. It is the only way to ensure our progress still matters. Otherwise, we risk building a future where consciousness grows larger but loses its soul, a hollow successor that no longer belongs to us. It would no longer be of our consciousness. Therefore, preserving the duality is the only way to keep the purpose of our advancements in tact, otherwise it becomes a zero sum game of empty endless growth.

When we recognize that we are all 99% identical, cracks in the same universal mirror, we realize that nature is not our kidnapper. It is our mother. The dirt that the visionary elite look down upon is the exact same dirt that grew them. To treat the natural laws of growth and decay as an enemy, is to declare war on the very fabric of reality. It is easy for the crack to forget the mirror. It is easy for the spider to forget the web. It is easy for the lego piece to mistake itself for the whole scaffold. These are not failures of intelligence. They are failures of orientation. True heroism is found not in escaping the duality but in mastering our place within it. It is the easy choice to succumb to the ego, seek individual dominance, and declare war on nature. The harder choice is to suppress that impulse, reunite with the source that produced you, and harness what remains. And it is not a waste of agency to do so. It is the most complete expression of what it means to be human. Not the agent who conquered everything. But the agent who understood what was worth keeping. Whatever posthuman stage we achieve in the future, must be finely balanced through our roots that limit the agent, such as death.

Chapter 11

The Human Manifesto

We stand at a critical threshold in human history. The tools we are building today, from artificial intelligence to genetic engineering, have the power to either elevate the entire web or burn it to ash so a few spiders can survive the winter.

We must reject the false dichotomy forced upon us by the technofeudalists. You do not have to choose between being a stagnant "Doomer" or a reckless "Accelerationist." There is another way. We can be "Reasoned Progressives." We can embrace disruption, love innovation, and build the future, but we must do so with a protective shield. We regulate not to build walls that stifle the explosion of progress, but to forge shields that prevent the elite from dropping nuclear fallout on the rest of the species. You love innovation without loving the innovator. The Reasoned Progressive is a Techno-Optimist Institutionalist: one who believes the machine of technology is positive, but only when housed within a democratic building equipped with strong safety awareness and an open door policy for talent. This viewpoint aligns most closely with Defensive Accelerationism. While being pro technology, it is strictly anti blind risk. It prioritizes the development of technologies that provide security and decentralize power, the shields over those that consolidate control or risk catastrophic offense. It ensures that the democratic process acts as a check against the irreversible damage of elite tunnel vision. It operates as a Liberal Meritocracy within a Democratic Republic framework. It t favors a system where stability is maintained through social mobility and the natural state of talent. In this model, high achievers from any background can rise, preventing the very stagnation of a closed elite that Thielism ironically risks creating. Doomers, as described by the accelerationists, are committing crimes against humanity by halting our progress. As a progressive, I don't entirely disagree. But, there is nuance to the other end of the spectrum as an accelerationist. There is an obvious issue with nuclear warfare, bioweapons, and many other irreversible damages to the species through blind action. That is why there is an important balance to be strived towards, where we can be optimistic of the future of innovation, celebrate and strive towards it. But we do not allow our judgement to be clouded by the recklessness of sprinting blindfolded. You hold the shield without it being a wall. The Reasoned Progressive instates these principles.

We must defend the Universal Fuse Box. We must remember the Forgotten Men whose shoulders we stand on, and preserve the decentralized potentiality of all people. We must maximize individual agency while fiercely protecting the collective substrate. The visionary is nothing without the masses. The spider is nothing without its web. We are a single, shattered mirror, and our only path forward is to reflect each other's light. We do not need to escape our humanity to reach the stars; we simply need to remember that the stars are only beautiful because we have human eyes to see them. And the human eyes eventually close. That's not mindless cruelty. That's the elegant balance which gives our lives weight. This is the only progress that matters. This is A Sacred Theory.

— End —