Per-target labor was the gate. Before the tooling, someone had to locate a target's public accounts, interests, colleagues and family, then correlate the pieces, work out who was related to whom, and decide what was usable in an attack [3]. That was the reason open-source intelligence gathering was aimed at high-profile and potentially high-value people and nobody else [2].
What the post does not carry is telemetry. No threat actor is named, no campaign is dated, no before-and-after reconnaissance cost is measured [9]. Exactly one figure in it is quantified: hundreds of UK under-18s reporting sextortion victimization this year, and "hundreds" is an order of magnitude rather than a count [6][10]. That makes this a capability argument about what is now cheap to attempt, not evidence that target selection has already moved down the org chart. A capability argument is grounds for changing a process; campaign data is what justifies unplanned spend.
Tiered awareness programs encode a scarcity assumption. The personalized pretext is expensive, so you rehearse it with the twenty people worth an attacker's afternoon and give everyone else generic guidance about odd phrasing and urgency. Both halves erode against what ESET describes. The model drafts the script, including for operators who do not write the target's language well, which is the tell most generic training still teaches [5]. The personalization inputs are already public: a child's school, a posted holiday, the workplace itself, gathered at scale [11].
The asymmetry is directional. Reconnaissance cost per target falls with tooling, while protective coverage is bought per person, so a program that stops at senior staff gets relatively more expensive to extend at the moment the attacker's shortlist stops being short.
For a corporate defender the operative paragraph in the post is the least dramatic one. Hybrid work has fused the two identities, with personal devices and home addresses used for corporate activity, and joining personal social accounts to professional ones is trivial for a model, so personal detail becomes the raw material for harvesting work credentials [7]. The deepfaked ransom calls and the sextortion cases are real harm to real people and they change no control a security team owns [6]. What changes controls is that the call reaching your helpdesk now arrives with accurate personal detail attached, which means verification has to hold when the caller's story checks out. ESET also puts vulnerability exploitation and basic malware generation on the same cost curve [8].
