1. Cybercrime Foundations and Threat Landscape

Introduction and Context

Cybercrime is not simply crime conducted through computers. It is a broad field involving the use of digital systems, networks, data, online identities, and connected devices to commit, facilitate, conceal, or investigate unlawful acts. Digital technology may be the target of an offence, the instrument used to commit it, the environment in which it occurs, or a source of evidence. This distinction is important because the same incident may involve several dimensions at once. A ransomware attack, for example, may target information systems, use stolen credentials as an entry mechanism, extort an organisation financially, and generate electronic evidence distributed across endpoints, cloud services, and cryptocurrency transactions.

The study of cybercrime therefore requires more than technical knowledge. It draws on criminal law, criminology, information security, digital forensics, psychology, economics, organisational governance, and international cooperation. Cybercrime investigators must understand both how an offence operates and why it occurs. Security managers must assess not only vulnerabilities but also the incentives, capabilities, and relationships that shape a threat. Policymakers must balance enforcement, privacy, freedom of expression, national security, and the rights of victims and accused persons.

A useful foundation begins by distinguishing the threat landscape from the individual attack. The threat landscape is the wider environment of offenders, targets, technologies, services, motivations, vulnerabilities, markets, regulations, and geopolitical conditions in which cybercrime develops. It changes as organisations adopt cloud computing, mobile platforms, artificial intelligence, digital payments, and operational technology. It also changes when law enforcement disrupts criminal infrastructure or when offenders shift to new business models.

Learning Objectives

By the end of this chapter, students should be able to:

1. Define cybercrime and distinguish its principal forms.

2. Explain important terminology used in cybercrime investigation and incident handling.

3. Analyse offender motivations, capabilities, roles, and criminal ecosystems.

4. Apply victimology to the assessment of individual, organisational, and societal risk.

5. Explain major categories including fraud, ransomware, identity crime, cyberstalking, intellectual-property theft, insider threats, and state-sponsored activity.

6. Use a structured framework to interpret a cybercrime incident.

7. Evaluate legal, ethical, governance, and professional issues associated with cybercrime.

8. Identify emerging trends and appropriate organisational practices.

Defining Cybercrime: A Spectrum Rather Than a Single Offence

There is no universally accepted definition of cybercrime. A narrow definition refers to offences in which a computer system or network is the direct target, such as unauthorised access, malware deployment, or denial-of-service attacks. A broader definition includes traditional offences transformed by digital technologies, such as online fraud, harassment, extortion, and trafficking in unlawful material.

A practical classification is as follows:

• Cyber-dependent crime cannot be committed without information and communication technologies. Examples include malware attacks, unauthorised system intrusion, distributed denial of service, and data destruction.
• Cyber-enabled crime existed before computers but has been expanded in scale, speed, reach, or concealment through digital technology. Examples include fraud, identity theft, stalking, intellectual-property infringement, and money laundering.
• Technology-facilitated crime uses digital tools as an accessory to a wider offence. Digital communications, location data, online marketplaces, and social media may support crimes that also involve physical-world conduct.

This classification is analytically useful but not absolute. An incident may move across categories as it develops. For example, an offender may use phishing, a cyber-enabled deception, to obtain credentials, conduct cyber-dependent intrusion, steal personal data, and commit conventional financial fraud.

The term cyber incident is wider than cybercrime. An incident may result from accident, system failure, negligence, malicious activity, or a natural event. A cybercrime requires an unlawful or criminally relevant act, although the final legal classification may depend on jurisdiction, evidence, intent, and prosecutorial decisions. Similarly, a security event is an observable occurrence in a system, while an incident is an event assessed as having actual or potential adverse impact.

A Vocabulary for Interpreting Cybercrime

Several concepts are central to professional analysis. The attack surface is the collection of points through which a system, organisation, or person can be reached or influenced. It includes internet-facing services, identities, applications, suppliers, endpoints, cloud resources, and human processes. Vulnerability refers to a weakness that can be exploited, whereas a threat is a potential cause of harm. Risk combines the possibility of an adverse event with its consequences; it is not synonymous with vulnerability.

An exploit is a method, code, or technique that takes advantage of a vulnerability. Malware is malicious software, including ransomware, spyware, trojans, worms, and destructive code. Phishing uses deceptive communications to induce a person to disclose information, open a file, transfer funds, or perform another action. Credential theft concerns the acquisition of authentication information, while account takeover is the unauthorised control of an account.

A botnet is a collection of compromised devices controlled through an administrative mechanism. A command-and-control channel allows an attacker to communicate with compromised systems. The dark web refers to intentionally hidden internet services accessible through specialised technologies; it is used for both legitimate privacy purposes and criminal activity. A criminal marketplace may sell stolen credentials, malware, access to compromised systems, or laundering services.

The cyber kill chain is a model that describes stages such as reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. It helps defenders identify opportunities for prevention and detection, although real attacks do not always follow a linear sequence. The MITRE ATT&CK framework provides a knowledge base of adversary tactics and techniques based on observed behaviours. It is valuable for detection engineering, threat hunting, and incident analysis, but it is not a complete incident-response procedure.

Why Offenders Commit Cybercrime

Motivation is a central element of criminological analysis. Financial gain is prominent in fraud, ransomware, business email compromise, credential theft, and the sale of stolen data. Financially motivated groups often behave like enterprises: they divide labour, specialise in access brokerage, negotiate with victims, outsource technical functions, and reinvest proceeds.

Other motives include political or ideological objectives, espionage, revenge, status, curiosity, coercion, personal relationships, and the pursuit of notoriety. Hacktivists may attack organisations to publicise a political cause. State-sponsored groups may seek intelligence, strategic advantage, influence, or disruption. Insiders may act for financial reward, grievance, loyalty to another organisation, coercion, or a desire to demonstrate capability.

Motivation alone does not determine capability. A technically skilled offender may lack a clear objective, while a highly motivated person may rely on publicly available tools or criminal services. Opportunity also matters. Weak authentication, excessive privileges, poor patching, exposed services, inadequate monitoring, and predictable human behaviour reduce the effort required for an attack.

The rational-choice perspective suggests that offenders weigh expected benefit, effort, risk of detection, and possible punishment, although decisions are often distorted by emotion, ideology, group pressure, or overconfidence. Routine activity theory provides another useful lens: crime becomes more likely when a motivated offender encounters a suitable target in the absence of effective guardianship. In digital environments, guardianship includes identity controls, monitoring, secure design, trained personnel, resilient backups, reporting mechanisms, and law enforcement capability.

The Cybercrime Ecosystem

Cybercrime is increasingly organised through ecosystems rather than isolated individuals. A single operation may involve an initial-access broker, a malware developer, a phishing specialist, a credential seller, a money mule, a negotiator, a data broker, and a laundering service. The crime-as-a-service model allows participants to purchase capabilities without mastering every technical stage. Ransomware affiliates, for example, may obtain access from another criminal group and then conduct the intrusion, while the malware developer receives a share of the proceeds.

The ecosystem includes legitimate technologies used unlawfully, such as cloud hosting, encrypted communications, remote administration tools, cryptocurrency exchanges, and online advertising. It also includes criminal infrastructure, compromised servers, bulletproof hosting, illicit forums, and informal trust mechanisms. Reputation, escrow arrangements, guarantees, and dispute resolution may be used within underground markets, demonstrating that cybercrime can possess commercial and organisational characteristics.

The ecosystem perspective has important investigative implications. Removing one piece of malware may not eliminate the operation if access, infrastructure, personnel, and financial channels remain available. Effective disruption may require simultaneous action against infrastructure, accounts, payment mechanisms, suppliers, and facilitators. It also shows why public-private cooperation is essential: evidence and control are distributed across service providers, banks, telecommunications companies, technology vendors, and victims in different jurisdictions.

Victimology and the Distribution of Harm

Victimology examines who is harmed, how victimisation occurs, and how victims respond. Cybercrime victims include individuals, businesses, hospitals, schools, governments, charities, and critical-infrastructure operators. A victim may be selected deliberately because of its value or targeted opportunistically because it presents an exposed service or reused password.

Victim characteristics do not excuse offending. However, understanding exposure helps organisations reduce risk without blaming victims. Relevant factors include digital dependence, public visibility, financial capacity, technical maturity, data sensitivity, supplier relationships, workforce composition, and the availability of recovery resources. Small organisations may have limited security staff, while large organisations may possess complex attack surfaces and fragmented accountability.

Harm is multidimensional. Direct losses may include stolen funds, ransom payments, restoration costs, legal expenses, and operational interruption. Indirect effects include reputational damage, loss of trust, regulatory action, psychological distress, safety risks, and harm to third parties. In identity crime, victims may experience long-term difficulty correcting records and proving that fraudulent activity was not their own. In cyberstalking, the harm may include fear, isolation, professional consequences, and physical danger.

Victimology also informs incident handling. Victims need accurate information, preservation of evidence, access to support, and communication that avoids shame or speculation. Reporting barriers—such as fear of reputational damage, uncertainty about jurisdiction, or concern that authorities will not act—can create underreporting and distort available statistics.

Major Categories of Cybercrime

Fraud and Deception

Online fraud uses deception to obtain money, property, services, credentials, or unauthorised transactions. Phishing, business email compromise, investment scams, romance scams, marketplace fraud, and payment diversion are common forms. Business email compromise often relies less on sophisticated malware than on social engineering, impersonation, knowledge of organisational processes, and urgency.

Fraud prevention requires controls at several levels: strong payment-verification procedures, separation of duties, identity assurance, transaction monitoring, staff awareness, and rapid reporting to financial institutions. Training alone is insufficient when procedures encourage rushed decisions or when senior communications are treated as automatically trustworthy.

Ransomware and Extortion

Ransomware restricts access to data or systems, usually through encryption or destruction, and demands payment. Modern operations may add double extortion, threatening to publish stolen data, and may target customers, employees, or business partners. Some groups use triple extortion by adding denial-of-service pressure or direct contact with affected stakeholders.

The appropriate response is not limited to deciding whether to pay. Organisations must determine the scope of compromise, isolate affected systems, preserve evidence, assess restoration options, notify relevant authorities and regulators, and protect individuals whose data may be exposed. Payment does not guarantee deletion of data, recovery of systems, or future non-revictimisation. It may also create legal, ethical, and sanctions-related concerns.

Identity Crime

Identity crime involves the misuse of personal, financial, professional, or organisational identity information. It includes account takeover, synthetic identity fraud, impersonation, fraudulent applications, and misuse of digital credentials. Identity attacks increasingly exploit authentication fatigue, password reuse, information leaked in previous breaches, and weaknesses in account-recovery processes.

The most effective response combines multifactor authentication, risk-based verification, least privilege, secure recovery procedures, anomaly detection, and timely notification. Organisations should minimise data collection and retention because information retained unnecessarily becomes an attractive target.

Cyberstalking and Technology-Facilitated Abuse

Cyberstalking involves repeated digital conduct intended to monitor, intimidate, threaten, control, or harass a person. It may include unwanted messages, impersonation, doxxing, spyware, location tracking, monitoring of accounts, or publication of private information. Technology-facilitated abuse often occurs alongside domestic violence and may create serious physical safety risks.

Responses must be victim-centred. Evidence should be preserved without increasing danger, accounts and devices should be assessed for compromise, and safety planning should involve appropriate specialist services. Simply advising a victim to confront or block an abuser may be unsafe if the abuser has access to accounts, devices, or physical locations.

Intellectual-Property Theft and Digital Piracy

Intellectual-property crime includes theft of trade secrets, source code, research data, designs, copyrighted works, and confidential business information. Competitors, insiders, criminal groups, and state-linked actors may seek such material. The commercial value of stolen information can be difficult to calculate, particularly when it affects future innovation or competitive position.

Protection requires classification of information, access governance, data-loss prevention, monitoring of unusual downloads, secure collaboration, contractual controls, and a culture that treats intellectual property as an information-security asset.

Insider Threats

An insider threat arises when a person with authorised access uses that access in a harmful or unauthorised manner. Insiders may be malicious, negligent, compromised, or coerced. Examples include deliberate data theft, accidental disclosure, unauthorised system changes, misuse of privileged accounts, and the installation of unauthorised software.

Insider-risk programmes must balance security with employee privacy and trust. Effective measures include least privilege, separation of duties, privileged-access management, audit trails, behavioural indicators interpreted carefully, secure offboarding, and clear reporting channels. Automated monitoring should not be treated as proof of guilt; alerts require contextual investigation and procedural fairness.

State-Sponsored Cyber Activity

State-sponsored activity includes espionage, influence operations, preparation of the battlefield, disruption, sabotage, and theft of strategic information. Attribution is difficult because attackers may use proxies, false flags, compromised infrastructure, or criminal groups. Technical indicators can identify tools and infrastructure but do not, by themselves, establish political responsibility.

Organisations should focus on resilience rather than relying solely on attribution. Important measures include threat-informed detection, segmentation, identity protection, supply-chain assurance, continuity planning, intelligence sharing, and coordination with government authorities. State activity may coexist with financially motivated crime, making categories difficult to separate.

A Framework for Analysing a Cybercrime Incident

A structured analysis can be organised around six questions:

1. What happened? Establish observable facts, affected systems, timelines, and immediate consequences.

2. Who or what was targeted? Identify victims, assets, data, services, and dependencies.

3. How was access obtained and maintained? Examine social engineering, vulnerabilities, credentials, insiders, suppliers, and persistence mechanisms.

4. What was the offender seeking? Assess financial, political, personal, strategic, or destructive objectives.

5. What evidence exists? Identify devices, logs, messages, cloud records, financial transactions, malware, and witness accounts, while preserving integrity and chain of custody.

6. What decisions are required? Consider containment, recovery, reporting, notification, communication, legal advice, and prevention.

This framework connects criminological interpretation with incident response. It also prevents premature conclusions. Investigators should distinguish confirmed facts, reasonable inferences, hypotheses, and unknowns. A professional report should state confidence levels and identify evidence needed to test competing explanations.

Illustrative Case Study: The Meridian Health Ransomware Incident

Background

Meridian Health, a fictional regional healthcare provider, operates hospitals, outpatient clinics, laboratories, and a patient portal. It depends on electronic health records, connected diagnostic equipment, email, and third-party billing services. Its environment includes legacy systems that cannot be rapidly replaced.

Situation and Problem

On a Monday morning, staff discover that shared files and several clinical systems are inaccessible. A ransom note claims that data has been copied and will be published. The initial technical review finds that an employee’s cloud credentials were used from an unusual location several days earlier. The organisation must maintain patient safety, investigate the intrusion, decide whether to notify authorities and regulators, and communicate with patients without confirming unverified claims.

Analysis

The incident combines identity crime, unauthorised access, ransomware, extortion, and possible data theft. The healthcare context increases potential harm because service interruption can affect clinical decisions and emergency care. The exposed attack surface includes cloud identity, remote access, legacy systems, suppliers, and privileged accounts.

Investigators preserve authentication logs, endpoint images, email records, cloud audit data, ransom communications, and relevant network traffic. They establish a timeline showing credential theft through a targeted phishing message, subsequent access to a cloud account, movement toward administrative systems, data staging, and encryption. The evidence supports the intrusion sequence, but attribution remains uncertain.

Approach and Strategy

The incident team first protects patient safety and isolates affected systems without destroying volatile evidence. It activates downtime procedures, disables compromised accounts, resets credentials through a controlled process, blocks known malicious indicators, and segments critical clinical networks. Legal, privacy, clinical, communications, and executive representatives join the response team.

The organisation contacts law enforcement, insurers, relevant technology providers, and specialist responders. It evaluates restoration from offline backups and avoids assuming that payment would resolve the underlying compromise. Notifications are based on verified facts and legal requirements. Patients receive practical guidance about service availability and possible data exposure rather than unsupported assurances.

Outcome

Meridian restores priority services from verified backups, identifies the compromised identity pathway, and improves multifactor authentication, privileged-access controls, network segmentation, backup testing, supplier oversight, and phishing-resistant authentication for high-risk users. A post-incident review finds that technical controls failed to compensate for excessive privilege and weak recovery procedures.

Learning Points

The case demonstrates that ransomware is an organisational crisis rather than merely a malware problem. Victim safety, evidence preservation, continuity, communication, legal duties, and technical recovery must be managed together. It also illustrates why an incident can involve several crime categories and why attribution should not be confused with response effectiveness.

Challenges, Ethical Issues, and Professional Responsibilities

Cybercrime investigations face jurisdictional conflict, volatile evidence, encryption, cloud complexity, attribution uncertainty, limited resources, and underreporting. Evidence may be stored in several countries and controlled by private providers. Investigators must follow lawful authority, documented procedures, proportionality, and rules governing search, seizure, disclosure, and privacy.

Ethically, professionals should minimise unnecessary collection, protect confidential information, avoid victim blaming, and disclose material risks accurately. Security researchers must consider authorisation, potential harm, responsible disclosure, and the boundary between testing and unauthorised access. Organisations should not conceal material incidents merely to protect reputation, nor should they publish speculative attribution that may endanger people or disrupt legitimate investigations.

Common mistakes include treating every alert as proof of compromise, destroying evidence during hurried remediation, relying on a single backup, paying without understanding legal implications, assuming that multifactor authentication eliminates identity risk, and communicating either too little or with unjustified certainty. Another frequent error is treating compliance as equivalent to security. Compliance establishes requirements, but effective protection depends on risk assessment, implementation, testing, and organisational accountability.

Technology, Automation, and Emerging Developments

Artificial intelligence is being used defensively for anomaly detection, malware classification, fraud analysis, security operations, and incident triage. Offenders may also use automation and generative tools to produce persuasive messages, scale reconnaissance, adapt malware, and personalise deception. AI outputs can be inaccurate, biased, or difficult to explain; human review, secure data handling, testing, and governance remain necessary.

The expansion of cloud services, application programming interfaces, connected devices, operational technology, digital currencies, deepfakes, and software supply chains is reshaping the threat landscape. Deepfake audio or video may support impersonation and financial fraud. Supply-chain compromise can provide access through trusted software or service providers. Criminal use of automation increases scale, while defensive automation increases the speed of detection and containment.

Best Practices for Organisations

A mature cybercrime-resilience programme should:

• maintain an accurate inventory of systems, identities, data, suppliers, and dependencies;
• prioritise risk using business impact rather than technical severity alone;
• apply least privilege, strong authentication, segmentation, secure configuration, and timely patching;
• protect and test offline or otherwise resilient backups;
• monitor identity, endpoint, cloud, network, and financial activity in context;
• establish rehearsed incident-response, crisis-communication, and continuity plans;
• preserve evidence and define escalation, reporting, and notification responsibilities;
• train staff through realistic, role-specific exercises rather than awareness slogans alone;
• assess suppliers and require appropriate security and notification controls; and
• conduct post-incident reviews that address governance and process weaknesses, not only technical indicators.

Chapter Summary

Cybercrime includes cyber-dependent offences, cyber-enabled offences, and technology-facilitated criminal conduct. Understanding it requires attention to terminology, offender motivation, opportunity, victimology, criminal ecosystems, and the interaction between technology and law. Major categories include fraud, ransomware, identity crime, cyberstalking, intellectual-property theft, insider threats, and state-sponsored activity. These categories often overlap within a single incident.

The threat landscape is shaped by access brokers, criminal marketplaces, crime-as-a-service, cloud platforms, human behaviour, suppliers, and geopolitical interests. A structured incident analysis should establish what happened, identify targets and access methods, examine objectives and evidence, and guide containment, recovery, reporting, and prevention. Effective practice combines technical controls with governance, ethical conduct, legal compliance, victim support, resilience, and informed use of automation. The chapter provides the foundation for later study of digital evidence, forensic methods, incident response, and investigative decision-making.

Key Terms

Cybercrime: Unlawful conduct involving digital systems, networks, data, or technology.

Cyber-dependent crime: Crime that cannot be committed without information technology.

Cyber-enabled crime: Traditional crime expanded in scale or reach through digital technology.

Attack surface: The set of points through which a system or organisation may be attacked.

Vulnerability: A weakness that can be exploited to cause harm.

Threat: A potential cause of an unwanted security event.

Risk: The possibility and impact of adverse consequences arising from a threat.

Exploit: A method or code that takes advantage of a vulnerability.

Phishing: Deceptive communication intended to induce an unsafe action or disclosure.

Malware: Software designed to perform unauthorised or harmful activities.

Ransomware: Malware or an associated operation that denies access and demands payment.

Identity crime: Misuse of personal, financial, or organisational identity information.

Account takeover: Unauthorised control of a legitimate account.

Insider threat: Harmful conduct by a person with authorised access.

Cyberstalking: Repeated digital conduct used to monitor, threaten, control, or harass.

Crime-as-a-service: Provision of criminal tools or capabilities through an organised service model.

Victimology: The study of victims, victimisation, harm, and responses to crime.

Threat landscape: The wider environment of threats, actors, targets, technologies, and conditions.

Attribution: The process of assessing responsibility for a cyber operation.

Double extortion: Ransomware pressure combining system disruption with threats to publish stolen data.

Review Questions

Short Answer Questions

1. Distinguish cyber-dependent crime from cyber-enabled crime.

2. What is the difference between a vulnerability, a threat, and a risk?

3. Explain why cybercrime is often organised as an ecosystem.

4. Identify two forms of harm suffered by victims of identity crime.

5. What is meant by double extortion?

Long Answer Questions

1. Explain the principal motivations of cyber offenders and relate them to rational-choice and routine activity perspectives.

2. Discuss how victimology can improve cybercrime prevention and incident handling.

3. Analyse fraud, ransomware, and identity crime as overlapping categories rather than isolated offences.

4. Explain the organisational, ethical, and legal challenges involved in responding to a ransomware incident.

5. Discuss the significance of state-sponsored cyber activity and the difficulties of attribution.

Analytical / Application Questions

1. A finance employee receives an urgent payment request from a senior executive’s apparently genuine account. Using the chapter’s concepts, analyse the likely crime, relevant attack surface, and preventive controls.

2. A university discovers that a departing researcher copied confidential research data to a personal cloud account. Assess whether this represents negligence, malicious insider activity, or both, and propose an investigation approach.

3. A hospital’s systems are encrypted after credentials were stolen through phishing. Design an initial response that balances patient safety, evidence preservation, continuity, communication, and legal obligations.

22. Multiple Choice Questions with Answers

Question 1

Which classification best describes an offence that uses phishing to steal credentials, intrudes into a network, and then commits financial fraud?

A. Only cyber-dependent crime

B. Only conventional crime

C. A combination of cyber-enabled and cyber-dependent conduct

D. A non-criminal security event

Correct Answer: C. A combination of cyber-enabled and cyber-dependent conduct

Question 2

Which factor most directly represents effective guardianship under routine activity theory?

A. An offender’s ideological motivation

B. Multifactor authentication and continuous monitoring

C. The market value of stolen data

D. The availability of anonymous communication

Correct Answer: B. Multifactor authentication and continuous monitoring

Question 3

Why is the ecosystem perspective useful in analysing ransomware?

A. It proves that one individual always controls the entire attack

B. It shows how specialised actors and services may share different stages of the operation

C. It eliminates the need to preserve evidence

D. It establishes attribution from malware alone

Correct Answer: B. It shows how specialised actors and services may share different stages of the operation

Question 4

Which response is most appropriate when cyberstalking may be connected to domestic abuse?

A. Advise the victim to confront the suspected offender publicly

B. Delete all messages immediately

C. Use victim-centred safety planning and preserve evidence carefully

D. Assume that blocking the account resolves the risk

Correct Answer: C. Use victim-centred safety planning and preserve evidence carefully

Question 5

What is the principal analytical danger of treating a technical indicator as proof of state attribution?

A. Technical indicators cannot be collected from networks

B. Attackers may use proxies, compromised infrastructure, or false flags

C. States never conduct cyber operations

D. Attribution is unrelated to evidence

Correct Answer: B. Attackers may use proxies, compromised infrastructure, or false flags

Question 6

An organisation pays a ransom but fails to investigate the initial compromise. What is the most significant risk?

A. The organisation will automatically avoid regulatory duties

B. The attacker may retain access and conduct further activity

C. Backups will become more reliable

D. The incident will necessarily become a state-sponsored operation

Correct Answer: B. The attacker may retain access and conduct further activity

Question 7

Which example most clearly represents an insider threat?

A. A random internet scan of a public server

B. An employee deliberately copying confidential designs before joining a competitor

C. A natural power failure affecting a data centre

D. A customer forgetting a password

Correct Answer: B. An employee deliberately copying confidential designs before joining a competitor

Question 8

Why should an incident report distinguish confirmed facts from hypotheses?

A. To avoid documenting any uncertainty

B. To support disciplined decision-making and prevent premature conclusions

C. To replace evidence with opinions

D. To ensure that attribution is always public

Correct Answer: B. To support disciplined decision-making and prevent premature conclusions

Question 9

Which control most directly reduces the consequences of ransomware?

A. A public social-media account

B. Untested backups connected permanently to production systems

C. Verified, resilient backups combined with segmentation

D. A policy prohibiting all remote work

Correct Answer: C. Verified, resilient backups combined with segmentation

Question 10

Which statement best describes the responsible use of artificial intelligence in cybercrime defence?

A. AI outputs should always replace human investigation

B. AI is useful for detection and triage but requires governance, testing, and human review

C. AI cannot be used by offenders

D. AI eliminates the need for incident-response plans

Correct Answer: B. AI is useful for detection and triage but requires governance, testing, and human review