Attack path — the adversary's kill chain
The 13 HACT tactics laid out as the attacker's operational sequence, from reconnaissance to impact. This is the surface an operation traverses. Click any step to open its detail. A hunting (short) operation may short-circuit from TA-H001 straight to exploitation; a farming (long) operation runs the full chain over weeks.
Preparation & access
Relationship & exploitation
Expansion, collection & impact
Hunting — one-shot, minimal contact (e.g. phishing): TA-H001 → TA-H006.
Farming — weeks/months of rapport before exploitation: full 13-tactic chain.
Debrief — after extraction the attacker returns the target to a positive emotional state to erase suspicion.
Defensive decision tree — the 60-second emergency memento
A logigramme condensing the whole HACT defensive doctrine into a decision that can be run in under a minute when facing any unusual request. Built from the book's five reflexes: urgency is a signal, an unusual channel is what must be verified, always call back on the known line, two indicators mean suspend, and report even if you already complied.