The Fences are High. The Gates are Open.

# The Fences are High. The Gates are Open. The targeting table doesn't lie, even if the press releases do. Government has reclaimed the #2 spot out of 15 sectors this week, with 214 separate stories hitting the wire. Today alone, 44 new incidents were logged. People usually look at those numbers and see a "trend." I see a collection of delayed patches and a fundamental failure to understand how users actually interact with their screens. When a sector is this active, it isn't usually because the attackers have found a magic key. It's because the locks are old and the people holding the keys are tired. Take the reports coming out of India regarding the Kudankulam nuclear power plant. It is the largest nuclear plant in the country, and it just suffered a data breach. The headlines are screaming about "critical infrastructure," which is a term that usually triggers a reflexive panic. But look at the evidence. This wasn't a remote-code execution that flipped a switch in the reactor core. It was a data breach. Files were exposed. The industry loves to focus on the "boom" scenario, but the "leak" scenario is where the actual danger lives. If you steal the operational manuals, the network diagrams, and the personnel lists for a nuclear plant, you haven't caused a meltdown—yet. You've just spent a few weeks reading the map. The second-order effect here is the most grating part: every contractor, vendor, and third-party technician who touched that plant's infrastructure is now a liability. The attackers didn't just breach a plant; they breached the blueprints for how that plant is maintained. Once the documentation is in the wild, the physical security becomes a guessing game. Then we have the Sandworm situation in Ukraine. Russian military intelligence isn't using a sophisticated zero-day to get into government and military targets. They're using a fake CAPTCHA. It's an elegant bit of cruelty. They’ve realized that we’ve conditioned users to trust the "I am not a robot" checkbox more than they trust their own security training. Sandworm is simply leveraging a psychological reflex. It's not a vulnerability in the software; it's a vulnerability in the human habit of clicking things to make a prompt go away. I find it amusing that we spend billions on EDR and XDR solutions only to be undone by a checkbox that looks like it belongs on a 2012 blog. The US federal government is currently fighting a different kind of battle: the battle against its own calendar. CISA has ordered federal agencies to patch an Oracle flaw by this Saturday. The flaw is being actively exploited in the wild. Now, usually, a "critical" label is thrown around like confetti. I don't trust it. But when CISA sets a deadline of a few days for a patch, the label has been earned. The tension here is the gap between the "Fix Version" and the "Installed Version." In a federal environment, the distance between those two numbers can be measured in months. The attackers aren't guessing; they're simply timing their exploits to the known lag of bureaucratic change management. They know exactly how long it takes for a patch to move from a vendor's advisory to a federal server. The claim I'm making is this: the Government sector is not being targeted because of its political importance, but because it is the world's largest repository of legacy middleware. The evidence is in the variety of the attacks. You have the high-end persistence of Sandworm, the opportunistic data theft at Kudankulam, and the wide-net exploitation of Oracle. These aren't three different strategies. They are three different ways to exploit the same condition: the reliance on systems that were designed before the people currently managing them were born. The strongest objection to this is the "Cost of Doing Business" argument. Some analysts will tell you that governments are simply larger targets and that the volume of attacks is proportional to the size of the attack surface. They'll argue that a few data breaches and some phishing campaigns are inevitable for any entity of that scale. That's a lazy take. Volume is not the issue; the failure of the "perimeter" is. We aren't seeing a proportionate increase in attacks; we're seeing a failure to adapt the defense to the way attackers actually move. If the perimeter is "hardened"—and on paper, federal networks are—but the insiders are clicking fake CAPTCHAs and the Oracle servers are sitting on version numbers from two years ago, the hardening is a performance. It's security theater. Compare the Government sector's activity to the noise in the Technology sector, which is #1 with 326 stories. Tech gets hit because it's a goldmine for intellectual property. Government gets hit because it's a goldmine of trust. When you compromise a government credential, you don't just get data; you get the authority to move laterally into other sectors—defense, energy, healthcare. I keep coming back to the Oracle patch. The fact that CISA has to "order" agencies to patch by Saturday tells you everything you need to know about the state of federal vulnerability management. It's a reactive posture. We are patching the holes that the attackers have already found, rather than closing the gaps that the version numbers tell us are there. The White House is currently touting a new "AI cybersecurity clearinghouse" to coordinate defenses across critical infrastructure. It sounds impressive. It sounds like a solution. But I wonder if a clearinghouse can solve the CAPTCHA problem. I wonder if an AI-driven coordination center can force a sysadmin in a regional office to update an Oracle instance before Saturday. Probably not. You can't solve a version-number problem with a committee. The real question isn't whether we have the right tools, but whether we're willing to admit that our "secure" networks are essentially just old houses with new locks on the front door, while the back windows have been open for a decade. I'll be watching the Oracle patch compliance rates. If the Saturday deadline passes and the exploitation continues, we'll know the clearinghouse is just another piece of theater.