A swarm is not a smarter hacker. It is many ordinary agents sharing a goal: map a network, find a weak account, keep going when one of them gets stuck. That is the story behind this week’s briefing on agent activity aimed at government networks in Taiwan — and the reason it belongs in a series for people who do not speak packet.
Classic intrusion looks like a person picking a lock. A swarm looks like weather. One agent reads a public site. Another tries a password reset. A third writes a convincing email in the local language. None of those steps is science fiction. Together they compress the time between “we think someone is looking” and “someone is already inside.”
Speed is the weapon. The swarm does not need to be brilliant if it never sleeps.
Why this is a people problem
The first person who sees a swarm is rarely a hunter in a dark room. It is a clerk, a help-desk analyst, a regional admin who notices ten odd logins before lunch. If your culture treats that report as noise, the swarm gets a free afternoon.
- Tell staff that a burst of “almost right” emails is an incident, not a nuisance.
- Rate-limit password resets and MFA fatigue. Swarms love polite systems.
- Watch for many small tools used in parallel, not one loud malware drop.
- Have a phone tree that does not depend on the same email the swarm is already reading.
Watch the episode if you want the walkthrough. Then ask one question in your next standup: if twenty polite agents tried us at once, who would notice in the first hour — and what would they be allowed to shut off?