Infiltration
Проникновение
Deception Takes Depth —
gets past defenses unnoticed
Moats it grows into
Infiltration takes a position inside a perimeter and holds nothing, because the perimeter still belongs to someone else. The foothold is not a moat: a host that notices can ban, patch or bundle its own version, and a rival can walk in through the same gap next quarter. What keeps the seats is what you wire to them afterwards — integrations into the host's workflows, switching costs in the stored data, habit in daily use, an installed base too large to rip out. Those are the moats; the entry is the door they were dug behind. Without them, the first IT audit is the end.
Summary
Infiltration enters where the defenses are not looking. An incumbent's gates — procurement, IT approval, a platform's review, a border — are built for rivals who come through the front. A free tool one employee installs, a checkbox inside another program's installer, code on a USB stick walk past them. It wins a foothold inside. Staying there is a separate question.
How it works
Every defense has a threshold, and the threshold is set for the threat the defender expects. Procurement reviews contracts above a sum; IT approves software that asks for a licence; a platform inspects apps that call its API in bulk; a customs officer opens the crate that looks like cargo. Infiltration comes in under every threshold at once: it is free, it needs one seat, and it looks harmless. One person installs it because it solves their problem today and nobody has to sign.
Then it grows from inside, where the defense is not pointed. The second seat is a colleague's invite, the tenth is a team, and by the time IT finds out there are hundreds of users who would complain if it were banned. The position is real. But nothing in the entry keeps it: the host can ban, patch, close the API or bundle its own copy, and it will, once it has noticed. The foothold is worth what is built on it before that.
Do you have it
- Your customers' IT departments learnt about you from their own users, after the seats were already in the hundreds.
- The first user at each account never asked permission: no contract, no card, no security questionnaire on the way in.
- You live inside somebody else's product — an extension, an add-on, a checkbox in an installer — and grow with its installs.
- Bans, blocked domains or a removed listing have already happened to you at least once, and users complained on your behalf.
How to dig it
- Make the first seat free, personal and useful alone, so one employee can adopt it without asking anyone.
- Build the spread into the product: every invite, shared link or exported file should carry the next install with it.
- Ride inside something already permitted — a marketplace listing, an installer, a browser — so the gate never sees a new vendor.
- Prepare for the day you are noticed: a security page, an admin console and a paid plan ready before IT asks.
- Wire the seats to the host's workflows fast; integrations and stored data are what survive the audit.
How it erodes
- The host notices and bans, blocks the domain, removes the listing or bundles its own copy into what everyone already pays for.
- The gap closes for everyone: the API is restricted, the installer checkbox is outlawed, the app store review gets stricter.
- IT standardises on one vendor and your hundreds of seats are migrated in a weekend, because nothing tied them to you.
- Your own entry becomes the incident — a security finding, a leak — and the gate you slipped past is rebuilt against you.
Solo, without capital
A single builder can infiltrate this quarter: a free extension, a plug-in in the incumbent's marketplace, a tool one employee can install without a card. That is the cheapest door into a large company there is. What they cannot do alone is survive the day IT notices — a security page, a compliance story and an enterprise plan take money and months. Build the integration that makes ripping you out painful before that day, or the seats leave as easily as they came.
In nature, in business
- Nature
- —
- Business
- Trojan horse, malware, smuggling
Cases
- Slack — Entered companies one team at a time on free workspaces; IT departments often learnt of it once hundreds of employees already depended on it.
- Google Chrome — Rode along inside other programs' installers as a pre-ticked box, so it was on the machine before the user had chosen a browser.
- Stuxnet — Crossed an air gap on USB sticks and ran inside an Iranian enrichment plant's control network for months before anyone noticed.
Combines with
- Low-friction — The door only stays open while entering is effortless; one licence key or card field puts you back at the front gate.
- Bundling — Packaged free with something people already want is the checkbox in the installer, the most literal way past the gate.
- Camouflage — Looking like a harmless utility is what keeps the threshold from tripping; infiltration is camouflage in motion.
- Usership — Seats that invite seats turn a foothold into a crowd, and a crowd inside the perimeter is what network effects are made of.
Fights with
- Prestige — Endorsement by authoritative sources is the front door — a signed contract, a vendor list — and a product built to skip the door skips that too.
- Transparency — Leading with visible inner workings means volunteering for the security review; infiltration is built to arrive before anyone asks for one.