Women in cyber and tech have been comparing notes. Across years of conferences, events, and award galas, a pattern has emerged: a predictable, repeatable script deployed by male perpetrators to harass women at industry events, writes writes Moona Ederveen, founder and advisor at IT consultancy Resilia Connect, faculty at University of Cambridge PACE, international speaker (NATO Maritime Cyber Security Conference, Davos).
It is effective because it is engineered to exploit the very qualities professionals rely on: decency, politeness, and respect for seniority. Written down, the tactics are identifiable. In the moment, they are designed not to be. By exposing the script, my hope is that once seen, readers can detect it in the moment and invoke the defences listed.
In cyber security, kill chains map progression through attack phases, TTPs describe methodology, and IOCs provide the signs of compromise. So, this is how I expose the predatorโs playbook. What makes these tactics particularly insidious is that they are deployed by individuals who appear to be exactly the kind of people you would trust: senior figures, well-regarded professionals, respected speakers. That surface respectability is not incidental; it is a core component of the exploit, used specifically to lower defences and establish plausible deniability.
The Harassment Kill Chain
Attackers must progress systematically through kill chain phases to lower defences, test boundaries, and eliminate mitigations. Read below how to break the chain at any point to disrupt the entire attack.
Phase 1: Initial Contact ย โ ย Phase 2: Grooming ย โ ย Phase 3: Boundary Testing ย โ ย Phase 4: Target Isolation ย โ ย Phase 5: Exploitation
TTPs and IOCs by Phase
Monitor for TTPs and IOCs in real time during each phase.
Phase 1: Initial Contact
TTPs: Singling out a target on arrival with disproportionate warmth: an immediate drink offer, aggressively securing one-to-one time before she has oriented herself or found her colleagues.
IOC: You are separated from your group early and feel an unexplained, mild sense of social obligation to someone you have only just met.
Why it works: Warmth from a senior figure feels flattering. Decency makes this an exploitrequiring โreciprocityโ.
Phase 2: Grooming
TTPs: Sharing deeply personal disclosures early, framed as rare confidences. Persistent flattery, intellectual or otherwise: โI never meet anyone I can actually talk to.โ Invoking holiday or Vegas-mode framing to treat the event as a personal night out: ordering strong drinks early or repeatedly, blurring the professional context of the evening.
IOCs: Conversation feels oddly intimate for a first meeting. You find yourself drinking more than you normally would or feel comfortable with. The professional frame of the evening is quietly dissolving.
Why it works: Flattery overrides intuition. The โholiday-modeโ redefines the norms of the situation, and therefore what objecting to them would look like.
Phase 3: Boundary Testing
TTPs: Sharing photographs or videos that are physically revealing or suggestive, masked as fitness or holiday content. Talking over expressed reluctance or hesitation.
IOCs: Your reaction is being watched. Discomfort is neither acknowledged nor apologised for. A polite or neutral response is treated as permission to continue.
Why it works: Social politeness makes it nearly impossible to object loudly to a senior peer. Silence reads as compliance, and compliance is logged.
Phase 4: Target Isolation
TTPs: Systematically steering toward quieter, unmonitored spaces. Deflecting any suggestion to include colleagues. Responding to hesitation with pre-loaded reassurances: โItโs just friends having a drink.โ Refusing to accept a stated refusal, reframing it and applying pressure until the target exhausts her resistance.
IOCs: You find yourself steered away from crowds and witnesses. Every objection is met with a swift reassurance. You feel โunheardโ.
Why it works: A stated โnoโ is treated as an opening position. Reassurances make pushing back feel paranoid rather than reasonable. Each step sounds plausible in isolation. The pattern only becomes visible in aggregate.
Phase 5: Exploitation
TTPs: On reaching a private space, the psychological context is subtly shifted from professional to personal by altering the environment e.g. dimming lights, turning on music. Continuing alcohol pressure, fetching drinks from unobserved locations, unsolicited denial that a drink has been tampered with. Initiating physical contact framed as accidental or casual.
IOCs: You may feel uncomfortable or scared. Late-night or early-morning contact after you have ended the evening. The same individual seeking you out at the next conference.
Why it works: Environmental alterations reveal pre-planning. Each act is individually deniable but collectively asserts dominance and tests compliance. Trust your gut instinct.
The Honeypot Shift
Falling victim to this script is not a failure of intelligence. It is engineered to exploit professional decency. By naming the script and recognising these indicators, the power dynamic flips. A perpetrator who believes he is operating in the shadows may be walking into a honeypot if they do the following โ all while generating a forensic trail:
Defensive measures
Preparedness is key:
A Call to Action
Individual vigilance is a stopgap; systemic community security requires an industry-wide patch. For conference organisers: implement a Code of Conduct. Respond with urgency. Ensure no one ever feels that coming forward was a mistake.
For allies: โMind if I join you?โ can break the isolation chain. For women: share this threat intelligence. The playbook loses its power the moment the community refuses to let it run. And if it happens to you: you did not cause it, you did not invite it. The fault lies entirely with the person following the script.
