How Many Hackers Are There, Really?

By The Most Secure Man Alive | WISECLICK Ambassador

There is a country I'd like to take you to. You won't find it on a map. It has no flag, no anthem, no border you could stand at — and yet, by one careful reckoning, its economy is the third-largest on Earth. Larger than Germany. Larger than Japan. Behind only the United States and China.

The researchers who measure such things have even given it a name. They call it Cyber Rica. Last year they put its annual takings at around ten and a half trillion US dollars — a figure that makes the entire global trade in illegal drugs look like a weekend market stall.

I've spent a good deal of my life studying the citizens of this country, because they are forever trying to wander into businesses like yours. And the single most useful thing I have learned is that almost nothing you imagine about them is true. So allow me to introduce you properly. It's a more interesting place than the films suggest — and, this is the part that matters, a far less frightening one.

Who actually lives there

You're picturing him already. The hood. The dark room. The cascade of green code. A lone genius, brilliant and nocturnal, who has selected your business out of all the businesses in the world.

He is very nearly fictional.

In 2022, the internal messages of one of the planet's most successful cyber gangs — a Russian outfit called Conti — spilled out onto the internet. Researchers sat down and read the lot, including a team here in Australia, at Deakin University. What they found was not a den of geniuses. It was an office.

Conti had around four hundred and fifty staff. It had a human resources department. It had a hiring process, with interviews, and someone whose actual job was to chase up the candidates who'd gone quiet. It paid salaries — fortnightly, fairly modest — with the occasional bonus and a genuine employee of the month. Coders, testers, sysadmins, middle managers, and all the office politics to match: people grumbling about pay, about the boss, about the new hires.

Some of the staff, it later emerged, believed they were working for a perfectly ordinary software company. They simply turned up, did their tasks, and collected a wage. The banality is the whole point.

And here is my favourite detail, because it tells you everything. The gang kept losing track of its own equipment. The leaked messages are littered with staff chasing overdue invoices for servers, and fretting that the kitty for the VPN subscriptions and — I promise you this is true — the antivirus licences had run dry. The most feared cyber gang on Earth could not reliably keep its own software subscriptions paid.

I have seen tidier operations running a suburban café. This is not the criminal mastermind of the popular imagination. It is a slightly disorganised mid-sized business, staffed by bored employees, that happens to do something terrible for a living.

So — how many are there?

Now to your question, the one everyone arrives at eventually. How many?

For a long while the honest answer was rather reassuring, once you understood it. The people who could actually do the clever part — write a genuinely new attack from nothing — were never many. A few thousand, worldwide, with real skill. Everyone else was renting.

Because Cyber Rica runs, above all, on franchises. The skilled few build the weapons, then lease them out — ransomware you can hire by the job, help desk and instruction manual included — to a vast layer of unskilled others who simply point the rented thing and pull the trigger. The trade has a name for these foot soldiers, and it isn't flattering: script kiddies. People who could not write the code if their liberty depended on it, running someone else's.

Which meant, for years, that the genuinely dangerous population was small, and busy, and aimed almost entirely at targets far grander than you. The genius was real. He was also extremely unlikely to have heard of you.

That was the comfortable answer. I'm afraid it has just changed.

The borders just opened

Here is the genuinely new thing — the story the people who watch this for a living are writing about as we speak.

The one barrier that kept Cyber Rica's population small was skill. You had to be able to do it. And that barrier has, in the space of roughly eighteen months, very nearly fallen over.

The reason is the same one that lets your nephew produce a passable essay without reading the book. The tools that now write code, draft a flawless email in any language, and clone a voice from a few seconds of audio do not stop to ask who is using them, or why. The skill that used to be the price of admission is now something you can simply ask a machine to hand you.

And the examples are no longer hypothetical. Early last year three teenagers — fourteen, fifteen and sixteen, not one of whom could code — used an ordinary AI chatbot to build a tool and aim it at a telecommunications company some two hundred thousand times. They spent the proceeds, in the grand tradition of teenagers everywhere, on gaming consoles. Around the same time, a single individual armed with nothing but widely available AI tools ran an extortion campaign against seventeen organisations in a single month — the sort of operation that would once have taken Conti's entire four-hundred-strong office to manage.

The genius is being automated. His job is being given away, free, to anyone who cares to ask. The population of Cyber Rica is about to go from "fewer than you feared" to "rather more than you'd like."

Why I am telling you this so calmly

Because the number is only half the story, and the other half is the good news.

The crowd that's coming is not a crowd of geniuses. It is a crowd of amateurs — more of them, yes, and better-armed than amateurs used to be, but amateurs all the same. And amateurs, the world over, do precisely one thing: they try the handle, and if it's locked, they move along. They have neither the skill nor the patience for anything cleverer. That is how the sheer volume has always worked, and it is about to become more true, not less.

So the strange, almost paradoxical truth is this. A rising tide of low-skill attackers makes the boring, ordinary locks more valuable than they were, not less. The genius might, in principle, have puzzled his way past a locked door. The amateur will rattle it once and wander off to the next one. Lock your doors, and you don't merely survive the coming crowd — you become the very thing it is built to skip.

This is the whole of my trade, and it has never once changed. I do not try to out-think the cleverest criminal alive. I simply make certain I am never the easiest one in the street. The cleverest criminal isn't coming for you. The lazy crowd is — and the lazy crowd is wonderfully easy to disappoint.

Australia's own cyber authority, the Australian Signals Directorate, describes these people in plain and unglamorous terms: financially motivated, willing to exploit any available opportunity for profit. Not your opportunity. Any. It has also, sensibly, begun publishing guidance for small businesses on this very AI-shifted landscape — because the fundamentals that disappoint an amateur are exactly the fundamentals that always worked.

None of this, by the way, is a failing on your part. The doors I find unlocked almost never belong to careless people. They belong to busy ones — a new staff member joined and an old account stayed open; a password got reused because it was a Tuesday with nineteen other things on it; an update waited for a quieter day that never quite came. That is not negligence. It is simply what running a real business from a laptop looks like. It is also, happily, the easiest thing in the world to put right.

There are three of them, and not one costs a cent. A second step on your important logins, so a stolen password opens nothing. Automatic updates, so the faults the crowd goes looking for are quietly mended before it arrives. And a different password for every account, so one leak in some far corner of the internet stays in that far corner. Three locks. One afternoon. The entire rattling crowd, disappointed at once.

Want to see which of your own doors are unlocked?

That's the whole purpose of our Ransomware Readiness Check. No scare tactics, no technical lecture, and nothing to hand over — just a plain-English walk-through of what's open, what's already shut, and what to see to first.

30 minutes. No tech knowledge needed. $149.

Take the Ransomware Readiness Check →

Understand your exposure. Know what matters most.

Frequently Asked Questions

1. How many hackers are there in the world?

There's no exact count. The skilled few who can build a genuinely new attack have always numbered only a few thousand worldwide — most so-called hackers simply rent those tools. What's changed is that AI has lowered the skill barrier, so the number of low-skill attackers is rising fast.

2. Are hackers lone geniuses or organised groups?

Often highly organised. When the Conti ransomware gang's internal files leaked in 2022, they revealed a company-like operation of around 450 people — with a human resources department, salaries, performance reviews and even an employee of the month.

3. How big is cybercrime as an industry?

By one widely cited estimate, if global cybercrime were a country its economy would be the third-largest on Earth — behind only the United States and China, and more profitable than the global trade in illegal drugs.

4. Is AI making cybercrime worse for small businesses?

AI is lowering the skill needed to attempt an attack, so the volume of low-skill attempts is climbing. The reassuring part: the basics still stop them — a second step on your logins (MFA), automatic updates, and a different password for every account.

Cyber Rica is growing. It will go on growing — a country built on unlocked doors will always attract new residents. I find this neither surprising nor worrying. I simply saw to it, some years ago, that none of the doors were mine. It remains the most restful decision I have ever made.

Stay protected, my friends.
— The Most Secure Man Alive