Describing attacks with crime script analysis

This article explores crime script analysis (CSA) as a method for understanding and visualizing cyberattacks, particularly business email compromise (BEC) scams. CSA, derived from criminology, breaks down attacks into a narrative sequence, making them accessible to non-technical audiences and highlighting potential intervention points. The piece argues that AI is increasingly automating the preparatory steps of BEC attacks, necessitating new defense strategies, including leveraging AI providers to detect malicious patterns and focusing on disruption at the delivery (Step 6) and victim awareness (Step 7) stages. CSA is presented as a complementary approach to frameworks like MITRE ATT&CK, offering a more human-readable perspective on threat actor activity.