The Moving Target Trilogy
Ever notice every data breach story ends exactly the same way?
The company apologizes. Somebody in a good suit reads a statement about taking security seriously. You get a letter in the mail offering twelve months of free credit monitoring, which is the corporate equivalent of a fruit basket. Then silence.
Everybody moves on.
Except the people at the epicenter.
They do not move on. They are crime victims. And their story never makes the news.
Until now.
Picture the person who clicked.
Not the company. Not the logo. Not the eight-figure loss on page C4 of the business section. The person.
She is forty-two. She has been at the same company for eleven years. She has a husband who works remote sales and asks her one question every night: what do you need. She has two kids and a laundry room she keeps meaning to organize. She is good at her job. Genuinely good. Good enough that when the private equity firm came calling, they wanted her to stay on and run the thing after the sale.
On a Tuesday, in a hurry, between a vendor call and a board deck, she does not open an email.
That is the entire crime. That is the whole thing. She does not open an email.
Eleven months later she is sitting in a conference room with the shades pulled down, and a man she has never met is explaining to her that the criminals are already inside, that they have been inside since before Halloween, and that they want millions of dollars or they publish the files.
And the only thing she can think about, the only thing running on a loop behind her eyes while everyone else is talking about insurance carriers and negotiation windows, is that everyone in this building is about to find out that it was her.
That is the crime nobody covers.
Not the money. The money is just evidence. The shame is the sentence.
Moving Target is a trilogy built out of more than four hundred interviews and investigations. Ransomware negotiators. Reformed criminals who ran the operations. FBI agents. CFOs who wired eight hundred thousand dollars to a voice they had known for six years and had never once questioned. Parents. Teenagers. People who were counting down to retirement and instead spent it on the phone with a fraud department.
The books follow Stevie Parker, a chief operating officer at a mid-sized logistics company in Indianapolis.
She is not a hacker. She is not a federal agent. She does not know what a firewall does and, frankly, she should not have to.
She is a person with a mortgage, a mother, and a seven percent equity stake she has spent a decade earning.
Which makes her exactly what the criminals are looking for.
Let me set one frame before we go further, because if you get this wrong nothing else in the story lands.
Forget the hoodie. Forget the guy in the dark basement with three monitors and a Guy Fawkes mask. That image has done more damage to more businesses than any single piece of malicious software ever written, because it makes you believe you would recognize the danger if it ever came for you.
You would not.
The people who take companies apart run businesses. Real ones. With offices, with payroll, with quotas, with performance reviews. They have customer service departments, because a victim who cannot figure out how to buy cryptocurrency is a victim who cannot pay. They have quality assurance, because if the decryption key does not work, word gets around and the next victim does not pay either. They have onboarding. They have HR disputes. They clock in and they clock out and they take Sundays off.
One group ran a help desk with better response times than the company it was extorting.
That is who is on the other end of the email you did not open.
Not a genius. Not a ghost. An employee, doing a job, working a list, and your company is line forty-one.
I sat with a controller at a manufacturer with sixty employees. Twenty-two years at the company. She wired four hundred eighty thousand dollars because her CEO called her, by name, from his number, using a nickname only he used, and told her the acquisition was closing early and the wire had to go before noon.
It was his voice. It was not him.
The company survived. She did not stay. Nobody fired her. Nobody had to. She sat in the same chair for six more weeks and could not look at anyone in the hallway, and then she resigned in an email at 11:40 on a Friday night.
That is the part that never makes the news. There is no headline for it. There is no press release. There is a woman in her fifties who was excellent at her job for twenty-two years and now tells people at church that she took early retirement.
She was not the weakest link. The weakest link was the absence of anybody whose job it was to catch it.
She just happened to be the one holding the phone.
BOOK ONE. THE ART OF ONLINE CAMOUFLAGE.
Stevie Parker was a crime victim before she was old enough to drive.
I am not going to tell you what happened. I will tell you that how the adults around her handled it, what they said, what they did not say, and who they decided to protect, set the trajectory of her entire adult life. It shaped how she reports things. It shaped what she keeps to herself. It shaped what she does at 6:40 on a Tuesday evening when a notification lands in her inbox that she does not fully understand and does not want to be the person who escalates for nothing.
Book One takes her from twenty-two years old to the corner office. Every promotion. Every compromise. Every small, defensible, completely reasonable decision that any of us would have made on the same day with the same calendar.
Along the way, it teaches you how you are actually found.
Not hunted. Found. There is a difference, and the difference is the whole book.
Your information is not stolen from you as much as it is assembled about you. Your address from a data broker. Your phone number from a loyalty card. Your maiden name from a birthday post. Your job title, your reporting structure, and your travel schedule from a professional network you update voluntarily because you are looking for your next role. Nobody breaks in. They log in. They already have the parts.
By the end of Book One, Stevie has made it. The equity, the title, the corner office, all of it.
And on page two hundred and change, a breach sits inside her company, dormant, doing nothing at all.
It is not detonated. It is planted.
Sleep well.
BOOK TWO. THE OBEDIENT MACHINE.
The buyers arrive.
A private equity firm out of Chicago wants the company, and they want it modernized. They want artificial intelligence in the workflow, in quality control, in the forecasting, and they want it in ninety days because that is what the valuation model assumes.
Stevie has no playbook for this. Nobody does. She is evaluating vendors who cannot answer basic questions about where the data goes. She is managing a workforce that is convinced the software is there to replace them. She is writing governance rules for a technology that changes underneath her every six weeks.
And AI is not evil. It is obedient. It does exactly what you tell it to do.
But it also does what you fail to tell it not to do.
Somewhere in the middle of that, a man named Ryan Marsh is hired. Good interview. Clean background check. Real references. Real credit history. Real address.
Ryan Marsh does not exist.
A synthetic identity is a person built out of real parts. A stolen Social Security number that belongs to a nine-year-old, married to a fabricated name, aged for four years with a secured credit card and an on-time payment history until the file looks better than yours. Banks lend to him. Employers hire him. He passes because on paper he is a better citizen than the person interviewing him.
His credential accesses the network at 2:17 in the morning.
Nobody looks. Nobody is watching. There is nobody to watch, because 24/7 monitoring is a line item and the line item did not survive the budget.
Then the dormant breach from Book One wakes up. Mid deal. Mid diligence.
Ransomware is a criminal enterprise locking your files and selling you back the key to your own building. The demand is in the millions. The settlement is two hundred fifty thousand dollars. The decryption key works, which is the only mercy in the entire ordeal, and it is not mercy, it is quality assurance.
The buyers walk. The deal dies. A decade of Stevie's life evaporates in a nineteen minute conference call.
What she does next is the reason I wrote the trilogy.
Because that is where the second act of Book Two lives, and it is not a story about loss. Under a deadline that no rational company would accept, half her team gone, her reputation in freefall, Stevie builds the thing they should have built in the first place.
And then, on the last page, someone calls her husband.
It is her voice. Her cadence. The way she leans on the second syllable of his name when she is tired. Her face, on video, three days later, in a meeting she was never in.
She got the company back.
She lost herself.
BOOK THREE. GHOST AND THE MACHINE.
The final book is about a woman deciding she is done being visible.
A deepfake is a synthetic copy of a real person's face or voice, generated from samples. The samples are not exotic. A conference panel on YouTube. A voicemail. A podcast interview. Four seconds of audio is enough now. Four seconds.
You cannot un-ring that bell. Once your voice is out there, it is out there forever, and it can say anything anyone wants it to say, to anyone who trusts it.
So Stevie disappears.
Not metaphorically. Operationally. Data brokers purged. Phone locked down. Photographs scrubbed. Home address removed from the county property records the legal way, which takes months and a lawyer. She becomes unreachable, unsearchable, and effectively unfindable, and I walk you through exactly how she does it, because it is the same protocol I give to executives who travel abroad and to families who have already been hit.
Stevie is the ghost.
Then she builds the machine.
An isolated system, sealed off, fed nothing but her own proprietary data. No outside inputs. No shared model. No connection to anything that anyone could poison. Perfect outputs that nobody can reach, nobody can copy, and nobody can corrupt.
And it works. It works better than anything her industry has.
Which is when she finds out that her biggest competitor's system has already been poisoned. Quietly. Months ago. Possibly by the same criminal infrastructure that took her company apart during the deal. The outputs are wrong. The data going into their decisions is wrong. They do not know. They are about to walk it out onto a very public stage.
Stevie sees it coming.
She says nothing.
I am not going to defend her. That is not what the book is for. Read what she does and then sit with the fact that you understand exactly why she did it.
The last three lines of this trilogy are locked. They have been locked since before I wrote the first page of Book One. Nobody has seen them.
When you read them, you will understand why this was never a book about cybersecurity.
There is a version of me that would have written a manual. Three hundred pages of controls and frameworks and a compliance matrix in the back, and it would have sold four hundred copies to people who already agreed with me.
I have watched too many good people get taken apart to write that book.
I have sat in the room after. I have watched a founder explain to his wife why the retirement account is gone. I have listened to a sixty-eight-year-old woman apologize to me, apologize, for being defrauded by an organization with a customer service department and a training program. I have watched executives get told the voice on the recording is theirs and see the exact moment they realize it is.
Nobody needed a framework in that room.
They needed somebody to have told them the story before it happened to them.
That is the entire reason these books exist.
It was always about what it costs each of us to be visible.
Your face. Your voice. Your address. Your kid's school. Your calendar. Your habits. Every one of them is now an input into a machine that can imitate you, and imitation is all a criminal needs, because the person on the other end of the phone was never verifying you.
They were recognizing you.
Recognition is not verification. It never was. We just never had to know the difference before.
Stevie Parker learned the difference in a conference room with the shades pulled down.
You can learn it for the price of a paperback.
Book One: Moving Target, The Art of Online Camouflage. How they find you, and how she was found.
Book Two: Moving Target, The Obedient Machine. What happens when the machine you trusted does exactly what you told it.
Book Three: Moving Target, Ghost and the Machine. How she vanished, and what she saw from the outside.
Books One and Two are available now, everywhere books are sold. Book Three arrives September 22, one week before Cybersecurity Awareness Month, and the presale is open at CyberCrimeJunkies.com.
Grab all three. Read them in order. Then go look at what a stranger can find out about you in eleven minutes and a hundred and ninety-nine dollars.
She did not get to choose whether she became a target.
You still can.
Move. They miss.
David Dean Mauro