Attackers operate largely the same way. They scrape your org chart, guess who signs the wire, assume which domains belong to you and harvest what normal looked like months ago. Their picture is external, often stale and rarely confirmed. They are reading your stars.
Defenders can carry facts the attacker has to guess at: who actually approves a payment and whether it takes two signatures, the 99 domains you own that an outsider might flag as strangers, the vendor that is real and the one that never existed.
That advantage is not absolute. Attackers get inside through stolen passwords, compromised mailboxes and breached suppliers. But getting inside costs them, and even then, they are moving against facts they cannot fully see or reliably keep current. For 30 years, the asymmetry ran their way because they only had to be right once. Ground truth is how the price starts to run the other way.
