Yochai Corem is GM of Exposure Management at Check Point Software.
Cybercriminals trade tools, rent each other access and combine forces to hit targets no single group could reach alone. The security industry has spent two decades doing the opposite, building walls between vendors instead of bridges. If the people attacking us cooperate freely, the people protecting us can’t afford not to.
The Alliance Economy Criminals Already Built
Hacktivism used to mean a handful of independent actors defacing a website to make a point. That model is gone. For example, threat groups are now using crowdsourcing tactics to turn bystanders into unpaid contributors to someone else’s attack, expanding a campaign without needing to enlarge the core group behind it.
Many of today’s hacktivist groups have also drifted closer to nation-states, whether through direct funding, shared targeting priorities or simple convenience. A hacktivist collective with state backing operates on a different level than one working alone, and it’s part of why this threat has become harder to contain than it was even five years ago.
This kind of cooperation extends beyond hacktivism. Ransomware operations increasingly rely on collaboration between groups with different capabilities. DragonForce, for example, has been linked to Scattered Spider, a cybercriminal network known for sophisticated social engineering. In 2025, Scattered Spider threat actors targeted organizations with the intent of deploying DragonForce ransomware. The activity shows how attackers with expertise in gaining access to corporate environments can operate alongside ransomware groups with the infrastructure to carry an attack further.
It also illustrates the larger advantage of this collaborative model: One group doesn’t need to master every stage of an attack when different actors can contribute access, infrastructure and specialized expertise to the same operation. That interconnected model allows cybercriminals to extend their reach without building every capability themselves. That level of coordination exposes a weakness in a security industry that still struggles with tools and vendors operating in silos.
Where The Security Industry Has Got It Backwards
For years, the security industry has treated interoperability as a competitive threat rather than a customer need. Vendors built platforms designed to keep customers locked inside a single ecosystem on the theory that switching costs were more valuable than shared defense. The result is enterprise environments stitched together from tools that don’t talk to each other, running alongside an attacker economy that increasingly does.
This is a strategic failure. Most large organizations run a mix of security vendors by necessity, whether through acquisitions, regional requirements or simple preference. A remediation platform that only acts on findings from its own firewall or endpoint agent leaves every other control in the stack unmanaged. Attackers don’t check which vendor logo is on the box before they exploit a gap. Neither should the response.
Security leaders feel this gap every day. A vulnerability gets flagged by one tool, but the fix has to be pushed through a completely different system that the first tool has no visibility into or authority over. Someone has to manually bridge that handoff, and every manual step gives an attacker more time to act. Multiply that across dozens of tools in a typical enterprise stack and the industry has effectively built its own version of the silos that criminal groups abandoned years ago.
At Check Point, we decided to build our exposure management remediation to act across environments, not just our own. That decision reflects a simple fact: Security teams don’t get to choose a clean environment, so the tools meant to protect them shouldn’t assume one.
I’d rather see that decision copied than credited. Every vendor building exposure management, detection and response, or remediation tools faces the same choice we did: Protect the closed ecosystem or protect the customer.
Interoperability standards, shared threat intelligence and remediation that works across vendors aren’t just good product decisions. They’re the minimum requirement for competing with an adversary that already operates this way.
Cybercriminals figured out that cooperation beats competition years ago. It’s long past time the security industry caught up.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
