I think that unfortunately you&#x27;re mistaken.  If all you do is sit and look at log files all day you can come off with this impression because you see so many scans go by, but that creates a bias in your thinking which doesn&#x27;t line up with the facts.<p>A motivated attacker will always tend to try the &quot;low tech&quot; approaches first to rule them out as a first step because it it doesn&#x27;t require as much sophisticated technical attention and in addition it&#x27;s a well known fact that human beings are more often than not the weakest link in the chain of security.<p>It goes something like this:<p>1. enumerate the employees.. in other words build a list of all their work emails and try to obtain their personal emails and those of their spouses and children.<p>2. investigate the background of executives so that a compelling phishing email message can be crafted which looks like it originated from high up within the organization.<p>3. Send targeted phishing emails designed to bait people within the organization to visit webpages that exploit Adobe Flash attack vectors or other browser based vulnerabilities, or perhaps even lure them into installing a trojan directly.<p>4. after someone in the organization falls victim to the client-side attack, read their emails to learn more about the organization&#x27;s structure so that your next phising attack can be more refined, specific, and compelling and can possibly utilize a real corporate email address.<p>5. Rinse and repeat until you eventually gain access to a developer laptop where you can grab production environment SSH keys.  Now you own the network without even having to scan a single server and without leaving a trace in the log files.