Environmental Criminology Is a Forecast, Not a Theory

The economy is rolling over, and the security profession is about to relearn environmental criminology the hard way. Cohen and Felson laid it out fifty years ago, crime requires a motivated offender, a suitable target, and the absence of a capable guardian. In a downturn, all three legs of the triangle move in the wrong direction at the same time, and the firm’s interior risk surface lights up faster than any external one.

Motivated offenders multiply. Layoffs, frozen pay, evaporating bonuses, underwater mortgages, the population of people under financial pressure expands across every department, including the ones with the keys. Targets become more suitable. The firm has cut the security team, deferred the EDR upgrade, and pushed the privacy program to next year’s budget. Guardians vanish. The audit function got reduced, the SOC moved to a cheaper MSP, the compliance team’s senior people took severance. The interior of the firm is now a richer, softer environment than it was twelve months ago, occupied by more people with more reason to act.

Three employee-driven vectors will define the next eighteen months.

1) The first is pre-exit data exfiltration. Employees who see the layoff coming move client lists, source code, pricing files, and CRM exports out of the environment before the notice lands. They take it for the next job, for resale, or out of resentment. The DLP that would have caught it isn’t tuned, because the engineer who would have tuned it was the previous round.

2) The second is external recruitment of insiders. The Scattered Spider and Lapsus$ playbook, paying employees and contractors for credentials, MFA approvals, and session tokens, accelerates in a downturn. A help desk technician making sixty thousand a year, with a rent increase and a sick parent, is a different person to a recruiter offering twenty thousand in cash for one VPN approval.

3) The third is trusted-insider fraud. The fraud triangle, pressure, opportunity, rationalization, lights up across the long-tenured workforce. The controller, the AP clerk, the operations manager. Reduced segregation of duties from headcount cuts meets real financial pressure at home. The expense fraud, the ghost vendor, the wire diversion, every fraud examiner has seen the cycle. It starts again.

Environmental criminology is not a theory in a downturn. It is a forecast. Firms that cut security to protect the quarter will pay for it in the next two.