Risk = Probability × Severity. The Math That Exposes Who's Really Attacking You

The cybersecurity industry has spent decades training us to fear the hacker in the hoodie. Meanwhile, the actual predators wear polo shirts, send us EULAs, and sponsor the regulations that claim to protect us.

Let's apply the formula that actually matters:

Risk = Probability × Severity

And let's populate it honestly — not the way a Norton marketing department would.

The Matrix

Solo hackers and botnets. Moderate probability, limited severity. They want your credit card, maybe a few grand in Bitcoin. They don't want your life. Risk: medium. And crucially, they don't own the update channel. These are the pickpockets. Real, but they don't run the city.

State actors — NSA, FSB, Unit 8200. Near-zero probability for the average person. If you're not a journalist, a dissident, or a defense contractor, you're not worth the zero-day. Severity: catastrophic. But probability rounds to zero. Risk: low for most.

The Big Five — Microsoft, Apple, Google, Meta, Amazon. Probability: near 100%. If you use their products, they are extracting your data right now. This isn't a potential attack. This is the business model. Severity: structural and total. Continuous, cumulative, permanent. Your browsing history, location, social graph, biometrics, file contents, political views, health data. Risk: extreme. This is the water you're swimming in.

The Protection Racket

Here's the uncomfortable truth the previous articles in this series laid out in architectural detail: the entities we invite into our systems to protect us from small predators are themselves the large predators.

Your antivirus has root access to every file, scans everything you open, monitors every URL you visit, and phones home with the results. Avast sold the browsing data of 100 million users to over 100 third parties through its subsidiary Jumpshot — consulting firms, investment funds, advertising networks, data brokers. Non-aggregated, re-identifiable. The Czech DPA confirmed the violation. €13.9 million fine, final and enforceable.

Avast isn't the exception. Avast is the one that got caught.

Closed-source software precludes independent verification. You cannot verify what you cannot see. You cannot trust what you cannot verify. The claim "this software respects your privacy" isn't a promise — it's a logical contradiction, a square circle. Aristotle would approve.

The Big Five don't just allow smaller predators to exist — they benefit from them. Every ransomware headline is a marketing opportunity for "trust us with your security." Fear of the pickpocket drives you into the arms of the mafia. And the mafia keeps the pickpockets away. But who protects you from the mafia?

When the Mafia Writes the Laws

If you needed proof that the line between "state actor" and "corporate predator" has dissolved, look at what happened in the EU Council in June 2026.

The European Commission proposed Article 88b as part of the Digital Omnibus — a provision that would have replaced cookie consent banners with a browser-level signal. Users would set tracking preferences once, and websites would be required to respect it. The single measure in the entire package that would actually have simplified things for consumers.

Google submitted a lobbying paper arguing that removing cookie banners would halt online advertising — using figures the Commission itself called "highly exaggerated." On 18 June 2026, the Council removed Article 88b entirely. Germany, France, and Poland — the same member states publicly calling for "cutting red tape" — pushed for its removal. As Max Schrems put it: "You really have to let that sink in: the European Commission finally wants to get rid of cookie banners, but Google and some EU Member States are now determined to keep them."

Cookie banners aren't an invention of data protection law. They're an invention of the tracking industry. Studies suggest 3–10% of users actually wish to be tracked, yet dark patterns achieve consent rates up to 90%. Google doesn't want you to say "no" easily. It wants you to say "yes" through exhaustion. And when the EU tried to give you a simple, one-time "no," Google lobbied sovereign governments to kill it. Germany and France complied.

This is the predator hierarchy in action. The state is not a separate threat category — it is increasingly Big Tech's infrastructure. When a corporation dictates legislation to member states, the distinction between "state actor" and "corporate predator" becomes academic. They operate the same servers. They share the same data. They write the same laws.

Helplessness as a Business Strategy

There's a deeper layer to this predation. It's not just about data extraction — it's about induced helplessness, the systematic erosion of basic computing skills to make you permanently dependent on the ecosystem.

Consider what's been taken from us in two decades. The unified browser omnibox erased the distinction between URLs and queries — every "google.com" you type becomes a query through Google's servers. Mobile apps replaced bookmarks, app stores replaced software installation. iCloud, Dropbox, and OneDrive moved your files to their servers. iOS and Android hid the filesystem entirely. "The cloud" replaced basic networking — who needs to know what DNS is when everything routes through 8.8.8.8?

This isn't accidental. It's induced helplessness as a business strategy. A user who understands their filesystem might ask what rapportd is doing. A user who knows what DNS is might wonder why all their queries go to Google. A user who can install an OS might try Linux — or OpenBSD.

The complexity of open source isn't a bug. It's that we've been trained for two decades to find complexity unnatural — to expect to be served rather than to understand. A 10-year-old in 1995 could configure autoexec.bat to free up memory for games. That same 10-year-old today can't find the Downloads folder on an iPhone. The hardware got simpler. The user got simpler too. By design.

The Two Pillars the Big Five Sabotage

This is where the GDPR becomes devastatingly relevant.

The regulation rests on two operational pillars: privacy by design (Art. 25) — protection built into the system, not bolted on — and staff training (Art. 39) — personnel educated on secure data handling. The architrave is accountability (Art. 5(2)): the controller must demonstrate compliance, not believe in it.

Mainstream operating systems fail all three. Closed-source, unauditable, laden with telemetry, so complex that vulnerabilities are a mathematical certainty. You cannot demonstrate transparent processing when the logic is opaque. You cannot ensure confidentiality when you can't verify what leaves the system.

But the attack on training is subtler. The Big Five don't just fail to educate — they make users hostile to learning. Every dark pattern, every "it just works" abstraction teaches: don't worry about how it works, just click accept. When a DPO deploys a Windows fleet, they're deploying an environment that trains employees in helplessness. That's not Article 39 compliance. That's its opposite.

Now consider the alternative. Linux and BSD systems — particularly OpenBSD, the only OS undergoing continuous line-by-line security auditing — don't just permit understanding. They require it. The learning curve the industry dismisses as "too steep" is not a bug. It's the training pillar made operational. Article 39 compliance not as a checkbox webinar, but as the daily act of using a computer.

The Real Equation

The math is brutal:

P(hacker) × S(hacker) — manageable, not existential

+ P(state) × S(state) — near-zero for most

+ P(Big Five) × S(Big Five) — near 100% × structural total surveillance

= Total Risk

The third term dominates. By orders of magnitude. And the state actor term is increasingly just a special case of it. When intelligence agencies run on AWS, when surveillance requests go through corporate legal departments, when Google lobbies France and Germany to kill privacy legislation — the distinction between "state threat" and "corporate threat" is a vestigial organ of a threat model that no longer describes reality.

What To Do

1. Escape the Big Five. You cannot fix this with settings. You cannot disable enough telemetry. Migrate to Linux or OpenBSD. Use open source applications. Store data locally.
2. Basic hygiene against criminals. Updates, password manager, uBlock Origin. This handles 95% of the hacker threat without any AV bloatware.
3. Forget antivirus. It's anti-privacy by design. On Linux and OpenBSD you don't need it. Network-level filtering does more than a rootkit that uploads your files to "analyze" them.
4. Embrace the learning curve. The difficulty of open source is not a barrier — it's the mechanism. Every hour spent learning your system is an hour of immunity from induced helplessness, an hour of reclaiming skills the Big Five spent two decades extracting.

The pickpockets are real. But the mafia owns the police station, writes the laws, and sponsors the training seminars on theft prevention. Choose your enemies wisely — and don't pay protection money to the people robbing you blind.

This is the third in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on BSD. The full version, with risk matrix, deskilling table, defense spectrum, and regulatory analysis, is on the blog.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every week.