On automated threats, static defences, and the one gap in the criminal economy's attack chain that almost no one is investing in.