The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise.

That assumption is starting to break.

Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat at one end. Organized criminal groups followed. Inexperienced attackers, dismissed as "script kiddies," sat at the other end, running public