Security that depends on vigilance is not security.
In 2014 Hari Ravichandran was hacked. The damage to his credit file was bad enough that his family was refused a mortgage, and the experience turned into a company — he founded Aura — and eventually into this book. It is a practical manual for defending an ordinary household against an industry that has professionalised while most families were still treating safety as a matter of being careful.
You are not being outsmarted. You are being outspent and outstaffed. The Mdrn Urban
and aging parents.
Cybercrime stopped being a hobby and became an industry. Household defence never made the same transition.
A mortgage refused for a crime he did not commit.
The opening is a personal story and it earns its place, because it demonstrates the part people underestimate: the attack is rarely the damage. The breach itself took minutes. The consequence was a corrupted credit file, months of correspondence with institutions that each had a partial view, and a family that could not borrow. Identity is administrative. Once someone has inserted false information into the records that other institutions trust, you are not fighting a hacker, you are fighting the paperwork of every organisation that believed them.
Not a teenager in a bedroom. A company with a payroll.
The mental image most people carry is thirty years out of date. Modern fraud runs on call centres, scripts, quality control, customer-service style escalation paths, purchased data sets and A/B tested messages. Scam compounds operating across Southeast Asia are staffed, in part, by trafficked workers. The people contacting your parents are not improvising; they are working a funnel that was optimised on tens of thousands of previous attempts. Understanding that changes the defence: you cannot out-concentrate a shift-based operation, and any strategy that relies on you and your family never having a bad day is already broken.
Teenagers, money, and aging parents.
The book organises a household into the three places it is actually attacked. Teenagers live a second life online that parents are structurally unable to see, and the risk there is less about viruses than about grooming, sextortion, and account takeover through the games and apps they trust. Family finances are attacked through the weakest credential anyone in the house reuses. And aging parents are targeted deliberately, because the scripts that work on them — authority, urgency, a family member in trouble — are well understood and cheap to deploy. Each surface needs a different answer, and the book is at its most useful when it stops generalising and takes them one at a time.
Put it on autopilot, or it will not happen.
The one idea running underneath everything is that protection has to be a default rather than a practice. Any measure requiring a person to remember, check, resist or decide correctly under pressure will fail eventually, and the failure only has to happen once. So the recommended posture is structural: defaults that hold when attention lapses, monitoring that runs whether or not anybody is watching, and recovery paths decided in advance rather than improvised at 11pm by somebody who has just realised what has happened.
Any safety rule that requires everyone in the house to be alert forever is a rota, not a defence.
The Mdrn UrbanThe author sells the category he recommends.
State it plainly, because the book largely does not. Ravichandran founded and runs a consumer security company, and an all-in-one protection subscription is precisely what his company sells. That does not make the advice wrong — much of it is the standard guidance any independent security practitioner would give — but it does shape which solutions feel inevitable by the final chapters. The correct way to read it is to take the threat model seriously and treat the product-shaped conclusion as one option among several, most of which cost nothing.
Most of the benefit costs nothing but an evening.
If you implement only the structural parts, you capture most of the protection. A password manager so that no credential is ever reused; multi-factor authentication on email and banking, using an authenticator app rather than SMS, because a SIM can be swapped; the family email account treated as the master key it actually is, since every reset flows through it; automatic updates left on; and one honest conversation with parents establishing that no legitimate institution will ever ask them to move money to keep it safe. The American specifics do not transfer — credit freezes and the US bureaus are not how CTOS and CCRIS work here — so translate the principle rather than the procedure.
Design for the bad day, not the good one.
Every household security plan is really a bet about your worst evening — tired, distracted, in a hurry, reading a message that arrived at exactly the wrong moment. Build the defence that still holds then, and the rest of the advice becomes optional.
Summarised in my own words from Intelligent Safety: How to Protect Your Connected Family from Big Cybercrime by Hari Ravichandran (Skyhorse, 2023). The author is the founder and CEO of Aura, a consumer security company; section 05 explains why that matters when reading the recommendations.