What were the lessons of D.B. Cooper?

• A. Never copy what works.
• B. Copy what works.
• C. Always broadcast demands publicly.
• D. Immediately release all hostages.

Answer: (B)

Threat actors tend to study and borrow proven techniques from past operations to increase their chances of success. The D.B. Cooper case illustrates that when a method proves effective, others are likely to imitate or adapt it, so the important takeaway for security teams is to monitor what has worked in real incidents and build defenses around those patterns. The idea of “never copy what works” ignores this observed behavior and would leave defenses blindsided by familiar tactics that attackers have already tried. The other options suggest actions that aren’t realistic or relevant to understanding threats—broadcasting demands publicly or releasing hostages are not practical lessons in this context. So, the best takeaway is that threat actors copy what works, and defenses should learn from that to strengthen controls.