This week, Christopher Nolan’s The Odyssey brings the Trojan Horse back to the big screen. It’s the most famous trick in history: giant horse, hollow belly, hidden soldiers, and a fallen city.
But while everyone remembers the horse, nobody remembers how it got inside the city walls. That’s where the real story lies.
We sat down with Dr. Garrett Ryan, ancient historian and the voice behind the Told In Stone YouTube channel, to look at the fall of Troy from another angle: the human decision that brought down a city.
Three thousand years later, that’s the part of the attack that counts the most.
The horse didn’t bring down Troy – Sinon and his cover story did
If we strip away the myth, the Trojans don't simply let the horse in with a shrug – they argue about it. What changes their minds is Sinon, a man left behind by the Greeks to spin a convincing story. As he explains, the horse is an offering to the Gods – and if they bring it inside, the city will become invincible.
As Dr. Ryan tells us, this story really did the trick. "The Greeks know very well the power of rhetoric," he says. "All communication is persuasion. That's Aristotle's case. Odysseus's great power is the power of words – the power to trick, to convince, to persuade."
“Sinon must have been a great actor,” says Dr. Ryan. “Because the Trojans believed him.”
This is a powerful lesson for us today. Every time a company faces a data breach or ransomware attack, we might be tempted to focus on the sophistication of the malware involved, or how clever the payload is. But the cover story is the trickiest, most dangerous part of social engineering – and even the smartest among us can be fooled by it.
The strongest walls can’t protect against human error
One of the biggest lessons, says Dr. Ryan, is that you don’t attack a city by breaking its walls. “The weakest point is not the gates of the walls. It's the minds and the willpower of the people inside the city.”
With cybersecurity, every organization has spent years building the right walls – network protections, identity verification, endpoint detection. These defenses are real, and they work. But hackers know the easier way to get inside is to target the human layer. That’s why, in 2026, roughly 60% of all data breaches still involve an element of human error.
As Dr. Ryan puts it, the Trojans even had a warning mechanism that worked: the priest Laocoön warned the city plainly not to trust the horse. But his warning was overruled by Sinon's cover story.
So, are we getting any better at listening to these voices of doubt?
Looking for ten ways to keep your company secure? Take a look at our free Gatekeeper's Checklist.
Why we still fall for social engineering 3,000 years later
According to Dr. Ryan, we need to face an uncomfortable truth: today, we’re no better than the Trojans at keeping the threat outside the walls where it belongs.
"The fascination of history," he says, "is that we are the same dumb animal – and at the same time so very different. Our psychology is based on groups. We want to belong, we want to believe people, we're conditioned to trust."
That’s why we’re still getting scammed today. In human beings, trust isn't a bug – it's an operating system we need for society to function. Scammers still exploit that same instinct – only now with AI tools and deepfakes that let them look and sound like anyone, anywhere.
In 2024, for example, a finance employee at the engineering firm Arup transferred $25 million after being tricked by a scammer impersonating his CFO via a series of Zoom deepfakes. It’s a level of cunning that would impress Odysseus himself.
How should we stay secure? Make our minds into citadels
So, what did the ancients actually offer as a defense? Not bigger or stronger walls, but a mental discipline.
Every school of ancient philosophy, Dr. Ryan explains, shares one assumption: that the mind is the ultimate citadel, and that it has to be kept like a well-regulated city.
"All you can control ultimately is yourself," Dr. Ryan says. "Once you lose that sense of self, you are vulnerable to everything. Keep it strong, and you have a strong defense."
This is the ultimate defense – and it’s 3,000 years old. The window is brutally short: on average, a person who falls for a phishing email will click within seconds, handing over their credentials – the key to the city walls – in under a minute.
In these conditions, the only real defense is a strong security posture based on regular, impactful training on the latest threats. As Dr. Ryan puts it: "Human psychology is the ultimate firewall."
Thanks again to Dr. Garrett Ryan of the Told In Stone channel for this fascinating discussion!
To learn more about how Riot can help teams everywhere build a stronger shared security posture through unforgettable training and proactive defense, get in touch with one of our experts today. Sandals not included.
