An attack vector is a method, path, or tactic a cybercriminal uses to compromise, disrupt, or gain unauthorized access to a system or network Attack vectors typically fall into 2 categories: technical or human-based.
Technical vectors exploit flaws in software, hardware, networks, or system configurations. Human-based attack vectors target people. Threat actors manipulate individuals into revealing information, approving access, opening malicious files, or completing other harmful actions through social engineering.
Attack vectors rarely work in isolation. An attacker may, for example, start with a phishing email, steal an employee’s credentials, enter a company’s cloud account, and then exploit a misconfiguration to access sensitive data.
This guide takes a closer look at how attack vectors work and how cybersecurity teams can reduce the risk of successful attacks.
How does an attack vector work?
An attack vector forms the path between a weakness and an attacker’s objective. A successful attack requires the following components:
- A target. This may be, for example, an employee, an exposed server, an account, or a cloud service with a weakness such as a poor password, a software vulnerability, or a misconfiguration.
- A pathway. The attacker needs a route to gain unauthorized access to their target.
- A payload or goal. The attacker uses unauthorized access to steal data, deploy ransomware, disrupt operations, conduct espionage, or move deeper into the network.
A typical attack follows a 7-stage cyber kill chain:
- Reconnaissance A threat actor looks for information about the target, such as employees, systems, software, domains, and exposed services.
- Weaponization The attacker prepares a malicious tool, file, exploit, or payload based on the weakness they plan to target.
- Delivery A cybercriminal sends or places the payload through phishing, a malicious website, compromised credentials, or another attack vector.
- Exploitation The payload takes advantage of a vulnerability, misconfiguration, or human mistake to gain access.
- Installation The attacker installs malware, creates a backdoor, or changes system settings to maintain access.
- Command and control The compromised system connects to the infrastructure controlled by the attacker and receives further instructions.
- Action on objectives The attacker steals data, deploys ransomware, disrupts services, commits fraud, or maintains access for espionage.
Attack vector vs. attack surface
An attack surface covers all entry points, assets, and vulnerabilities that cybercriminals can target across an organization’s systems, networks, applications, devices, and users. An attack vector, by contrast, is the method, route, or tactic the attacker uses against part of that surface For example, a company’s attack surface includes domains and subdomains, DNS records, open ports, APIs, cloud services and storage, and web apps. Every exposed asset or potential weakness can create an opportunity for attackers to compromise systems, steal data, or disrupt operations.
Attack surfaces are growing as businesses adopt AI, migrate to the cloud and data center environments, use IoT devices, and support remote work. This means more opportunities for cybercriminals to infiltrate networks and systems.
At the same time, attack vectors are more advanced. Threat actors now use AI to manipulate users and bypass traditional security controls.
Here is a quick comparison between an attack surface and an attack vector:
An attack surface | An attack vector | |
|---|---|---|
The key difference | Where could an attacker try to get in? | How could an attacker get in? |
Scope | All assets, systems, users, and potential entry points that attackers could target, including both external and internal resources | One specific attack route, method, or tactic used to gain access to a system or network |
Nature | Broad and complex it depends on system configurations and architecture | Dynamic it depends on the tactics, techniques, and procedures (TTPs) a cybercriminal uses |
The common types of attack vectors
Multiple attack vectors enable data breaches, and the average cost of a breach in 2025 was $4.4 million according to IBM. Understanding them can help you choose suitable security strategies and measures to protect your business.
Social engineering
This method exploits psychology, trust, and human behavior. Social engineering attacks manipulate people into disclosing personal data, such as bank passwords, and company-sensitive data, such as intellectual property or trade secrets.
Phishing is one of the most prevalent social engineering attacks. In a phishing attack, a threat actor uses spoofing, a technique in which they pretend to be a trusted source. According to IBM, phishing is one of the most common attack vectors with an average breach cost of $4.8 million.
Traditional social engineering relied on deception. Employees could identify red flags, such as suspicious links, poor grammar, or implausible requests—and report them. Now, attackers have moved on. They research a victim thoroughly, so their attacks look like reasonable requests, not an obvious attack
In a February 2026 incident, Figure Technology a blockchain-based lending company, disclosed that it fell victim to a social engineering attack that impacted 967,000 accounts. Cybercriminals used voice phishing that tricked an employee into approving prompts on legitimate authentication portals.
Here are the most common types of social engineering and phishing methods hackers use:
- Emails with malicious links or attachments
- Voice phishing (vishing)
- SMS phishing (smishing)
- Spear phishing
- Business email compromise
- CEO fraud
- Pretexting
Compromised credentials
According to the X-Force Threat Intelligence Index 2026 stolen credentials were the second most common initial access attack vector in 2025 A credential-based attack takes an average of 186 days to resolve Threat actors can access systems with usernames and passwords stolen through data breaches, infostealer malware, phishing attacks, or purchased on dark web marketplaces.
Credential-based attacks are difficult to detect because an attacker may appear to be a legitimate user. A successful login may not trigger the same security alerts as malware, for example.
Dark web monitoring can help organizations find exposed employee credentials before threat actors use them. Security teams can use these findings to reset affected passwords, revoke active sessions, enforce multi-factor authentication (MFA), and investigate whether the credentials were used for unauthorized access.
Malware and ransomware
Malware, or malicious software, is designed to steal information, disrupt systems, monitor activity, or give attackers remote access. It is often part of other attack vectors, such as phishing or supply chain attacks. One of the most commonly used types of malware is ransomware.
Our recent research shows that ransomware attacks rose by 20% in the first quarter of 2026, compared to the same period last year. As Mantas Sabeckis, Senior Threat Intelligence Analyst at Nord Security, notes, it was small and medium-sized companies in the United States that took the biggest hit.
Ransomware operators often use compromised VPN accounts or exposed remote desktop protocol configurations for initial access. Some of the most active ransomware groups, like Qilin use double extortion. They steal data before encrypting it, then threaten to leak the stolen data on their dark web sites. This lets them dictate the conditions of ransom negotiations and pressure businesses to pay more.
In February 2024, the ALPHV/BlackCat ransomware group breached Change Healthcare stole more than 6 terabytes of sensitive data, and disrupted claims, prescriptions, billing, and reimbursements across the US. The company reportedly paid a $22 million ransom, while the total cost of the attack reached about $2.87 billion, making it one of the costliest attacks in history.
Vulnerability exploitation
The X-Force Threat Intelligence Index states that vulnerability exploitation in public-facing assets is one of the most common attack vectors.
The most prevalent vulnerability exploitations include:
- Unpatched software Attackers scan internet-facing systems for vulnerabilities. Once exploit code becomes publicly available, cybercriminals can automate attacks and target large numbers of unpatched systems.
- Misconfigured access controls Incorrect settings for cloud storage, firewalls, or network ports may allow unauthorized access.
- Exposed services on open ports Internet-facing services running on open ports can contain vulnerabilities or weak configurations that attackers exploit to gain access.
- Cross-site scripting (XSS) If a web app doesn’t handle user input correctly, bad actors can inject malicious scripts into web pages.
- Compromised devices After attackers compromise one device, they can use it to access other parts of the network if security controls are weak.
In June 2026, cybercriminals exploited CVE-2026-35273 a critical remote code execution vulnerability in Oracle PeopleSoft’s Environment Management component, before a patch was available. The attackers then installed remote management tools, moved across internal systems with common credentials, and stole organizational data.
Exposed public-facing assets
External-facing assets are systems accessible from outside your organization’s perimeter. This category includes websites, VPN gateways, cloud servers, APIs, email systems, remote access portals, development environments, and file-transfer applications.
Many organizations often lose track of these critical assets because of:
- Shadow IT Unauthorized or unmanaged IT tools. For example, the average organization has about 975 unknown cloud-based apps in use.
- Cloud velocity Cloud resources change so quickly that automated deployment can create misconfigurations and make manual inventories outdated.
- Mergers, acquisitions, and subsidiary networks Ownership sometimes doesn’t transfer cleanly and leaves forgotten inherited systems that attackers can exploit.
- Decentralized IT across business units Access points or environments maintained by former suppliers or contractors make it hard to track all external risks.
- Abandoned DevOps environments Unsecured or unmonitored staging and testing platforms can also serve as an easy entry point for attackers.
External attack surface management (EASM) gives your security team an attacker’s view of your external digital assets and helps discover exposed systems, misconfigurations, and exploitable vulnerabilities.
Network-based attack vectors
These vectors exploit weaknesses in connections, communication protocols, network devices, or the data transmitted between systems. Attackers use them to gain unauthorized access, intercept information, move across networks, or disrupt service availability. Common examples include:
- Man-in-the-middle (MitM) attacks—intercepting communication between two parties.
- DNS spoofing—redirecting traffic to malicious websites by corrupting DNS data.
- Address resolution protocol (ARP) spoofing—linking an attacker’s MAC address to a legitimate IP address on a local network.
- Session hijacking—taking control of a user’s active session.
- Distributed denial-of-service (DDoS) attacks—overwhelming a system with traffic to disrupt service availability.
- VPN and firewall exploitation—bypassing or compromising network security controls.
- Lateral movement via flat networks—spreading throughout a network from an initial compromise due to insufficient segmentation.
For instance, an attacker on an unsecured Wi-Fi network can intercept sensitive traffic or redirect users to a fraudulent login page. Similarly, once an attacker gains access to one internal system, they can scan the network for other vulnerable devices and services.
Mobile, IoT, and Bluetooth vulnerabilities
IoT devices often store business-critical data and connect to corporate networks, while mobile devices facilitate access to email and cloud applications. This greatly expands an organization’s attack surface.
IoT devices also tend to receive fewer security updates, and they may lack essential endpoint detection capabilities. This makes them attractive targets. Attackers can compromise an IoT device and use it as a foothold for network reconnaissance or lateral movement within the corporate environment.
Mobile and IoT vulnerabilities
- Outdated firmware and software Devices may use old software with known security flaws or no vendor support.
- Hard-coded or default credentials Embedded credentials or unchanged default passwords can let automated botnets take control of devices.
- Unencrypted data transfers. Devices may send company data without encryption, which exposes it to interception on local networks.
- Weak application APIs Mobile apps that are not secured properly may expose login tokens or grant access to administrative systems.
Bluetooth attack methods
- BlueBorne This family of Bluetooth vulnerabilities allows attackers to silently take over a device, which may lead to remote code execution or MITM attacks.
- Key negotiation of Bluetooth (KNOB) attack This attack exploits a security flaw in the classic Bluetooth standard (BR/EDR) and tricks two connected Bluetooth devices into using a weak encryption key, which the cybercriminal can crack to read or alter the data.
- BlueSmack (Bluetooth denial-of-service attack) Attackers flood a Bluetooth-enabled device with oversized data packets, overwhelming the device’s CPU and making it unusable.
- Bluetooth sniffing Bad actors intercept and analyze data sent between Bluetooth-enabled devices without alerting them.
Insider threats
Users with legitimate access to an organization’s systems and data can abuse it, either intentionally or unintentionally. They can be current employees and former employees whose access was not revoked, contractors, suppliers, and other trusted third parties. For example, a departing employee might copy customer records to their personal cloud storage account.
There are a few types of insider threats:
- Malicious A company’s employee intentionally steals, deletes, or exposes sensitive information.
- Negligent A user compromises security by sending data to the wrong recipient, using weak credentials, or ignoring established security policies.
- Accidental An employee can accidentally expose confidential data by incorrectly sharing a document through a cloud collaboration platform.
- Supply chain exploitation Compromised third-party accounts can give attackers trusted access to sensitive systems, especially when vendors have weak security controls.
In March 2023 a user named “FreeSpeechEnthusiast” leaked parts of Twitter’s source code on GitHub a code hosting platform. The cause was never publicly confirmed, so the leak cannot be directly attributed to the layoffs that Twitter had earlier that year. However, the user’s name was clearly a reference to Elon Musk, who often called himself a “free speech absolutist”.
AI-based attack vectors
Companies are adopting AI at scale, and so are cybercriminals. They use AI tools to launch advanced attacks, such as highly convincing phishing campaigns or automated social engineering campaigns. They can personalize attacks, target more employees, and extract data with less time and effort.
AI systems also introduce new attack paths for cybercriminals. For example, through prompt injection threat actors can hide malicious instructions in emails, PDFs, websites, support tickets, or knowledge base entries that an AI agent processes. The agent may follow these instructions and expose sensitive data, send fraudulent messages, change records, or misuse connected business tools.
Other threats include poisoned data sources, manipulated agent memory, stolen API keys, and excessive permissions. When AI agents are connected to business tools and granted broad permissions, they may access applications, steal company data, or take actions without human approval.
In May 2026, Google Threat Intelligence Group (GTIG) reported the first known case of a threat actor using AI to help exploit a zero-day vulnerability in a real-world attack The attack targeted a two-factor authentication bypass in an open-source web administration tool, but it was stopped before it could be used at scale.
Passive vs. active attack vectors
Attack vectors can also be classified as passive or active:
- Passive attack vectors Cybercriminals use them to access data without changing or disrupting a system. For example, an unencrypted Wi-Fi network may allow attackers to intercept data through eavesdropping.
- Active attack vectors These are used to change, disrupt, damage, or take control of a system. Examples include denial-of-service attacks and ransomware attacks.
Knowing which category an attack falls into helps security teams choose the right detection and response controls—and shape a broader plan to reduce attack vector risk across the organization.
How to identify and reduce your attack vectors
Reducing attack vector risks starts with knowing what systems or assets attackers could target in your organization. The best approach is a layered strategy.
Discover external assets continuously
Track internet-facing domains, IP addresses, cloud services, APIs, and applications. Continuous external attack surface discovery helps security teams find forgotten, exposed, or misconfigured assets that manual inventories may miss.
Patch vulnerabilities quickly
Apply security updates to operating systems, applications, firmware, and internet-facing services. Prioritize critical vulnerabilities that attackers actively exploit.
Require multi-factor authentication
MFA adds another verification step if an attacker steals a password. Apply it to email, cloud platforms, administrative accounts, remote access tools, and other sensitive systems.
Enforce least-privilege access
Give users, applications, and third parties only the access they need. Regular access reviews can remove unnecessary permissions and limit the damage from compromised accounts.
Segment the network
Network segmentation separates users, devices, and sensitive systems into smaller zones. This limits lateral movement after an attacker gains initial access.
Strengthen email security
Use spam filters, attachment scanning, link checks, and domain protection to block phishing emails. Additional controls can detect spoofed senders and suspicious login attempts.
Train employees to spot attacks
Teach employees how to recognize phishing, social engineering suspicious links, and unusual access requests. Provide clear steps for reporting possible security incidents.
Monitor user and system activity
Review activity logs for unusual downloads, privilege changes, login locations, and access patterns. These signals can reveal compromised accounts or malicious insider activity.
Use data loss prevention controls
Data loss prevention (DLP) controls can detect or block sensitive data sent through email, cloud storage, removable devices, and other channels. They help reduce both accidental leaks and deliberate theft.
Deactivate accounts during offboarding
Remove access as soon as an employee or contractor leaves the organization. Revoke active sessions, API keys, shared credentials, and access to third-party services.
Monitor the dark web for leaked data
Dark web monitoring can detect exposed employee credentials or company-related data, helping teams respond to risks early on.
Conclusion
Organizations can reduce the risks of attack vectors through continuous asset discovery, timely patches, MFA, least-privilege access, network segmentation, employee training, activity monitoring, and dark web monitoring—a layered defense that address both the technical and human paths attackers rely on.