Attack Vectors in Cybersecurity: The 12 Most Common Types and How to Defend Against Them
In an incident response call, once the panic settles, somebody asks “how did they get in?” Whatever the answer turns out to be, a password phished from the payroll manager or a FortiGate that missed its patch, or the contractor account nobody disabled in March, that’s the attack vector.
Below: the definition, how it differs from attack surface and threat vector, then the 12 most common attack vectors we’d expect any organisation to face, with the controls we’d actually spend money on for each.
What is an attack vector?
What is an attack vector, precisely? The pathway from outside your defences to inside them. The attacker might be after your customer database, or want to run ransomware, or mine crypto on your AWS bill, or sit quietly in the network for a year; none of that happens until they have a foothold. Sometimes that’s a credential typed into a fake login page. Sometimes it’s a storage bucket left public after a migration.
Attack vector vs attack surface vs threat vector
These get used interchangeably, and risk meetings suffer for it:
- Attack vector is the method of entry, say password spraying against Outlook Web Access, or SQL injection in a login form.
- Attack surface is everything that could be targeted. That includes the forgotten staging server on a subdomain and the API your mobile app talks to, not just the obvious website. You shrink an attack surface; you defend against attack vectors.
- Threat vector is a synonym for attack vector in most usage, although some teams stretch it to cover who the threat actor is and their motive.
Active vs passive attack vectors
The usual split is two categories:
- Active attack vectors change or disrupt something directly. Malware and ransomware belong here, as do denial-of-service floods, exploitation of an unpatched vulnerability and brute force attacks against a login page. They’re fast and they’re noisy, so a decent EDR or SIEM usually sees them.
- Passive attack vectors gather information and leave everything as it was: sniffing unencrypted traffic on a shared network, capturing session tokens, enumerating your subdomains and exposed services, or a friendly phone call that gets a receptionist to confirm who the new finance director is. Nothing alerts, which is the point; this is the groundwork that makes the active phase work.
Real breaches mix them. Reconnaissance and credential harvesting come first, and exploitation follows once the attacker knows where to aim.
The 12 most common attack vectors
1. Phishing and social engineering
Phishing is still the most common attack vector. An email, a text (smishing) or a phone call (vishing) gets an employee to click a link, open an attachment or type a password into a spoofed Microsoft 365 page. LLMs have removed the broken English people were taught to look for. AiTM kits like Evilginx sit between the victim and the real login page and keep the session cookie as well as the password, so SMS codes don’t save you. Business email compromise skips malware altogether: a believable note asking accounts payable to change a supplier’s bank details is enough, and it costs organisations billions per year.
Defence: move admins and finance staff to FIDO2 keys or passkeys first, because a phishing proxy can’t replay them. Then run regular phishing simulation with security awareness training attached, and put a report button in Outlook. If reports arrive hours after the click, nobody is using it.
2. Compromised and stolen credentials
Attackers would much rather log in than break in. The awkward source these days is infostealer malware like Lumma running on a personal laptop that an employee also uses for work: it lifts every saved password and session cookie in the browser, the log gets sold on a Telegram channel, and somebody tries the corporate VPN with it a few days later. Defence: multi-factor authentication, a password manager so nobody reuses passwords, and monitoring breach data and infostealer logs for your own domains.
3. Weak passwords and brute force attacks
A brute force attack guesses until something works, which against “Password1!” on a login with no rate limiting doesn’t take long. Spraying is the quieter variant that tends to show up against Microsoft 365 tenants: one or two likely passwords tried across every account, slowly, so no single account locks. Credential stuffing replays pairs from old breaches instead of guessing. Defence: MFA first, then lockout and rate limiting, a banned-password list that includes known-breached passwords (Entra ID has one built in), and a password policy that favours length over complexity rules.
4. Malware
Malware covers trojans, infostealers, loaders, spyware and remote access tools. It arrives through phishing attachments, trojanised downloads pushed via search ads, and compromised websites, and its job is usually to give the attacker a foothold to escalate from. Defence: EDR on every endpoint, application allow-listing where you can stand the admin overhead, and blocking macros in Office files downloaded from the internet (Microsoft now does this by default, but check your Group Policy hasn’t undone it).
5. Ransomware
Ransomware encrypts systems and data, demands payment, and these days the group has usually stolen a copy of your files first so they can threaten to leak them too. The ransomware is the payload, not the way in. Entry comes through another vector on this list, typically a phished credential, exposed RDP, or an unpatched VPN. Whether you pay usually comes down to backups. Operators go looking for the backup console with the domain admin account they stole, so keep copies offline or immutable, and restore from them in a test instead of trusting a green job status. Segmentation and EDR slow the spread; closing the entry vectors above keeps them out.
6. Unpatched software vulnerabilities
Once a vulnerability is public, mass scanning for it starts within hours, and exploitation usually begins well before most organisations have patched. Edge devices have been the headline problem for several years: VPN gateways, firewalls, and file-transfer appliances like MOVEit. Defence: patch by exposure, not by CVSS score alone. A VPN gateway with a medium score outranks an internal print server with a critical one, and anything on CISA’s Known Exploited Vulnerabilities list jumps the queue with an SLA measured in days. Judge the vulnerability management program on how fast findings close. A report that counts scan findings only proves the scanner runs.
7. Zero-day exploits
A zero-day is a vulnerability exploited before a patch exists, so patching is off the table and the question becomes how far an attacker gets after using it. What you still control is the blast radius. A compromised web server shouldn’t be able to reach the domain controllers, its service account should have almost no rights, EDR should flag the odd child process, say a web server spawning PowerShell, and a WAF or IPS rule can act as a virtual patch until the vendor ships one.
8. Insider threats
An insider threat is a current or former employee, contractor or partner who misuses legitimate access. The malicious version is the salesperson exporting the CRM a week before starting at a competitor. The negligent version is far more common, the engineer pasting a customer table into a public chatbot, for instance. Firewalls don’t help. Deprovision on the day someone leaves, including SaaS apps signed up for outside SSO, which is where former staff usually still have a login. Keep access at least privilege, put data loss prevention on the obvious exits such as personal webmail and USB, and use user behaviour analytics so a bulk CRM export raises an alert before the resignation letter does.
9. Misconfiguration and exposed services
Public cloud storage buckets, default admin passwords, RDP open to the internet, an “allow any” firewall rule left over from a test: misconfiguration is the attack vector that takes no skill to exploit, only Shodan or a mass scanner. Look at yourself from outside first. Scan your own IP ranges and domains the way Shodan does and kill whatever shouldn’t answer. Then hold the line with hardened baseline configurations (CIS Benchmarks are a reasonable start) and cloud security posture management, so a bucket made public on a Friday gets flagged before Monday.
10. Web application attacks (SQL injection and XSS)
Applications that trust user input let attackers inject their own instructions. SQL injection reads or changes your database directly; a single quote in a search box that produces a database error is the classic first sign. Cross-site scripting (XSS) runs the attacker’s JavaScript in other users’ browsers, often to steal session tokens. Defence: parameterised queries end SQL injection, because input is never parsed as SQL. XSS needs output encoding for whatever context the data lands in, plus a Content Security Policy. A web application firewall is a backstop, not the fix. Test against the OWASP Top Ten during penetration testing, with someone running Burp Suite who also reads the code.
11. Man-in-the-middle and session hijacking
On unencrypted or badly configured connections an attacker can sit in the path and read or change traffic, picking up credentials and session tokens as they go. Public Wi-Fi and rogue access points with a convincing SSID are the classic settings, though AiTM phishing proxies now do the same thing over the internet. Defence: TLS everywhere with HSTS, Secure and HttpOnly cookie flags, VPN or zero-trust access for remote staff, and certificate monitoring.
12. Supply chain and third-party compromise
Breaching one supplier to reach its customers is efficient, which is why attackers keep doing it. SolarWinds was a poisoned software update; Kaseya went through a managed service provider’s tooling; plenty of smaller incidents start with a vendor who had a permanent VPN account with far more access than they needed. Your attack surface includes everyone you trust. Defence: vendor security assessments, least-privilege and time-limited third-party access, an SBOM for the software you depend on, and treating vendor connections as untrusted networks.
What are the 4 types of attacks?
A framing you’ll see in textbooks and some certification syllabuses splits cyber attacks into four types: passive attacks (interception and eavesdropping), active attacks (modification, malware, denial-of-service), insider attacks (misuse of legitimate access), and close-in / physical attacks (hands on a device or inside a building). The most exploited vulnerability categories line up with it closely, being unpatched software, misconfiguration, weak or stolen credentials and plain human error.
How attackers actually exploit attack vectors
Real breaches chain vectors together. The attacker maps your attack surface and finds your finance team on LinkedIn (passive). They send a targeted phishing email to five finance employees (social engineering), and one enters a password on a fake Microsoft 365 login page. They sign in using a legacy protocol like IMAP that doesn’t enforce MFA (misconfiguration), move laterally through an internal server that missed last quarter’s patches (vulnerability exploit), and finally deploy ransomware across the file servers (active payload). Any one of those links, fixed, would have forced the attacker to improvise, and most crews would rather find a softer target than do that.
How to protect against common attack vectors
People come first, because phishing and social engineering start most breaches. Ongoing security awareness training with phishing simulation lowers click rates over time, but the bigger gain is staff who report a lure within minutes and become sensors instead of targets.
Credentials are the next cheapest win. MFA on every account, phishing-resistant where possible, a password manager, and a block on known-breached passwords.
Patch by risk, internet-facing and known-exploited first. Keep an inventory of what’s exposed and switch off services nobody uses, which shrinks the attack surface more than any tool. Assume breach anyway: segmentation, least privilege, EDR and backups you’ve tested mean a successful entry doesn’t automatically become a successful attack. Penetration testing and red team exercises then show you which attack vectors still work.
Frequently asked questions
What is an attack vector in cyber security?
The way a threat actor got, or could get, unauthorized access to a system or network: phishing, stolen credentials, malware, an unpatched vulnerability. MITRE ATT&CK files this under “initial access”, and that’s also the box it goes in on most incident report templates.
What are the most common attack vectors?
Phishing and social engineering, compromised credentials, weak passwords and brute force attacks, malware and ransomware, unpatched vulnerabilities, misconfiguration, insider threats, web application attacks such as SQL injection, and supply chain compromise. If you only have budget for two, put it into the first pair.
What is the difference between an attack vector and an attack surface?
The vector is the route actually used, such as a sprayed password on Outlook Web Access. The surface is everything they could have tried: domains, open ports, SaaS logins, vendor connections. You shrink a surface by switching things off and close a vector with a control.
What are the 12 most common types of cyber attacks?
Phishing, ransomware, malware, credential theft and stuffing, brute force attacks, denial-of-service, SQL injection, cross-site scripting, man-in-the-middle, insider threats, zero-day exploits and supply chain attacks.
How does security awareness training reduce attack vectors?
People are the vector attackers use most, and training is the only control aimed squarely at them. A user who clicked a simulated lure and was shown what they missed tends to remember it. A user who reports a real one within minutes gives the SOC time to purge the campaign from every other mailbox, which matters more than any individual click rate.