Attack Vector.

An attack vector is the concrete route an adversary takes to breach a target: phishing email, exposed RDP, exploited public-facing CVE, leaked credential reused on another service, supply-chain dependency, malicious USB, or insider misuse. The MITRE ATT&CK framework groups vectors as Initial Access techniques such as T1566 (phishing), T1190 (exploit public-facing application), or T1078 (valid accounts).

Real breaches show how a single vector cascades. The 2021 Colonial Pipeline shutdown began with one leaked password on a legacy VPN account that lacked MFA — DarkSide operators reused a credential harvested from a dark-web dump. The 2023 Cl0p campaign against MOVEit Transfer exploited CVE-2023-34362, an unauthenticated SQL-injection flaw (CVSS 9.8), to plant the LEMURLOOT web shell (disguised as human2.aspx) and exfiltrate data from thousands of organizations. SolarWinds (2020) illustrated a software supply-chain vector, poisoning the Orion build pipeline.

Defenders use attack-vector analysis to map threats to controls: MFA blocks credential-reuse vectors, EDR catches malware delivery, secure email gateways filter phishing, network segmentation limits RDP exposure, and disciplined patching shrinks the window for exploit-based vectors. Reducing attack vectors is a direct way to shrink the attack surface.

flowchart LR
  A[Adversary] --> B{Choose vector}
  B --> C[Phishing T1566]
  B --> D[Exploit CVE T1190]
  B --> E[Stolen credentials T1078]
  B --> F[Supply chain]
  C --> G[Initial access]
  D --> G
  E --> G
  F --> G
  G --> H[Lateral movement]
  H --> I[Data theft or ransomware]