Stop 01 · Cybersecurity FoundationsTopics · 4/9

Common Attack Vectors Overview

In short

Attackers rarely invent new tricks. Most breaches walk in through the same few doors: a fake email, a reused password, an unpatched server. Learn the doors and you know where to stand guard.

The typical ways attackers gain access — phishing, malware, unpatched vulnerabilities, weak credentials, social engineering — most breaches trace back to a small handful of recurring root causes.

The blob inspects a small house with a magnifying glass, spotting a key under the doormat.

Think of it like this

All the ways into a house

A thief doesn't need to break the main lock. An open window, a spare key under the doormat, or a helper who opens the door to anyone in a courier uniform works just as well. Attack vectors are those ways in.

Watch it happen

The usual ways in

Ways in

People

Technology

Phishing

Weak passwords

Unpatched bugs

Misconfiguration

Third parties

1/6An attack vector is the path an attacker uses to get a first foothold.

The big ideas

What you need to know

People are the top target

It's easier to fool a person than to break good encryption. That's why phishing never goes away.

Credentials are gold

Stolen or guessed passwords let attackers log in like a normal user, which is hard to spot.

Known bugs, not zero-days

Most exploited flaws already have a patch. Slow patching is the real problem.

Close the common doors first

MFA, patching, phishing training and sane defaults block a big share of real attacks.

Save yourself the pain

Common mistakes

Oops

Worrying about rare, fancy attacks while basic gaps stay open.

Do this instead

Fix the boring doors first: MFA everywhere, patch on time, remove default passwords.

Oops

Blaming the user who clicked and stopping there.

Do this instead

Ask why one click was enough. Good design means a single mistake can't sink the whole company.

Your mission

Audit your own attack surface

~20 min

Quick check

An attacker logs in to a company VPN using a password leaked from an employee's old gaming account. What is the vector?

Go deeper

1Research the top reported attack vectors from a recent industry breach report.
2Learn why phishing remains one of the most common entry points despite being 'low-tech'.
3Understand that most breaches exploit known, patchable weaknesses, not exotic zero-days.