What it means
Attack vectors describe how an attack is delivered or initiated. Examples include phishing messages, stolen credentials, exposed remote services, malicious websites, removable media, supply-chain compromise, vulnerable applications, and abuse by an insider. The vector is the avenue of approach, not necessarily the vulnerability or the complete attack sequence.
How it works
Organizations identify vectors by examining how users, devices, applications, vendors, networks, and physical locations connect to important assets. Each vector has different prerequisites and observable signals. Effective defense layers preventive controls, detection, response, and recovery around the vectors most relevant to the organization.
A phishing email is an attack vector. A user opening a malicious attachment may exploit a software vulnerability, establish a foothold, and begin an attack path. Keeping these terms distinct makes analysis and communication more precise.
Practical focus
- Catalog vectors across people, technology, facilities, and third parties
- Connect each vector to likely threats, affected assets, and available controls
- Use incident and threat-intelligence evidence to update priorities
- Test whether preventive and detective controls cover the same vector
Common mistakes
- Using attack vector, vulnerability, exploit, and attack path as interchangeable terms
- Focusing only on internet-facing technology
- Assuming a blocked delivery attempt means the underlying vector is no longer relevant
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: