An attack vector names the route an adversary uses to reach a target, such as a stolen password, a harmful file, or an exposed service.
Naming the route helps defenders place controls, and it is broader than any one exploit or payload.
How it works
Teams list vectors so they can see whether a risk arrives through people, software, suppliers, or exposed services.
The same actor may switch vectors when one path becomes expensive, which is why a single control rarely closes the whole problem.
A clear vector description stays at the level of the path and the impact, not the steps that would make the path work.
That keeps planning useful for patching, training, and access design without spreading operational detail.
Concrete examples
- A finance clerk receives a message that leads to a fake invoice portal and then enters a real password.
- An unpatched public service offers a route into a network that otherwise requires a staff login.
- A supplier account with broad access becomes the route an outsider uses to reach customer data.
Protective measures
- List the vectors that actually touch your critical processes and rank them by plausible impact.
- Close or monitor exposed services that are not required for customers or for daily operations.
- Train staff to report suspicious requests that ask for payment changes or unexpected credential entry.
- Review supplier access on a schedule so a partner route does not stay broader than the contract needs.
Related articles
The article What is a threat actor? describes who pursues a route, rather than the route itself.
The article What is a zero day attack? focuses on flaws that still lack a public vendor fix.
The article What is a brute force attack? covers repeated guessing against a secret such as a password.