Cybersecurity glossary
What is an Attack Vector?
Learn what an attack vector is, common vector types like network phishing and supply chain, how vectors differ from payloads, and how to shrink reachable entry paths.
Definition
An attack vector is the path or method an adversary uses to gain unauthorized access to a system, network, or user—such as a phishing email, exposed service, malicious USB, or compromised dependency—through which payloads and follow-on actions can be delivered.
Why naming the vector matters
Saying “we were hacked” teaches nothing. Naming the attack vector—phishing, RDP exposure, poisoned npm package—tells defenders which control failed and which budget line to fix.
Vectors are how strategy becomes checklist.
From vector to impact
Select a reachable opening
Adversaries choose email users, public CVEs, weak VPN, or trusted vendors.
Deliver or authenticate through it
Payload, exploit, or stolen credential crosses the boundary.
Establish initial access
Session, shell, or account control appears inside the environment.
Continue along an attack path
Additional techniques expand privileges and reach objectives.
Defenders close the vector class
Controls target the entry method so repeats fail earlier.
Common vector families
Identity & social
Phishing, MFA fatigue, help-desk takeover, password reuse.
Network & service
Exposed RDP/SSH, VPN flaws, unpatched edge appliances.
Application
SQLi, RCE, authz bypass on internet-facing apps and APIs.
Supply chain
Malicious updates, compromised build systems, tainted dependencies.
Mapping vectors to controls
| Vector | Primary control themes |
|---|---|
| Phishing / credential theft | Phishing-resistant MFA, mail filtering, user reporting |
| Exposed remote admin | Remove exposure, allowlists, PAM, patching |
| Public web RCE | Patch SLAs, WAF as interim, secure SDLC |
| Malicious dependency | Pinning, allowlists, SCA, signed artifacts |
| Physical / USB | Device control, boot protection, facility security |
- Label incidents and tabletop scenarios by initial attack vector.
- Inventory internet-facing services weekly—unknown exposure is a vector factory.
- Treat identity as a first-class vector, not only “network perimeter.”
- Track vendor and CI/CD trust relationships as supply-chain vectors.
- Align CVSS Attack Vector with your actual reachability when prioritizing.
- Measure reduction in successful vector classes over time, not only CVE counts.
- Assume multi-vector campaigns; closing one door is not the whole path.
- Feed vector trends into purple-team technique selection.
The practical takeaway
An attack vector is the method of first unauthorized reach. Name it, measure it, and remove it—then watch whether attackers simply pick the next door.
If your roadmap never mentions vectors, you are hardening randomly.
Related security terms
Attack Path
The multi-step journey that may begin with a single attack vector.
Attack Primitive
Reusable technique components used once a vector provides access.
Common Vulnerability Scoring System (CVSS)
Includes an Attack Vector metric describing how a vulnerability is reached.
Phishing-resistant MFA
Control that hardens a dominant identity-focused attack vector.
Exploitability
How readily a vector can be abused successfully in practice.
Frequently asked questions
What is an attack vector in simple terms?
It is the door an attacker uses to get in—email, a public website bug, a stolen password, a bad vendor update, and similar entry methods.
How is an attack vector different from malware?
The vector is the delivery or access method. Malware or scripts are payloads that may travel through that vector.
Is “Attack Vector” in CVSS the same idea?
Related. CVSS Attack Vector scores how remotely a vulnerability can be exploited (network, adjacent, local, physical).
What is the difference between vector and attack surface?
Attack surface is the set of exposed interfaces. A vector is a specific method that abuses one of those openings.
What are the most common vectors today?
Credential theft/phishing, exposed remote services, vulnerable internet apps, and supply-chain compromises frequently dominate.
Can one incident use multiple vectors?
Yes. Initial access may be phishing, then a different vector for lateral movement inside the network.
How do you reduce attack vectors?
Remove unnecessary exposure, harden identity, patch reachable services, filter email/web, and vet suppliers.
References
Explore authoritative guidance and frameworks related to attack vector.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.