What is an attack vector?
Definition
An attack vector is the route an attacker uses to reach a system, account or person, such as a phishing email, a stolen password or an unpatched flaw, in order to carry out an attack.
- Category
- Attacks
- Also called
- attack path, threat vector
- Last updated
An attack is, in NIST's wording, malicious activity that tries to collect, disrupt, deny, degrade or destroy information system resources or the information itself. The attack vector is how it gets in. Think of the attack as the burglary and the vector as the unlocked back door.
NIST's description of advanced persistent threats lists three broad kinds of vectors: cyber, physical and deception. Cyber means technical routes such as software flaws or guessed passwords. Physical means getting hands on a device or a building. Deception means tricking a person into handing over access, which is what social engineering does.
Common examples
- Phishing. CISA describes phishing as social engineering in which the sender poses as a trusted party to get sensitive information or network access. Phishing by text is smishing, by phone call it is vishing.
- Stolen or reused credentials. If a password from one data breach works on your email, nobody has to break anything. This is the idea behind credential stuffing.
- Malware. A booby-trapped attachment, a fake app or an infected download that installs malware.
- Unpatched software. A known flaw in a phone, router or app that the maker has already fixed but you haven't installed.
CISA's #StopRansomware guide lists phishing and compromised credentials as separate initial access vectors, which shows how a single incident can start in more than one way.
Why it matters to you
Most people never face a technical break-in. They face a message that looks real, or a password that leaked years ago. Personal details that sit on data broker sites make those routes easier, because a scammer who knows your name, employer and relatives can write a far more convincing message.
Attack vector vs. attack surface
The vector is one route in. The attack surface is the total set of places an attacker could try. Closing one vector, say by turning on two-step verification, shrinks the surface but doesn't remove it.
How to protect yourself
- 1
Treat unexpected messages as the front door
Don't click links or open attachments you didn't ask for, even when the sender looks familiar. Go to the company's site or app yourself and check there.
- 2
Use a different password everywhere
A password manager makes this realistic. One leaked password then opens only one account.
- 3
Turn on two-step verification
Two-factor authentication stops a stolen password from being enough. Prefer an authenticator app or a security key over text codes where the service offers it.
- 4
Install updates
Switch on automatic updates for your phone, computer, router and apps, so known flaws get closed without you remembering.
- 5
Make personal details harder to find
The less an attacker can learn about you, the less convincing a scam is. Serus finds where your address and phone number are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the most common attack vector?
It depends on the year and the data set. CISA's ransomware guidance names phishing and compromised credentials among the main ways in, and both rely on tricking a person or reusing a leaked password rather than breaking technology.
What is the difference between an attack vector and a threat?
A threat is who or what could cause harm, such as a scammer or a piece of malware. The attack vector is the route that threat uses to reach you.
Is an attack vector the same as a vulnerability?
No. A vulnerability is a weakness, such as unpatched software or a reused password. The vector is the path an attacker takes through that weakness, or through a person's trust.
Sources
Something wrong or out of date? Tell us and we'll re-check it.