Attack Vector

Overview

An attack vector is the channel through which an adversary approaches a system, user, or process. Examples include phishing messages, exposed APIs, vulnerable software, malicious dependencies, stolen credentials, insecure wireless access, compromised vendors, or deceptive blockchain transactions.

A vector is not identical to a vulnerability. The vector describes the route or method, while the vulnerability is the weakness that permits harmful effect. One vector may exploit several weaknesses, and one weakness may be reachable through multiple vectors.

Defenders identify likely vectors through threat intelligence, architecture review, asset inventories, and incident history. Controls should reduce exposure, prevent exploitation, detect attempts, and limit impact because completely eliminating every route is rarely practical.

Dependencies can weaken Attack Vector even when the primary component behaves correctly.

An attack vector is the method or route an attacker uses to reach a target and attempt exploitation or unauthorized influence. Attack vectors describe how threats reach a target, helping teams place layered controls along the most plausible and damaging routes.

Assessment of Attack Vector should trace the use of to reach a target and attempt exploitation or unauthorized influence from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving unauthorized influence should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Attack Vector context should be tested against the architecture associated with unauthorized influence.

Retesting for Attack Vector should reproduce the Attack Vector context involving unauthorized influence, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.