Attack Vector

An attack vector is the specific route an attacker uses to gain unauthorized access to a system or organization — the how of an intrusion. Vulnerability exploits, stolen credentials, malicious attachments, compromised vendors, and infected USB drives are all vectors. The sum of every vector an organization exposes is its attack surface, and the most consequential shift of the past decade is where that surface now concentrates: with the Verizon DBIR attributing 62% of breaches to the human element, the busiest routes now run through people rather than software.

How it works

Attackers pick vectors by cost and yield, and they enumerate before they strike. On the technical side that means scanning for exposed services and unpatched software. On the human side it means OSINT: harvesting names, roles, and email patterns from LinkedIn and press releases to work out who approves payments, who administers identity, and who joined last month. Each employee adds addressable entry points — an inbox, a phone number, MFA push prompts, help-desk tickets — and every unsanctioned tool they sign up for adds more (shadow IT is a set of vectors the security team cannot even see). Vectors also chain: a phishing email delivers a credential harvester, the stolen password enables an MFA-fatigue push flood, and a help-desk call finishes the job. The initial vector named in a breach report is usually just the first link.

How to defend against it

You cannot defend a vector you have not mapped, and most organizations map their machines far better than their people. Reduce the technical routes with patching, least privilege, and decommissioning what is unused. Then apply the same discipline to the human layer: inventory who holds risky permissions and money-moving authority, identify which roles are most targeted, and measure how they actually respond to the vectors attackers really use — through simulation across email, SMS, voice, and QR channels, not email tests alone. A quantified human risk score per team turns the human side of the map from an anecdote into a managed metric — the foundation of human risk management.