Top 10 Types of Cyber Attack Vectors

An attack vector is any path a threat actor uses to get into your network, systems, or data. There are dozens of named variants in security literature, but in practice a handful of them account for the overwhelming majority of real incidents. Knowing which ones actually matter this year, rather than which ones made headlines five years ago, changes where you put your limited defensive budget.

The 2026 Verizon Data Breach Investigations Report, built from more than 22,000 confirmed breaches across 145 countries, is the best current benchmark for this. The numbers in it have moved enough in the last two years that a lot of older attack vector guides are now describing a threat picture that no longer exists. "The 2026 DBIR makes clear that attackers continue to prioritize the most reliable paths to compromise, such as exploiting unpatched vulnerabilities, leveraging compromised or weak credentials, and scaling social engineering with speed and efficiency," said Phyllis Lee, Vice President of CIS Security Best Practices Content Development, commenting on the report's findings to Help Net Security. "Organizations that focus on proven, prioritized security controls and timely remediation are better positioned to reduce risk and disrupt these common attack patterns."

How attackers actually use these vectors

Broadly, attacks fall into passive and active categories. A passive attack is reconnaissance: harvesting information about a target without touching or altering anything, which makes it hard to detect. An active attack is the exploitation itself, an attempt to gain access, damage, or exfiltrate. Most real intrusions combine both: weeks of quiet information gathering followed by a fast, decisive active phase once the attacker has enough to work with.

The attack vectors that matter most right now

1. Vulnerability exploitation, now the leading initial access vector

For the first time in the DBIR's nearly two-decade history, exploiting a software vulnerability is the single most common way attackers get in. It accounted for 31% of all breaches in the 2026 report, up from 20% the year before, a 55% increase in twelve months that pushed it past both phishing and credential abuse.

The reason this vector has become so dominant is remediation speed, or the lack of it. Verizon's data, aggregated across more than 13,000 organizations and 527 million vulnerability instances, found organizations take a median of 43 days to fix a known-exploited vulnerability, and only 26% get fully remediated at all. Mandiant's M-Trends 2026 report puts the mean time to exploit at negative seven days, meaning exploitation is, on average, already happening before a patch ships. Web applications, VPNs, and remote access infrastructure remain the most commonly targeted asset categories. See our guide on patch management policy for how to structure a defense against this specifically.

2. Credential-based vectors: compromised, weak, and reused logins

Credential abuse dropped to the second most common vector this year at roughly 13% of breaches, per the DBIR's headline figures, but it remains deeply intertwined with other categories: phishing, third-party compromise, and social engineering all frequently end in stolen credentials as the actual mechanism of entry. Weak passwords, default accounts left unchanged, and credential reuse across multiple systems all compound the risk. Multi-factor authentication remains the single most effective mitigation here, though it is not foolproof on its own, see the next section.

3. Voice phishing and help desk social engineering

This is the vector that changed the most since the last time this topic was widely covered. Email phishing, dominant for years, has seen a sustained decline in Mandiant's data. Voice phishing (vishing) climbed to the second most common initial infection vector Mandiant observed in 2025, appearing in 11% of investigations where a vector could be identified, with exploits still first at 32%.

The reason interactive social engineering has grown is straightforward: it bypasses automated technical filters entirely because there is no malicious link or attachment to scan. The group publicly associated with Scattered Spider has run campaigns specifically targeting IT help desks, calling and impersonating employees to request password resets or multi-factor authentication changes. A related 2025-2026 campaign tied to ShinyHunters and Scattered Spider tactics reportedly targeted more than 760 companies using exactly this approach: attackers called employees, posed as internal IT staff, and walked victims through steps that handed over access. If your help desk doesn't have a strict, non-negotiable identity verification procedure for password and MFA reset requests, this is the gap that gets exploited.

4. Malicious and compromised insiders

Insider risk covers disgruntled employees, malicious contractors, accidental leaks, and employees whose own accounts have been compromised without their knowledge. This category has gotten more expensive to manage: the 2026 Ponemon Institute Global Cost of Insider Risks report found average annual insider risk cost climbing to $19.5 million per organization, up from $17.4 million the year before. Credential theft incidents specifically averaged $842,462 per incident, up from $779,707 in 2024, and the average number of these incidents per organization rose from 4.8 to 5.3 year over year. For more depth on detection signals, see our guide to insider threat indicators and prevention.

5. Misconfiguration

Misconfigured cloud storage, exposed admin panels, and devices left with default settings remain a persistently easy entry point precisely because they require no exploit development at all, just a scan for the obvious mistake. Mandiant's 2025 investigations documented threat actors exploiting misconfigured Active Directory Certificate Services templates to create administrator accounts exempt from multi-factor authentication entirely, a specific and increasingly common technique worth flagging to your internal AD administrators directly.

6. Third-party and supply chain compromise

This vector has grown faster than almost any other category the DBIR tracks. Third-party involvement in breaches jumped 60% year over year, reaching 48% of all breaches in the 2026 report. A meaningful chunk of that traces back to basic access hygiene: only 23% of third-party organizations fully remediated missing or misconfigured multi-factor authentication on their cloud accounts, and 37% had at least one admin account with MFA disabled entirely on an infrastructure-as-a-service platform. The 2013 Target breach, a frequently cited example in this category even years later, was executed through a compromised HVAC vendor's network access, and Target ultimately paid $18.5 million in settlements. The lesson from that incident still holds: your security posture is only as strong as your weakest vendor's access controls, and that vendor is rarely the one you'd expect to worry about.

7. Ransomware, still climbing despite falling payment rates

Ransomware now appears in 48% of all breaches tracked in the 2026 DBIR, the highest share the report has recorded. There's a genuinely interesting nuance here: 69% of ransomware victims did not pay, up from 65% the year before, and the median ransom payment actually dropped to $139,875. Attackers are winning initial access at a growing rate. They're having more trouble monetizing it, mostly because more organizations now have workable backups and are willing to refuse payment. IBM's 2026 Cost of a Data Breach Report notes that 39% of breached organizations experienced at least one ransomware attack in the past 12 months, up from 24% in 2023, and that operators increasingly threaten public data leaks and brand-shaming as pressure tactics rather than relying purely on encryption, with 41% of 2026 ransomware attacks including this reputational threat component.

8. AI-driven attacks, a genuinely new category

This wasn't a meaningful line item in attack vector discussions a couple of years ago. IBM's 2026 data found a 56% year-over-year increase in AI-driven attacks, with one in four organizations reporting they'd experienced one in the past year. AI deepfake and impersonation made up 45% of these AI-driven attacks, with AI-generated malware at 19% and AI-generated phishing content at 17%. These attacks carry a real financial premium too: an AI-driven breach adds roughly $1 million to the average breach cost compared to a non-AI-driven incident, and most of the targeting so far has concentrated on critical infrastructure, particularly financial services and energy.

9. Open ports and exposed network services

An open port is a listening connection point, and attackers scan for them constantly, looking for services that shouldn't be internet-facing or that are running outdated, vulnerable software. This remains a low-effort, high-yield reconnaissance step for attackers precisely because so many organizations still don't maintain a current inventory of what's actually exposed to the internet. CISA's own guidance now explicitly recommends agencies "inventory and minimize your internet-facing footprint" as a direct response to rising AI-augmented vulnerability discovery tools, a recommendation that applies just as well outside the federal sector.

10. Eavesdropping and network interception

Whether through physical wiretapping or, far more commonly now, interception of unencrypted traffic on poorly secured networks, eavesdropping remains a viable vector wherever encryption in transit is incomplete. This risk compounds with weak encryption practices generally, using outdated ciphers or failing to enforce TLS everywhere creates the same exposure as no encryption at all in practical terms.

What actually reduces your exposure across these vectors

A comprehensive defense has to cover technical controls and human behavior at the same time, since the vectors above span both categories almost evenly:

• Patch based on exploitation risk, not just severity score. Given that median remediation now runs 43 days against a negative seven-day exploitation window, prioritization matters more than raw patching speed. See our guide to patch management policy for the current approach CISA itself has adopted.
• Train staff on vishing specifically, not just email phishing. Given how far voice-based social engineering has climbed, a help desk verification protocol that assumes every caller could be an attacker impersonating an employee is no longer excessive caution, it's baseline practice.
• Audit third-party access on a fixed schedule. With third-party involvement in breaches up 60% year over year, treat vendor access reviews with the same rigor as internal employee offboarding.
• Enforce MFA everywhere, including admin accounts on cloud platforms. The gap in third-party MFA coverage cited above is a solvable problem, and closing it is far cheaper than recovering from the breach that exploits it.
• Maintain a current external asset inventory. You cannot defend what you don't know is exposed to the internet.

None of this makes a business invulnerable. No combination of controls does. But attackers overwhelmingly go after the easiest available target, not the best-defended one. As Daniel Lawson, SVP of Global Solutions at Verizon Business, put it in the official release of the 2026 DBIR: "While the velocity of cyber threats, driven by AI and faster vulnerability exploitation, is increasing, the foundational principles of security and strong risk management remain the most effective defense." Consistently closing the vectors above, even imperfectly, moves you out of the easy-target category, which in practice is most of what effective security actually buys you.