Definition
An attack vector is the route or method an attacker uses to get into a system or network, such as a phishing email, stolen credentials, an unpatched vulnerability or a misconfigured service.
What an attack vector is
An attack vector is the specific route or method an attacker uses to get into a system, network or application. It answers a simple question: how did they get in?
Every organisation has many possible attack vectors at once. Some are technical, such as an unpatched VPN or an exposed admin panel. Others target people, such as a convincing phishing email. Attackers usually pick the one that needs the least effort for the most access.
Common attack vectors
- Phishing and social engineering: emails, messages or calls that trick someone into clicking a link, opening a file or sharing a password
- Stolen or weak credentials: passwords bought from leaks, guessed, reused across sites or tried at scale through credential stuffing
- Unpatched vulnerabilities: known flaws in software, operating systems or network devices that have a public exploit
- Misconfigurations: open storage buckets, default passwords, exposed admin interfaces or overly broad permissions
- Exposed remote access: RDP, SSH or VPN services reachable from the internet without strong protection
- Web application flaws: injection, broken access control, insecure APIs and other application bugs
- Supply chain and third parties: a compromised supplier, software update or integration with access to your systems
- Malicious insiders: employees or contractors who misuse the access they already have
- Physical access: lost devices, USB drives or an unattended office network port
Attack vector vs attack surface vs attack path
| Term | What it means | Example |
|---|---|---|
| Attack surface | All the possible points of entry | Every exposed service, app and account |
| Attack vector | One specific way in | A phishing email or an unpatched VPN |
| Attack path | The chain of steps from entry to a target | VPN flaw → admin account → customer database |
In short, the attack surface is everything that could be attacked, an attack vector is how one attack gets in, and an attack path is where it goes from there.
Active and passive attack vectors
Active attack vectors change or disrupt something: exploiting a vulnerability, running malware or brute-forcing a login.
Passive attack vectors gather information without changing anything: monitoring unencrypted traffic, reading exposed files or collecting details about staff for a later phishing campaign. They are harder to detect because nothing visibly breaks.
Attack vector in CVSS
In the Common Vulnerability Scoring System, "Attack Vector" is also the name of one of the base metrics. It describes how close an attacker needs to be to exploit a vulnerability:
| Value | Meaning |
|---|---|
| Network | Exploitable remotely, for example over the internet |
| Adjacent | Needs access to the same local network or segment |
| Local | Needs local access or a logged-in session on the system |
| Physical | Needs to physically touch the device |
The more remote the attack vector, the higher the CVSS score, because more attackers can reach the vulnerability.
How to defend against attack vectors
- Know your attack surface: keep an inventory of what is exposed, so you know which vectors exist.
- Patch quickly, starting with internet-facing systems and vulnerabilities that are known to be exploited.
- Protect identities with multi-factor authentication, strong password rules and least-privilege access.
- Fix misconfigurations and remove services, ports and accounts you do not need.
- Train people to recognise phishing and make reporting it easy.
- Review third-party access and limit what suppliers and integrations can reach.
- Test regularly: confirm which vectors are actually exploitable in your environment and re-test after fixes.
How Plainsea helps
Plainsea tests the attack vectors a real attacker would try within the scope you set: exposed services, web applications, misconfigurations and weak credentials. AI agents attempt to exploit each one and follow it as far as it goes, so you see not just the way in but the attack path behind it. Every finding is confirmed exploitable before it reaches you, and fixes can be re-tested on demand.