Common Threat Vectors and Attack Surfaces

Not sure you’re ready?

Take the ~3-minute readiness diagnostic and see where you stand.

In physical engineering, the larger the exposed surface area of a structure, the more points of potential failure must be monitored, reinforced, and defended. The same absolute law governs network engineering and cybersecurity. As an organization adds servers, cloud instances, endpoints, and third-party integrations, it expands the physical and digital geography that adversaries can exploit. We define this total sum of all possible entry points into a system or network as the attack surface. Conversely, the threat vector is the specific path or method an attacker uses to traverse that surface and gain unauthorized access to a system. If the attack surface is the broad perimeter wall of a fortress, the threat vector is the specific grappling hook, tunneling machine, or forged letter of transit used to breach it.

To secure a modern IT environment, an administrator must possess a crystalline understanding of both the terrain they are defending (the surface) and the specific trajectories of incoming attacks (the vectors).

Before we can analyze how attackers break in, we must map the doors and windows they are trying to open. An organization's attack surface is not monolithic; it is a composite of four distinct domains.

Attack Surface Domain	Definition & Common Vulnerabilities
Network Attack Surface	Includes all open ports, wireless protocols, and network interfaces exposed to an attacker. Every active service listening on a network interface is a potential entry point.
Software Attack Surface	Comprises unpatched applications, vulnerable Application Programming Interfaces (APIs), and poorly written code. This is where buffer overflows and injection attacks occur.
Human Attack Surface	Represents the susceptibility of employees to social engineering and manipulation. Even the most hardened network can be bypassed if an administrator is tricked into handing over their credentials.
Physical Attack Surface	Includes unsecured building entrances, exposed network jacks, and accessible server rooms. If an attacker can physically touch a server or plug a device into a switch, digital defenses are largely rendered moot.

A conceptual diagram of a buffer overflow—a common vulnerability in the software attack surface where excess data spills into adjacent memory spaces.

Because this terrain is constantly shifting—as laptops connect to the network, spin-up cloud containers, and install new applications—security teams must engage in attack surface management.

Attack Surface Management is the continuous discovery, inventory, and monitoring of the IT assets of an organization. You cannot defend what you do not know you have.

Once attackers identify a vulnerability on the attack surface, they require a delivery mechanism to exploit it. These threat vectors are heavily weaponized versions of the standard communication and productivity tools your organization relies on every day.

Message-Based Threat Vectors

Message-based threat vectors utilize communication platforms to deliver malicious payloads or links. Because these platforms are designed to facilitate rapid information sharing, they are highly efficient distribution mechanisms for attackers.

Email: Attackers use email as a primary message-based threat vector to deliver phishing links and malicious attachments. Email inherently crosses the public internet to reach internal inboxes, bridging the outside world and the internal network.
SMS (Short Message Service): Text messages serve as a threat vector for smishing (SMS phishing) attacks. Because users naturally trust their mobile devices and SMS lacks the robust filtering layers found in enterprise email gateways, smishing is highly effective for stealing credentials or distributing malware.

An example of an SMS phishing (smishing) message designed to create a false sense of urgency and trick a user into clicking a malicious link.

Instant Messaging: Enterprise collaboration tools and public instant messaging platforms are often exploited to distribute malicious links to users. The informal, rapid-fire nature of IM causes users to lower their guard, making them more likely to click a link without verifying its destination.

File-Based Threat Vectors

File-based threat vectors rely on the execution of malicious code embedded within standard document types. We often think of documents as inert, static text, but modern business files are highly complex and capable of executing logic.

PDFs: Portable Document Format (PDF) files are universally trusted, yet they can contain malicious JavaScript designed to compromise a user system. Attackers exploit vulnerabilities in the PDF reader application itself when it processes this embedded script.
Office Documents: Microsoft Office documents can host malicious macros written in Visual Basic for Applications (VBA). While intended to automate legitimate repetitive tasks, VBA is incredibly powerful, allowing an attacker to write macros that download secondary malware payloads, alter system registries, or encrypt files the moment the document is opened.

Image-Based Threat Vectors

Perhaps the most deceptive mechanisms are image-based threat vectors, which conceal malicious code or redirection mechanisms within graphical files.

Steganography: This technique hides a secret message or malicious payload within an otherwise normal-looking image file. By altering the least significant bits of an image's color data, attackers can embed executable code that remains completely invisible to the human eye and often undetected by standard antivirus scanners.

Steganography enables attackers to hide malicious code or data within the seemingly benign layers of an image file. In this example, hidden numbers are only revealed under specific color filters.

Quishing (QR Phishing): Quick Response (QR) codes are simply machine-readable optical labels. Quishing attacks use malicious Quick Response codes to direct users to fraudulent websites. Because a human cannot read a QR code natively, the user has no way to verify the destination URL until their device has already processed the image and opened the browser.

The structure of a QR code highlights why they are dangerous threat vectors: they are entirely machine-readable, making it impossible for a human to visually verify the destination URL before scanning.

Beyond sophisticated malicious files, attackers frequently rely on misconfigurations and poor network hygiene to gain baseline access. These vectors do not require elaborate exploits; they simply require an administrator to leave the digital door unlocked.

Unsecure Networks

Unsecure networks lack proper encryption and expose transmitted data to interception. If an attacker sits between a user and their destination, unencrypted data can be captured natively.

Cleartext Protocols: Protocols like Telnet and File Transfer Protocol (FTP) transmit data without encryption. When an administrator authenticates over Telnet, their username and password travel across the network in plaintext, allowing anyone running a packet sniffer (like Wireshark) to capture the credentials perfectly intact.

A network protocol analyzer like Wireshark can intercept, decode, and display cleartext credentials transmitted over unsecure network protocols.

Open Wi-Fi Networks: These networks do not require authentication and transmit wireless traffic in plaintext. An attacker in a coffee shop or hotel lobby can passively capture the traffic of every user connected to that unencrypted network.
Rogue Access Points and Evil Twins: To force users onto unsecure connections, attackers deploy rogue access points or evil twins to intercept traffic on wireless networks. An evil twin broadcasts the exact same SSID (network name) as a legitimate corporate or public network. Devices automatically connect to it based on prior trust, routing all the victim's traffic directly through the attacker's hardware.

The Liability of Default Credentials

Default credentials are pre-configured usernames and passwords set by hardware or software manufacturers (e.g., admin / password). They are intended purely for initial setup.

Unfortunately, Internet of Things (IoT) devices—from security cameras to smart thermostats—are frequently deployed on networks with unchanged default credentials. Because these devices often lack robust user interfaces, administrators simply plug them in and forget about them.

Attackers do not search for these manually. They use automated network scanners and publicly available lists (often published in manufacturer manuals) to systematically guess default credentials across millions of IP addresses. Once a single IoT device is compromised, it becomes a beachhead—a foothold inside the network from which the attacker can pivot to high-value servers.

Internet of Things (IoT) devices, such as wireless IP cameras, are frequent targets for automated attacks because they are often deployed with unchanged factory default credentials.

Crucial Defensive Mandate: Organizations must change all default usernames and passwords prior to deploying any new device on a production network. This single operational rule eliminates an entire class of automated attacks.

Finally, we must consider the perimeter outside your direct control. The supply chain encompasses all third-party vendors, suppliers, and service providers interacting with an organization. You may lock down your own infrastructure perfectly, but if you inherently trust software and hardware from third parties, their vulnerabilities become your vulnerabilities.

A supply chain attack exploits vulnerabilities in a trusted third-party vendor to access the primary target. This threat vector bypasses traditional perimeter defenses because the malicious payload is delivered via a trusted, whitelisted channel.

A standard supply chain model. In a cybersecurity context, attackers exploit this trusted flow from upstream suppliers to bypass a target's primary perimeter defenses.

Software Supply Chains: Attackers compromise software supply chains by injecting malicious code into trusted open-source libraries or vendor updates. If a popular code library used by thousands of applications is poisoned, every system that downloads the updated library is instantly compromised.
Hardware Supply Chains: Hardware supply chain attacks involve tampering with physical components before delivery to the final customer. An adversary might intercept a router in transit, install a malicious microchip or backdoored firmware, and carefully repackage it. When the IT administrator unboxes and installs the router, the network is compromised from minute one.
Managed Service Providers (MSPs): MSPs provide IT administration and support for dozens or hundreds of client organizations, requiring deep, privileged access to their clients' networks. Consequently, MSPs are high-value targets because compromising one provider can grant access to multiple client networks. For an attacker, breaching an MSP is the equivalent of stealing a master skeleton key that opens every building in the city.

Just as a skeleton key is filed down to bypass the internal wards of multiple physical locks, compromising a Managed Service Provider (MSP) allows an attacker to implicitly unlock the networks of multiple client organizations.

As an IT or security professional, your operational reality is defined by managing these vectors and surfaces. The attack surface dictates what you must patch, harden, and monitor. The threat vectors dictate how you configure your email gateways, endpoint detection systems, and network encryption policies. By systematically shrinking the attack surface—disabling unused ports, patching software, and educating humans—and by interrupting threat vectors—blocking macros, enforcing encrypted protocols, and demanding strict supply chain audits—you construct a resilient environment capable of withstanding the inevitable assault.