An attack vector is the route or method a threat actor uses to reach and affect a target. It is the how of an intrusion: the path taken to gain initial access or to move further once inside. Vectors can be technical, social, or physical: for example a crafted request to a vulnerable web function, a message that tricks a user into running code, or entry through an unattended port or console. Each vector depends on a specific weakness and the context around it, such as exposed services, misconfigurations, weak credentials, or permissive physical access. In risk terms, the vector is different from the attack surface: the surface is every possible entry point, while the vector is the particular entry point used in an event. Analysts often group vectors by phase (initial access, persistence, lateral movement, data exfiltration) and map them to frameworks like MITRE ATT&CK to describe behaviour consistently. Understanding likely attack vectors helps explain how incidents happen and which controls block or detect them.
