Attack Vector

An attack vector is the route by which someone gains unauthorized access to a computer system. The word thus describes not the damage itself, but the path leading to it. A comparison helps: a burglar can come through the front door, the basement window, or the garage. Each of these possibilities would be its own attack vector. In computing, the typical routes are a fake email with a dangerous attachment, a guessed password, or a programming error in a piece of software. People count as well: anyone who talks an employee into revealing a password over the phone has used an attack vector.

Why security teams count paths instead of dangers

A defender must secure every path, while an attacker only needs a single one. This asymmetry is the core of the problem. That’s why it’s not enough to have a strong password if, at the same time, outdated software is running on the server. Anyone planning security therefore first lists all conceivable paths.

The sum of these paths is called the attack surface. It grows with every new device, every cloud service, and every external service provider. A company with a hundred laptops and twenty online services has a considerably larger attack surface than one with ten computers in its own basement. This is precisely why shrinking the attack surface is considered one of the most effective measures of all: a service that is switched off cannot be attacked.

For investors and news readers, the term is relevant because it explains the cost of an incident. After a major data breach, regulators almost always ask which vector was used and whether it was already known. If the vulnerability had been publicly documented for months and was nonetheless not closed, hefty fines are likely.

From the vulnerability to the breach

An attack usually unfolds in stages. First, the attacker searches for a vulnerability, meaning a flaw or an oversight. Then they exploit it in order to get in at all. Only afterward do they move further through the network until they reach the valuable data.

Roughly two families can be distinguished. Technical vectors target software: insecure interfaces, unpatched programs, open network access. Human vectors target users: phishing refers to fake messages designed to trick people into entering their credentials. In practice, both are combined, because that works most reliably.

A common misconception is to equate attack vector with vulnerability. The vulnerability is the defect; the vector is the path that leads through this defect. A single software flaw can open up multiple vectors, for instance via the website and additionally via the mobile app of the same provider. Conversely, not every vector requires a technical flaw: a stolen laptop without hard-drive encryption is a vector without any programming error at all.

New entry points through AI systems

In everyday life, you most often encounter the term in reports about data breaches. After an incident at a bank or an online shop, the press release often states which attack vector was used. Frequently it’s an email sent to a single employee. Your phone’s warnings to install an update also belong here: every update closes paths that were previously open.

AI has added new vectors. In a prompt injection, someone hides instructions in a text or on a webpage that an AI assistant later reads and follows. The model does not reliably distinguish between the user’s instruction and what is stated in the document it reads. As soon as an assistant has access to emails or files, this becomes a serious risk.

At the same time, language models are improving the old vectors. Phishing emails used to often be recognizable by spelling mistakes; today they are linguistically flawless and personally tailored. Security firms have therefore been reporting significantly rising case numbers for several years now. For companies, this means: the number of vectors is growing faster than individual ones can be closed.