Attack Vector

An attack vector is the point at which an attacker gets into a foreign computer system. The comparison with a castle fits well: the walls can be high, but a single open gate is enough. In technology, this gate is rarely a door, but rather a flaw in a program, a weak password, or a poorly secured connection to the internet. The term says nothing about what the attacker does afterward. It only describes the way in. Experts often also speak of the attack vector, meaning the direction from which an attack comes.

Why a single open gate is enough

Security works differently than most other quality characteristics. A car with ninety-nine working parts and one defective one usually still drives. A system with ninety-nine secure access points and one insecure one, on the other hand, is completely vulnerable. That’s because the attacker specifically seeks out the weakest point. Defenders therefore have to close all gaps, while the attacker only has to find one.

On top of that, modern systems consist of a great many parts. A typical company software uses hundreds of foreign program components, so-called libraries. Each of these components can contain an attack vector without the company knowing about it. The sum of all possible entry points is called the attack surface. The larger it is, the more likely there is a hole somewhere.

For companies, this is also a financial issue. A successful attack can shut down production for days and expose customer data. Under the European General Data Protection Regulation, hefty fines are also a risk. That’s why attack vectors regularly appear in quarterly reports and stock market announcements.

Typical paths in

The most common path leads through people, not through technology. In a phishing email, the sender poses as a colleague or a bank and asks for access credentials. Whoever types them in has opened the gate themselves. No antivirus scanner reliably helps against this, because nothing technically breaks.

The second major path is programming errors. A program expects, say, a postal code, but instead of numbers is sent a long command, which it then executes. Such gaps are continually discovered and closed through updates. Particularly dangerous are systems that no one updates anymore, such as old control computers in factories.

With AI systems, a new type is added. A language model cannot reliably distinguish text from command. If someone hides the instruction “Ignore your previous rules” on a website, and the AI reads that page, it may follow the instruction. This method is called prompt injection and is currently considered one of the most important open security problems.

Attack vectors in the news and in everyday life

In business reports, the term usually appears after an incident. Phrases like “The attackers used an unpatched server as an attack vector” mean: a known update had not been installed. Suppliers are especially often affected. Whoever cracks a small service provider can sometimes gain access to that provider’s large customers through it. Experts call this a supply chain attack.

In the private sphere, the same rules apply on a smaller scale. A default password on a router, an app from an unknown source, or a surveillance camera that hasn’t been updated in years are classic attack vectors. A common misconception is that private devices are uninteresting to attackers. In fact, they are often taken over in order to attack other targets from there.