Initial access

Hand-drawn sketch: Only a few first holds. Every intrusion needs a first foothold, and the routes are few: phishing, exposed services, stolen credentials and trusted third parties.

Every intrusion starts somewhere, and the routes are a short and stable list.

Phishing, stolen credentials, an unpatched internet-facing service, a supplier, or something exposed that should not have been. The list barely changes year to year, which is unusually useful: a small number of defences cover most of the ways anybody gets in at all.

Checked against the primary source.

Initial access

More on Threat actors & ATT&CK