The few ways most breaches start

News stories about cyberattacks often make attackers sound like geniuses using unstoppable techniques. The reality is more ordinary. Industry incident reports published every year, such as the Verizon Data Breach Investigations Report, keep finding the same entry points at the top of the list.

The common entry points

1. Stolen or weak credentials. Passwords reused from a breached website, guessed, or captured by a fake login page. Once an attacker has a valid login, they look like a normal user.
2. Phishing and social engineering. Messages that trick people into clicking a link, opening a file, approving a login request or sending money.
3. Exploited vulnerabilities. Unpatched software exposed to the internet, such as VPN appliances, web applications and file transfer tools. Attackers scan the whole internet for known weaknesses within days, sometimes hours, of public disclosure.
4. Misconfiguration. Cloud storage left public, admin panels exposed, default passwords never changed.
5. Third parties and supply chain. A compromised supplier, software update or library becomes a path into many organisations at once.

What attackers want

Most attacks are about money. Ransomware groups encrypt or steal data and demand payment. Fraudsters redirect invoices or payroll. Others steal data to sell, or hijack computing resources. Some attacks are espionage or activism, but for most organisations and individuals the threat is financially motivated crime operating at scale.

Why this is good news

Because the entry points are well known, so are the defences. A handful of controls stop a large share of real attacks:

• Multi factor authentication, ideally phishing resistant, on every important account.
• A password manager and unique passwords everywhere.
• Prompt patching of internet facing systems and devices.
• Reliable, tested backups that attackers cannot delete.
• People who know how to recognise and report suspicious messages.

The attacker's path

After getting in, attackers usually explore, raise their privileges, move to more valuable systems and only then act: stealing data or deploying ransomware. This takes time, from hours to weeks. That gap is your opportunity: good logging and monitoring can catch intruders before they reach their goal.

In the next lessons we build the vocabulary to reason about these risks, then go through each control in turn.