Threat Vectors and Attack Surfaces
Explain common threat vectors and attack surfaces
What you will learn
- Separate the attack surface from the vector, and know why shrinking the first comes before closing the second.
- Name the main vectors: message-based, file-based, voice, unsecure networks, and supply chain.
- Tell the phishing families apart — email, voice and SMS, and general from targeted.
- Explain why supply chain is a dangerous vector even when the victim did nothing wrong.
Confusing these two costs marks. The attack surface is the sum of the points an attacker could try: every open port, every running service, every employee with an inbox. The threat vector is the route actually taken in a particular attack. Shrinking the surface is continuous work; closing a vector is a response to an incident.
From surface to compromise
Attack surface
Everything that could be attacked — measured and reduced.
The vector
The chosen route: email, file, call, network, supplier.
Exploitation
A technical vulnerability, or a wrong human decision.
Initial access
And from here the rest begins: persistence and lateral movement.
The main vectors
| Message-based | Email, SMS and instant messaging. By far the most used, because it reaches every employee. |
|---|---|
| File-based | A document, image or archive carrying a payload. The attachment that looks like an invoice. |
| Voice call | A call impersonating IT support or the bank. It bypasses every email filter by not being email. |
| Unsecure networks | Open or public wireless, Bluetooth, or a wired network with no port control. |
| Removable device | A USB drive left deliberately for someone to find and plug in. |
| Vulnerable / unsupported software | Software with a known flaw, or a system past end of support so no patch exists at all. |
| Supply chain | A supplier, a service provider, or a software library. The victim did nothing wrong — the trust itself is the route. |
| Default credentials | A device deployed with factory credentials. It needs no exploit, just a login. |
Social engineering
| Phishing | Phishing by email, sent to everyone. |
|---|---|
| Vishing | Voice phishing, over a call. |
| Smishing | Phishing over SMS. |
| Spear phishing | Aimed at one person or team, built on information gathered about them. |
| Whaling | Targeted phishing aimed specifically at senior executives. |
| BEC | Business email compromise: impersonating an executive to request a transfer or data. |
| Pretexting | Building a story that justifies the request: "I'm from audit and I need the file today." |
| Watering hole | Compromising a site the target habitually visits, instead of attacking them directly. |
| Typosquatting | Registering a domain that differs from the real one by a single character. |
The medium decides the name
The act is the same and the name changes with the medium: email = phishing, call = vishing, SMS = smishing. Then ask about targeting: everyone = general, one named person = spear, a senior executive = whaling. Read the medium first, then the targeting.
Real-world example: a call that needs no vulnerability
Someone calls the service desk saying they are new in sales, and names their manager, their branch number and their start date — all published on a professional network. They ask for a password reset because they are "in a client meeting in ten minutes". The agent helps. Not one vulnerability was exploited: the vector is a voice call, the technique is impersonation built on a pretext, and the reconnaissance came from open sources. The control that stops this is not technical; it is a verification procedure that does not accept urgency as a reason to skip it.
"We have a strong email filter"
A filter covers one vector. A call, an SMS, a USB stick and a supplier all bypass it trivially, because they never pass through it. Defending one vector is not defending the surface.
What matters on the exam
- "Attack surface" means what could be attacked; "vector" means the route used. The question uses both words precisely.
- Supply chain is the answer when the compromise arrives through a trusted supplier or a signed update. Existing trust is what was exploited.
- Default credentials need no vulnerability. If a question mentions a device deployed as it came from the factory, that is the vector.
- Urgency, authority and fear are the markers of social engineering. If the question leans on time pressure, the answer is human, not technical.
Quick check
Answer in your head first, then reveal.
A text message claims your parcel is held and asks you to tap a link to pay. What is this called?Reveal the answer
Smishing — phishing over SMS. The act is phishing; the SMS medium is what fixes the name.
What separates the attack surface from the vector?Reveal the answer
The surface is everything that could be attacked: ports, services, people. The vector is the route taken in a specific attack. The surface is continuously reduced; a vector is closed after an incident.
A company is breached through a signed update from a software supplier it trusts. Which vector?Reveal the answer
Supply chain. The victim made no mistake and skipped no control — they did the right thing by installing a signed update. Legitimate trust is what was exploited, which is why it is so hard to defend.
Why is spear phishing more dangerous than the general kind?Reveal the answer
Because it is built on reconnaissance: it names real people, live projects and context the target recognises, so the cues people normally rely on — clumsy wording and generic greetings — are absent.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.