How Does a Cyberattack Begin?

Imagine for a few minutes that you are on the other side.

Your goal is to gain access to an organization’s infrastructure. You do not have any credentials yet, you do not know the internal network, you do not know which security tools the organization uses, and you have probably never had any contact with anyone at the company.

Where do you start?

The answer may be simpler than it seems: the Internet.

Before attempting to break into anything, an attacker needs to discover what is out there. And that is exactly where many attacks begin.

Before the attack comes discovery

The first step does not necessarily involve malware, phishing, or any particularly sophisticated technique. The attacker starts by looking for information about the organization and its exposed infrastructure:

• Domains and subdomains.
• IP addresses.
• Web applications and APIs.
• Remote access portals.
• Exposed services.
• Cloud infrastructure.
• Technologies and software versions in use.

Much of this information may be publicly accessible.

MITRE ATT&CK itself describes this stage as Reconnaissance (TA0043): the adversary gathers information that can be used to plan future operations.[1]

Techniques documented by MITRE include Active Scanning (T1595), Gather Victim Network Information (T1590), and Search Open Technical Databases (T1596). Public DNS databases, digital certificates, and Internet scanning results can reveal IP addresses, hostnames, open ports, technologies, and other information useful to an attacker.[2][3][4]

In other words, the attacker begins by building a map of the organization’s attack surface — identifying domains, systems, services, technologies, and other assets that can be discovered and analyzed from the Internet.

Let’s think like an attacker

Imagine that this reconnaissance reveals dozens or hundreds of assets associated with the organization. Most may not be particularly interesting, but some can quickly attract attention:

• A subdomain points to an old application.
• An IP address has an administrative port accessible from the Internet.
• A VPN portal is exposed.
• An application runs a software version known to contain vulnerabilities.
• An API that should have restricted access responds publicly.
• An old server created years ago for a project is still online.
• A cloud storage service is misconfigured.
• An administrative panel or testing environment that no one on the security team remembered was published remains accessible.

For those defending the organization, there may be dozens or hundreds of assets to manage. For an attacker, finding one viable path is enough.

The attacker does not need to understand your entire infrastructure

This is an important point.

The attacker’s initial objective is not to fully understand the organization’s entire technology environment. It is to find an opportunity.

That is why certain elements naturally become priorities during reconnaissance:

• Known vulnerabilities in exposed systems: Especially when an exploit is available.
• Sensitive services accessible from the Internet: Such as VPN, RDP, SSH, administrative interfaces, or management tools.
• Legacy systems: Which may remain publicly accessible even when they no longer receive the same level of maintenance or updates.
• Misconfigured applications, APIs, and cloud infrastructure: Especially when they allow unauthorized access to data, interfaces, or resources.
• Forgotten or unknown assets: Often outside regular inventory, patching, and vulnerability management processes.

This is where reconnaissance and initial access begin to converge.

From discovery to an access attempt

Suppose our attacker finds a publicly accessible application running a vulnerable version. They can now research the technology, identify the vulnerability, and determine whether a known exploitation method exists.

In MITRE ATT&CK, this behavior is clearly represented by Exploit Public-Facing Application (T1190).

The technique covers the exploitation of weaknesses in Internet-facing systems — from applications and web servers to databases, services, network devices, and edge infrastructure. MITRE also highlights that exploiting applications hosted in cloud or container environments may provide additional paths to other components of the environment.[5]

Another path is External Remote Services (T1133). VPNs, Citrix, and other remote access mechanisms can serve as entry points. MITRE also covers scenarios involving exposed services without authentication and, in container environments, cites examples such as the Docker API, Kubernetes API Server, and kubelet.[6]

This helps challenge a common perception: a cyberattack does not always begin with someone clicking a malicious link. Sometimes, it begins simply because something that should not be exposed is accessible from the Internet.

Does this happen in practice?

Recent data helps illustrate the scale of the problem.

Mandiant’s M-Trends 2026, based on more than 500,000 hours of incident investigations conducted globally in 2025, found that vulnerability exploitation was the most frequently observed initial infection vector for the sixth consecutive year, accounting for 32% of investigated intrusions.[7]

In its Threat Intelligence Index 2026, IBM X-Force identified a 44% year-over-year increase in the exploitation of public-facing applications as an initial access vector. The report also highlights another important finding: 56% of the disclosed vulnerabilities analyzed did not require authentication for successful exploitation.[8]

ENISA, in its Threat Landscape 2026, also identifies the exploitation of N-day and zero-day vulnerabilities as a frequent intrusion vector. Among unauthorized-access incidents for which the entry vector could be determined, 60% involved vulnerability exploitation.[9]

Although these studies use different methodologies and datasets, they deliver a consistent message: the exploitation of Internet-accessible systems remains one of the main paths used to initiate cyberattacks.

This places the organization’s external attack surface in a critical position. Vulnerable applications, exposed sensitive or legacy services, remote access systems, APIs, cloud infrastructure, and unknown assets are not merely isolated technical issues — they can become the starting point of an intrusion.

The problem is not simply having a vulnerability

There is an important difference between a vulnerability existing and that vulnerability representing an immediate opportunity for an attacker.

Context matters.

Where is the asset?

Is it accessible from the Internet?

Which service is exposed?

Is authentication required?

Is the vulnerability exploitable?

Is there a known exploit?

Does the asset contain sensitive information?

Does it provide a path to other systems?

Is the asset even known to the organization?

These questions begin to transform a list of vulnerabilities into a view of exposure.

And perhaps this is one of the most important points for security professionals:

The attacker does not see the organization through its internal inventory. The attacker sees what the Internet reveals.

While you are reading this article…

New assets may be going online.

Cloud environments may be being created.

New subdomains may appear.

Services may be enabled.

Configurations may change.

A vulnerability may be disclosed for a technology that has already been exposed for months.

And automated tools can quickly identify these changes.

An organization’s external attack surface is not static.

It changes.

And every change can create a new opportunity.

That is why perhaps the most interesting question is not simply:

“Do we have vulnerabilities?”

But also:

“What can an attacker discover about us right now?”

In the next article, we will look at the data: which breaches, exposures, and initial access vectors appear most frequently in recent incident reports — and why external vulnerabilities, edge services, remote access, cloud misconfigurations, and forgotten assets deserve particular attention.

Because understanding how an attacker begins is the first step toward understanding what we need to see before they do.

References

1. MITRE ATT&CK — Reconnaissance (TA0043)
2. MITRE ATT&CK — Active Scanning (T1595)
3. MITRE ATT&CK — Gather Victim Network Information (T1590)
4. MITRE ATT&CK — Search Open Technical Databases (T1596)
5. MITRE ATT&CK — Exploit Public-Facing Application (T1190)
6. MITRE ATT&CK — External Remote Services (T1133)
7. Google Cloud / Mandiant — M-Trends 2026 Report, data from investigations conducted in 2025
8. IBM X-Force — Threat Intelligence Index 2026, published in February 2026
9. European Union Agency for Cybersecurity (ENISA) — ENISA Threat Landscape 2026, data covering January through December 2025

Continue exploring

• External Attack Surface: What Recent Data Reveals About How Attacks Begin
• Attack Surface Management (ASM): Seeing the Organization from an Attacker’s Perspective
• What is an attack vector? Understanding its relationship with the attack surface
• What is an attack surface and why does it change continuously?

Want to bring this perspective to your attack surface?

See how Lion Focus helps discover, monitor, validate, and prioritize cyber exposures.

Request a Demo →