Phishing and identity abuse
An adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
Path traversal and file inclusion
An adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
Defense evasion and control impairment
An adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
Unsafe consumption of third-party APIs
An application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.
MFA fatigue, push bombing, and interception
An adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.