Insider threat and authorized access abuse
An insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
Data exfiltration and leakage
An adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
Injection and command execution
Untrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
API security misconfiguration and exposed interfaces
Insecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
Privilege escalation and persistence
An adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.