DDoS and resource exhaustion
An adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
Supply chain and trusted access
An adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
Client-side injection and Cross-Site Scripting
An adversary injects untrusted content into a user’s browser and executes script in the context of a trusted application.
Credential stuffing and password spraying
An adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
Business Email Compromise and mailbox takeover
An adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.