SSRF – Server-Side Request Forgery
An adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
Shadow and zombie APIs without managed inventory
Unknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
Ransomware and availability impact
An adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
Lateral movement inside the network
After initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
Reconnaissance and attack surface mapping
An adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.