Reconnaissance and attack surface mapping
An adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
Phishing and identity abuse
An adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
Path traversal and file inclusion
An adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
Defense evasion and control impairment
An adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
Unsafe consumption of third-party APIs
An application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.