Definition
An attack vector is the path or means by which a threat actor gains unauthorized access to a computer system or network to deliver a payload or malicious outcome. It represents the method used to exploit vulnerabilities and compromise security controls. Understanding attack vectors is crucial for implementing effective defenses and mitigating risks in real-world scenarios. For instance, phishing emails are a common attack vector, tricking users into revealing sensitive information or downloading malware. Unlike a vulnerability, which is a weakness, an attack vector is the active exploitation of that weakness. This concept is fundamental to cybersecurity certifications like CompTIA Security+ and CySA+.