Definition
A threat vector is the pathway or method by which an attacker can gain unauthorized access to a network or system to deliver a payload or cause harm. It describes the specific means used to exploit vulnerabilities, acting as the route for malicious activity. Understanding threat vectors is crucial for implementing effective security controls and defenses because it allows security professionals to anticipate and block potential attack paths. For instance, a phishing email is a common threat vector used to trick users into revealing credentials or downloading malware. This differs from a vulnerability, which is a weakness, whereas a threat vector is the exploit of that weakness. Knowledge of threat vectors is fundamental for certifications like CompTIA Security+, CySA+, and CISSP.