Attack vector
The path an attacker takes into a target, such as a phishing email, public API, unsafe upload, stolen password, or poisoned dependency.
See it
What it is
An attack vector is the route or method used to reach a target. A public login form, a malicious email attachment, an exposed admin panel, a poisoned npm package, and a stolen session cookie are all vectors. The vulnerability is the weakness at the destination; the vector is how the attacker gets close enough to use it.
Reach for the term while mapping an attack surface or investigating an incident. Start outside the system and trace what crosses each trust boundary: browser requests, files, webhooks, package updates, support tools, employee devices, and cloud control planes. That view finds paths a code-only scan cannot see.
Do not equate vector with endpoint. One endpoint can support several vectors, and one vector can cross several systems. A password reset route might be reached through credential stuffing, email account takeover, or poisoned Host headers. Write down the full path, the access required at each hop, and the control expected to stop it.
Ask AI for it
Map this application's attack vectors with a data-flow diagram and a STRIDE pass. Inventory every internet-facing route, login and recovery flow, file upload, webhook, admin surface, third-party script, package update path, CI credential, and cloud console. For each one, trace the attacker's starting position, every trust boundary crossed, the exact input or credential carried across it, the vulnerability required, and the control meant to stop the path. Include phishing, credential stuffing, SSRF, malicious dependencies, and insider access only where the architecture makes them possible. Rank the complete paths by likelihood and blast radius, then name one testable mitigation for each of the top ten.