A manufacturer's security team finds a service account that has been quietly reading engineering files for eight months. No password was ever cracked. An engineer had scanned a QR code on a flyer left in the staff parking lot, entered his credentials on the page it opened, and from there the intruder moved from laptop to file server to backup system without tripping a single alarm. One break-in, but several different routes in and across the network.
That is why this section of the course is about threat vectors: the routes attackers use. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists dozens of specific vectors, from email to USB drives to Bluetooth, and expects you to recognize each one in a scenario. This first lesson sets up the whole section. It defines a threat vector, separates it from two terms it is easily confused with, the attack surface and the threat actor, and explains the advanced persistent threat, the patient adversary that ties the vectors together.
A threat vector is the route an attacker takes to reach a target
A threat vector, sometimes called an attack vector, is the path or method an attacker uses to gain access to a system or deliver a payload. It answers one question: how did they get in? A phishing email is a vector. A USB drive dropped in a lobby is a vector. An exposed remote-desktop port is a vector. So is a compromised software supplier whose update you installed.
Naming the vector comes first, in defense and in exam scenarios alike, because the route decides the control. You stop a phishing email with mail filtering and user training, and you stop a dropped USB with device-control policy. Neither control touches the other's vector.
Most of objective 2.3 is a catalog of vectors grouped by where they operate: message-based, image-based, attachment-based, browser-based, network-based, remote access, endpoint-based, supply chain-based, removable media, human-based, IoT, operational technology, physical, and signal-based. The rest of this section walks through each group except the human-based vectors, which are taught with social engineering in the next section. For now, hold on to the core idea: a vector is a route, nothing more, and every route has a matching way to close it.
The attack surface is the sum of every point an attacker could target
The attack surface is the complete set of points where an attacker could try to enter or extract data: every open port, every running service, every user with a mailbox, every device on the network, every third-party integration. The vector is the one route used; the attack surface is everything that could be a route.
The two are related but not the same, and scenario questions depend on keeping them straight. Adding a new internet-facing web server enlarges the attack surface, whether or not anyone ever attacks it. A phishing email that lands in an inbox uses a vector across that surface. Security work pushes in two directions at once: shrink the attack surface so there are fewer possible routes, and defend the individual vectors that remain. Disabling an unused service, closing a port, or removing an old VPN appliance is attack-surface reduction. Training users to spot a malicious link defends a vector.
Attack surfaces and the vulnerabilities on them are objective 2.4, covered later in the course, so this lesson stays on vectors. When a question asks what increases your exposure overall, it is pointing at attack surface. When it asks how a specific attack arrived, it is pointing at a vector.