What is a threat vector?
A threat vector, often called an attack vector, is the route or method an attacker uses to gain access to a system or deliver a payload. It answers one question: how did they get in? A phishing email is a vector. So is a USB drive left in a parking lot, a remote desktop port exposed to the internet, a malicious browser extension, and a supplier's software update that was tampered with before you installed it.
Naming the vector comes first because the route decides the control. Mail filtering and user training stop a phishing email; neither does anything about a dropped USB drive, which needs a device-control policy.
Families of threat vectors
| Family | Examples | Typical control |
|---|---|---|
| Message-based | Email, SMS, RCS, instant messaging, collaboration tools | Filtering, sender authentication, awareness |
| Image-based | QR codes, embedded content, fake CAPTCHA pages | Treat as untrusted links, awareness |
| Attachment-based | Macro-enabled documents, RTF, PDF | Block internet macros, sandboxing, patch readers |
| Browser-based | Extensions, JavaScript, stolen cookies and session tokens | Extension allow lists, patching, short-lived tokens |
| Network and remote access | Unpatched routers and firewalls, RDP, VNC, VPN appliances | Patch, remove direct exposure, MFA |
| Endpoint | Workstations, servers, mobile and trusted devices, built-in tools | Hardening, EDR, least privilege |
| Supply chain | Third-party vendors, MSPs, logistics, SaaS providers | Due diligence, least-privilege vendor access |
| Removable media | Malicious USB drives, keystroke-injecting devices | Device control, disable autorun, training |
| Human-based | Impersonation, contractors, visitors, biometrics, watering holes | Verification procedures, escorts |
| IoT, OT, physical and signal | Cameras, controllers, locks, badges, Bluetooth, NFC | Segmentation, physical controls, disable unused radios |
Real intrusions chain several vectors
Attacks rarely use one route. A typical intrusion uses one vector for initial access (a phishing email), another for execution and persistence (a macro that installs a scheduled task), others for lateral movement (stolen credentials over SMB and RDP), and a final channel for exfiltration that looks like normal web traffic. That is the reason for defense in depth: if every email is filtered but any workstation can reach every server, the one message that slips through still wins.
Example: an exposed remote desktop port
A small company's server log shows three days of Windows event ID 4625 (failed logon) against the Administrator account from addresses abroad, followed by event 4624 (successful logon) with logon type 10, a remote desktop session, at 03:12. Nobody was phished and nothing was opened. The vector is remote access: RDP on TCP port 3389 exposed directly to the internet, protected only by a guessable password. The fix closes the vector rather than cleaning up after it: put remote access behind a VPN or zero trust gateway, require MFA, restrict source addresses and keep the service patched.
Threat vector vs. attack surface vs. threat actor
The threat actor is who attacks, the vector is how, and the attack surface is everywhere they could try. One actor uses many vectors, and one vector, such as phishing, serves petty criminals and state spies alike. Adding a new internet-facing service enlarges the attack surface; a phishing email that lands in an inbox uses a vector across it. A vulnerability, such as an unpatched VPN appliance, is a weakness that a vector exploits.
Threat vector on the CompTIA Security+ exam
SY0-801 objective 2.3 catalogs threat vectors and expects you to recognize each one from a scenario and pick the matching defense. The fastest path is to name the vector, place it in its family, and choose the control that family implies: a dropped USB drive calls for device control rather than a stronger password, and an exposed port 3389 calls for removing the exposure and adding MFA rather than antivirus. A scenario that stresses who is attacking and why, such as funding or political aims, is testing threat actors under objective 2.2 instead, and one that stresses how much is exposed overall is pointing at the attack surface.