A field guide to the attack techniques our analysts see most often — what they are, how they work in practice, and the controls that make them far less effective.
Deceptive emails, texts, or messages designed to trick people into revealing credentials or clicking malicious links.
How it works
Attackers impersonate trusted brands or colleagues, often using urgency (“your account will be suspended”) and convincing lookalike domains.
How to defend
Malware that encrypts your data and demands payment — often while also threatening to leak stolen information.
How it works
Typically arrives via phishing, exposed RDP, or unpatched internet-facing systems, then spreads laterally before encrypting at scale.
How to defend
Any software written to damage, disrupt, or gain unauthorised access — including trojans, droppers, info-stealers and spyware.
How it works
Delivered through malicious attachments, drive-by downloads, cracked software, or supply-chain compromises of legitimate tools.
How to defend
Manipulating people into breaking security procedures — whether by phone, chat, email, or in-person impersonation.
How it works
Attackers research your staff and processes, then exploit trust, authority or urgency to bypass technical controls entirely.
How to defend
Risk from people who already have legitimate access — whether malicious, negligent, or compromised employees and contractors.
How it works
Abuse of over-broad permissions, data exfiltration to personal storage, or accidental exposure through misconfiguration.
How to defend
Distributed Denial-of-Service attacks flood your infrastructure with traffic to knock services offline.
How it works
Botnets or amplification techniques generate huge volumes of requests that exhaust bandwidth, compute, or application resources.
How to defend
Automated login attempts using username and password pairs leaked from unrelated breaches.
How it works
Because people reuse passwords, attackers try leaked credentials against your login endpoints en masse, often from residential proxy networks.
How to defend
Attacks that leverage previously unknown vulnerabilities, before vendors have released a patch.
How it works
Skilled attackers — or buyers of commercial exploit kits — target unpatched software, browsers, VPNs, or firewalls for initial access.
How to defend