The Attacker's Path

In the news, a breach can sound like one sudden event — a company is fine on Monday and "hacked" by Friday, as if someone flipped a switch. The reality is slower and more orderly. A real attack on a system is almost never one dramatic moment; it is a sequence of small steps, each one setting up the next.

And the steps tend to follow the same shape, attack after attack: the attacker looks around, gets in, gains more power, and finally acts. Security people often call this sequence the attacker's path — the ordered stages an intruder moves through. Once you can see the stages, a confusing breach story turns into a readable timeline.

Think of a burglary. A thief doesn't teleport into the master bedroom. They case the neighborhood first, find an unlocked window, slip inside, work their way through the house, and only then carry off the valuables. Each of those stages is a separate step — and a separate chance for someone to notice and stop them.

Reconnaissancelook around

→

Initial accessget a foothold

→

Escalate & movegain power

→

Act on goaldo the damage

A defender can try to break the chain at any of those four points — not just at the front door. That single idea is what the rest of this page is really about.

Reconnaissance: Looking Around First

The first stage is reconnaissance — quietly gathering information before touching anything. The attacker wants to know what they are dealing with: which systems a company runs, who works there, what is exposed to the internet, and which of those things looks weak.

A lot of this can be collected without ever breaking a rule. Public websites, job postings, social media profiles, and leaked email addresses all tell a story about an organization. At this stage nothing has been broken into — the attacker is just reading the map before choosing a door.

Initial Access: Getting a Foothold

The second stage is initial access — getting in through one weakness. This is where the attack stops being passive. It usually rides on a single opening: a password stolen through a phishing email, an unpatched flaw in some software, or a malicious file someone downloaded — the kinds of tricks earlier chapters covered.

Getting in sounds like the end of the story. Usually it is not. The first way in is often a foothold — a small, low-value spot inside, like one ordinary employee's account. By itself that account may not reach anything worth stealing. The real damage almost always comes from what happens next.

Escalation and Movement: Gaining Power

From that foothold, the attacker works to gain broader access and reach more valuable systems. Going from a limited account to a high-privilege one is called escalation; spreading from the first machine to others is called lateral movement — moving sideways across the network.

This stage is exactly why giving every account only the access it needs matters so much. If that first foothold account can touch very little, the attacker is stuck and has to fight for every step. If it can touch everything, one stolen password quietly becomes the keys to the whole building.

Acting on the Goal: The Payoff

The final stage is the one the attacker came for. Now that they have enough access, they do the actual damage: copy out sensitive data, lock the files and demand a ransom, or sit quietly and spy for months. Everything before this was setup; this is the payoff.

Seeing this as the last stage changes how you read a breach. The headline damage — the leaked records, the locked systems — is the end of a chain, not the beginning. Behind it sits a path of earlier steps, each one a place where the attack could have been caught.

Why Seeing the Path Helps Defenders

If an attack were a single instant, a defender would get exactly one chance: keep the intruder out, or lose. Because it is a sequence, they get several. Reconnaissance can be noticed, initial access can be blocked, escalation can be detected, and the final action can be caught before it finishes.

This is the logic behind stacking many defenses instead of relying on one strong wall — the idea earlier chapters called defense in depth. The goal is not only to keep attackers out, but to break the chain at whatever stage you can. A single missed step no longer has to mean a full compromise.