Anatomy of an Attack

Hollywood shows hacking as a single dramatic moment. Real intrusions are more like a burglary planned over weeks — a sequence of distinct stages, each one observable if someone is watching.

Reconnaissance. The attacker cases the city: who works there (LinkedIn), what technology runs there (job postings, exposed services), which credentials have leaked in old breaches. Most recon never touches your systems, which is why it rarely triggers alerts.

Initial access. The front door. Overwhelmingly this is phishing — a convincing email that harvests a password or runs a payload — or a stolen credential reused from another breach, or an unpatched internet-facing system. Note what this means: the most common break-in technique targets a person, not a machine.

Persistence. The attacker copies a key so the door stays open: a new account, a backdoor, a scheduled task that re-invites them after every reboot. This is why finding the original entry point is never the whole job.

Lateral movement. The first compromised machine is almost never the prize. The attacker moves room to room — reusing stolen credentials, exploiting the trust between internal systems — climbing toward the assets that matter.

The objective. Exfiltrate the data, detonate the ransomware, wire the money. By the time this stage is visible, the attacker has usually been inside for days or weeks. That gap — compromise to detection — is called dwell time, and shrinking it is the entire purpose of a SOC. Every stage before the objective is a chance to catch the intrusion while it is still cheap to stop. The attacker must succeed at every stage; the defender only needs to catch one.