The Anatomy of an Attack

Every cyberattack follows the same six-step trail — from the first quiet look around, to the moment it's finally over.

1
A figure looking through binoculars at a lit building at dusk PHASE 01

Reconnaissance

Before attacking anything, attackers spend time secretly learning about their target — checking social media, company websites, job postings, anything public that reveals useful details. They haven't touched anything yet. They're just watching.

2
A door left slightly open with light spilling into a dark hallway PHASE 02

Initial Access

This is the moment they actually get in — usually through a phishing email, a stolen password, or a weak spot nobody patched. It's the very first foothold.

BEST MOMENT TO STOP IT — nothing else has happened yet
3
A hidden trapdoor built into a bookshelf, slightly open PHASE 03

Persistence

Once inside, attackers don't want to lose access if someone finds and blocks the door they used. So they quietly build themselves a second way back in — a hidden account, a scheduled task, a secret program — just in case.

4
An aerial view of a maze with a glowing path branching toward multiple exits PHASE 04

Lateral Movement

With a foothold secured, attackers start exploring — moving from computer to computer, account to account, looking for more valuable targets than where they started.

5
A vault door wide open with files spilling out PHASE 05

Taking Action

This is the actual goal, finally happening — stealing data, locking up files for ransom, shutting something down. Everything before this stage was just setup, working toward this one moment.

6
Footprints fading away and disappearing midway across sand PHASE 06

Evading Detection

This isn't just a last step — it happens the whole way through. Attackers constantly cover their tracks: deleting logs, hiding their activity, making everything look like normal, everyday behavior.