What Is a Cyberattack?

A cyberattack is a deliberate attempt to access, damage, steal from, or disrupt a computer system, network, or device without authorization. It uses technical methods or human deception to break the confidentiality, integrity, or availability of a target, with motives that range from financial gain to espionage. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) document the attack types and the defenses that resist them.

What Is a Cyberattack?

A cyberattack is a deliberate, unauthorized attempt to access, damage, steal from, or disrupt a computer system, network, or device. It targets the confidentiality, integrity, or availability of data and services, using malicious software, deception, or the exploitation of a flaw. The defining traits are listed below:

• Deliberate intent separates a cyberattack from an accident, since the actor chooses to breach the target.
• Unauthorized access means the actor lacks permission to reach or affect the system.
• A target in the CIA triad is always confidentiality, integrity, or availability of data or services.
• A method ranges from malicious code and deception to the exploitation of a software flaw.

A cyberattack threatens the data and services that cybersecurity protects, breaking the confidentiality, integrity, or availability the field defends. Many attacks rely on deceiving a person rather than a machine, the method explained in the overview of social engineering.

What Are the Main Categories of Cyberattack?

The main categories of cyberattack group methods by how the attacker reaches the target: malware, phishing, denial-of-service, man-in-the-middle, injection, and credential attacks. The core categories are summarized below:

Each category maps to a specific defense among the layered controls of cybersecurity. A flood that targets availability is the distributed denial-of-service attack, an interception that targets traffic is the man-in-the-middle attack, and an input attack against a database is SQL injection. Two further classes raise the stakes: a zero-day exploit abuses an unknown, unpatched flaw, and a supply-chain attack compromises a trusted vendor to reach its customers.

What Are the Motives Behind a Cyberattack?

The motives behind a cyberattack are financial gain, espionage, hacktivism, and disruption. An attacker’s motive shapes the target chosen and the method used. The common motives are listed below:

• Financial gain drives ransomware, fraud, and data theft that an attacker sells or exploits for money. The largest share of reported losses.
• Espionage steals confidential data, intellectual property, or state secrets for a competitor or government.
• Hacktivism attacks a target to advance a political or social cause, often through disruption or defacement.
• Disruption and sabotage aim to damage operations, destroy data, or take a service offline, sometimes by a state actor.

The Federal Bureau of Investigation (FBI) and its Internet Crime Complaint Center (IC3) report that financially motivated attacks, including ransomware and business email compromise, account for the largest share of reported losses. An attacker’s motive determines whether the goal is theft, surveillance, protest, or damage.

How Does a Cyberattack Work at a High Level?

A cyberattack works through a lifecycle of reconnaissance, initial access, escalation, execution, and exfiltration or impact. The lifecycle describes the stages an attacker moves through, from studying a target to achieving the goal:

• Reconnaissance. The attacker gathers information about the target, such as systems, services, and people.
• Initial access. The attacker breaches the target through a phishing message, a stolen credential, or an exploited flaw.
• Privilege escalation. Access expands from a single account toward broader control of the network.
• Execution. The attacker carries out the goal, such as deploying ransomware or staging data to copy.
• Exfiltration or impact. Stolen data is removed, or the intended damage or disruption is delivered.

The lifecycle maps to frameworks such as the Lockheed Martin Cyber Kill Chain and the MITRE ATT&CK knowledge base, and breaking any single stage stops the attack. Initial access often begins with a deceptive message, the technique catalogued in the guide to phishing attack types, or with an unpatched flaw such as a zero-day exploit.

What Are the Common Targets of a Cyberattack?

The common targets of a cyberattack are individuals, businesses, government agencies, and critical infrastructure. A target is selected for the value of its data, its money, or its operations. The common targets are listed below:

• Individuals are targeted for credentials, financial accounts, and personal data used in fraud and identity theft.
• Businesses are targeted for customer data, intellectual property, and funds, often through ransomware and fraud.
• Government agencies are targeted for confidential records and for espionage by other states.
• Critical infrastructure, including energy, water, and healthcare, is targeted to disrupt essential services.

CISA identifies critical infrastructure sectors as priority targets because an attack on them affects public safety and essential services. An attack on an individual frequently leads to identity theft, while an attack on a business often begins with a deceived employee.

How Do You Defend Against a Cyberattack?

A cyberattack is defended through defense in depth, which layers patching, access control, encryption, monitoring, backups, and user awareness. No single control stops every attack, so independent barriers are stacked:

• Patching closes the software flaws that attackers exploit for initial access, including many zero-days.
• Access control limits accounts and permissions, applying least privilege and multi-factor authentication.
• Encryption protects data so an interception or theft yields unreadable information.
• Monitoring detects an attack in progress, including command-and-control traffic, so a response can contain it.
• Backups restore data and services after ransomware or destructive attacks.
• User awareness trains people to recognize phishing and social engineering attempts.

NIST and CISA recommend defense in depth, in which layered controls protect a system even when one control fails. Training users to verify requests defends the deception attacks described in the social engineering overview, and recognizing fraudulent messages is the focus of the guide to spotting a phishing email.

What Is the Difference Between a Cyberattack, a Threat, and a Vulnerability?

A vulnerability is a weakness, a threat is a potential to exploit it, and a cyberattack is the realized act of exploiting it. These terms describe different stages of risk:

• A vulnerability is a flaw in software, configuration, or human behavior that an attacker can use.
• A threat is any circumstance or actor with the potential to exploit a vulnerability.
• A cyberattack is the realized action in which a threat exploits a vulnerability against a target.
• A risk is the likelihood and impact of a threat exploiting a vulnerability.

NIST defines these terms separately so that organizations can measure risk and prioritize defenses. A vulnerability without a threat causes no harm, and a threat without a vulnerability has no path, while a cyberattack is the point at which the two meet.

Cyberattack Categories Comparison Table

The table compares the main cyberattack categories across how each works, its primary target in the CIA triad, and its primary defense:

What Are the Most Common Cyberattacks Reported Today?

The most common cyberattacks reported today are ransomware, phishing, business email compromise, and credential theft. A reported attack reflects the methods that produce the highest volume and financial loss. The most common reported attacks are listed below:

• Ransomware encrypts a victim’s data and demands payment, disrupting operations until files are restored.
• Phishing deceives users into revealing credentials, serving as the entry point for many larger attacks.
• Business email compromise impersonates an executive or vendor to redirect a payment or obtain sensitive data.
• Credential theft steals or reuses passwords to access accounts and systems.

The FBI Internet Crime Complaint Center (IC3) and CISA report ransomware and business email compromise among the costliest categories each year, and the Verizon 2026 Data Breach Investigations Report finds ransomware in 48% of breach chains. Phishing and credential theft frequently precede these attacks, since a stolen password or a deceived user often provides the initial access that a brute-force attack or an exploited flaw also seeks.

How Has the Cyberattack Threat Changed Over Time?

The cyberattack threat has shifted from isolated, individual intrusions toward organized, financially motivated, and supply-chain operations. The major changes are listed below:

• Professionalization turned attacks into organized criminal services, including ransomware sold as a service.
• Supply-chain attacks compromise a trusted vendor to reach the vendor’s many customers at once.
• Automation and AI scan and exploit large numbers of targets quickly and craft more convincing lures.
• Expanded attack surface grows as cloud services, remote work, and connected devices add new entry points.

CISA identifies supply-chain compromise and ransomware as priority threats because each affects many organizations from a single intrusion, and global ransomware damage is forecast to reach roughly $74 billion in 2026. The widening attack surface increases the value of defense in depth, since more entry points require the layered controls of cybersecurity.

Last Thoughts on Cyberattacks

A cyberattack is a deliberate, unauthorized attempt to access, damage, steal from, or disrupt a computer system, network, or device, targeting confidentiality, integrity, or availability. The main categories are malware, phishing, denial-of-service, man-in-the-middle, injection, and credential attacks, driven by motives of financial gain, espionage, hacktivism, and disruption, and with one striking somewhere every 39 seconds, the threat is constant rather than rare.

The attack lifecycle moves through reconnaissance, access, escalation, execution, and impact, and defense in depth layers patching, access control, encryption, monitoring, backups, and awareness so that breaking one stage stops the whole chain. Continue with the overview of social engineering, the guide to phishing attack types, the explanation of a DDoS attack, or the introduction to cybersecurity.

Key Takeaways:

• A cyberattack is a deliberate, unauthorized attempt to access, damage, steal from, or disrupt a system.
• The main categories are malware, phishing, denial-of-service, man-in-the-middle, injection, and credential attacks.
• The motives are financial gain, espionage, hacktivism, and disruption.
• The lifecycle moves through reconnaissance, access, escalation, execution, and impact.
• The targets include individuals, businesses, government, and critical infrastructure.
• Defense in depth layers patching, access control, encryption, monitoring, backups, and awareness, so breaking one stage stops the attack.

Frequently Asked Questions (FAQs)