Cyberattack

Conduct a deliberate hostile action through or against digital systems to gain unauthorized access, steal or manipulate information, disrupt availability, or maliciously control computing resources.

Version

v3 · 2026-09-19 · History

Domain-specific #

1608

Domain group

Applied Sciences & Engineering

Origin domain

Computer Science & Software Engineering

Subdomain

Cybersecurity → Computer Science & Software Engineering

Aliases

Cyber attack, Computer attack, Computer network attack

Core Idea

A cyberattack is a deliberate hostile attempt conducted through or against digital systems, networks, software, services, identities, or data. Its objectives include unauthorized access, collection, disclosure, manipulation, destruction, denial, degradation, or malicious control. The NIST glossary captures both the broad malicious-activity sense and the narrower “via cyberspace” sense directed at an enterprise's computing environment or information.^[1]

An attack is an action or campaign, not merely a possibility. It may fail and still be an attack. When it succeeds or imminently jeopardizes protected information or systems, it may become a security incident under the applicable operational or legal definition.

How would you explain it like I'm…

Computer Break-In Try

A cyberattack is when someone uses computers on purpose to break into, spy on, mess up, or shut down other people's computers or information. It is like someone trying to sneak into your house through the internet instead of the door. Even if they don't get in, trying still counts as an attack.

Attacks on Computers

A cyberattack is when someone deliberately tries to harm computers, networks, apps, online accounts, or the information stored on them. They might try to get in without permission, steal or leak information, change it, delete it, or stop a service from working. An attack is something that actually happens, not just a worry that it might. Even if it fails, it still counts as an attack. If it succeeds or puts protected information in real danger, it may become a 'security incident.'

Deliberate Digital Attack

A cyberattack is a deliberate, hostile attempt carried out through or against digital systems, such as networks, software, online services, user identities, or data. Its goals can include getting unauthorized access, collecting or leaking information, altering or destroying data, denying or slowing down service, or taking control of systems for malicious purposes. It is an action, not just a possibility: a weakness nobody has exploited is a vulnerability, not an attack. An attempt that fails is still an attack. When an attack succeeds, or seriously threatens protected systems or information, it may qualify as a security incident depending on the operational or legal definition being used.

 

A cyberattack is a deliberate hostile action or campaign conducted through or against digital systems, networks, software, services, identities, or data. Its objectives span unauthorized access, collection, disclosure, manipulation, destruction, denial, degradation, or malicious control of those resources. Definitions such as NIST's cover both a broad sense (malicious activity against information systems) and a narrower sense (an attack via cyberspace targeting an enterprise's computing environment or information). The concept is about an action, not a threat or vulnerability that merely makes attack possible. Success is not required: a failed attempt is still an attack. When an attack succeeds, or imminently jeopardizes protected information or systems, it may qualify as a security incident under the applicable operational or legal definition, which is a separate classification.

Structural Signature

• An adversary or adversarial principal.
• A deliberate objective and target selection.
• A digital target, dependency, identity, service, or information asset.
• A cyber access path or machine-mediated action channel.
• One or more techniques, procedures, or malicious payloads.
• Exploited vulnerability, credential, trust relation, capacity limit, or human–machine interface.
• A sequence from reconnaissance or preparation through attempted effect.
• An intended security-property impact: confidentiality, integrity, availability, authenticity, or control.
• Observable events, indicators, or artifacts, even if incomplete.
• A success condition distinct from the mere attempt.
• A scope and temporal boundary for grouping actions into one campaign.
• Defenses capable of preventing, detecting, containing, recovering, or attributing.
• Residual uncertainty about actor, intent, path, and achieved effect.

What It Is Not

It is not a vulnerability, which is a weakness; a threat, which is a potential source of adverse action; an attack surface, which is the set of reachable opportunities; or an incident, which is a qualifying realized or imminent security violation. Ordinary hardware failure and accidental misconfiguration are not attacks without adversarial intent, although an attacker may exploit them.

Scope of Application

The abstraction covers credential attacks, exploitation of software flaws, malware delivery, ransomware, distributed denial of service, destructive wipers, data theft, supply-chain compromise, and adversarial manipulation of digital processes. NIST risk assessment separates threat sources, threat events, vulnerabilities, likelihood, and impact, preventing the attack action from absorbing the entire risk model.^[2]

Clarity

Name the adversary, target, objective, access vector, technique, exploited condition, attempted effect, observed evidence, and success criteria. Distinguish a single action from a multi-stage campaign. State whether social engineering counts only when it drives a cyber-mediated effect. Do not infer attribution or success solely from an alert.

Manages Complexity

Cyberattack organizes heterogeneous technical events into an adversarial path. Analysts can map initial access, execution, persistence, privilege, movement, collection, command, and impact without treating every log line as an independent incident. The path model also exposes control opportunities before, during, and after compromise.

Abstract Reasoning

1. Declare the protected system and security properties.
2. Identify plausible adversarial principals and objectives.
3. Reconstruct the action sequence from evidence and dependencies.
4. Separate access path, exploited condition, technique, and payload.
5. Determine which steps were attempted and which succeeded.
6. Trace effects on confidentiality, integrity, availability, authenticity, and control.
7. Bound the campaign in time, identity, infrastructure, and objective.
8. Map preventive, detective, containment, recovery, and attribution controls.
9. Preserve uncertainty and alternative hypotheses.

The MITRE ATT&CK knowledge base supplies a public, behavior-oriented vocabulary for observed adversary tactics and techniques rather than treating malware names as the primary unit.^[3]

Knowledge Transfer

The portable pattern is an intentional hazard follows a constructed path through reachable interfaces and dependencies to change a protected state; analyze the path stepwise and keep possibility, attempt, success, and consequence distinct. The proposed immediate parent is Exposure Pathway.

Examples

A credential-stuffing campaign automates stolen username-password pairs against an Internet service to obtain unauthorized sessions. A ransomware campaign gains execution, spreads, encrypts data, and demands payment. A volumetric denial-of-service campaign exhausts a service's finite capacity without needing privileged access.

RFC 4949's Internet-security vocabulary distinguishes attack, threat action, incident, and related concepts, illustrating why precise role separation matters.^[4]

Structural Tensions

• Open connectivity versus controlled access.
• Attacker anonymity versus defender attribution.
• Prevention versus usability and availability.
• Fast containment versus evidence preservation.
• Local compromise versus systemic propagation.
• Technique observability versus adversarial concealment.
• Attempt evidence versus proof of achieved effect.

Structural–Framed Character

Intentional exposure-path traversal is structural. Computing resources, networks, digital identities, software execution, data, and information-security properties are constitutive. The abstraction is domain-specific.

Structural Core vs. Domain Accent

The structural core is adversary + reachable path + exploit or abusive action -> attempted protected-state change. The domain accent is cyberspace and information-system security.

Instantiates / Related Primes

This entry is a kind of Exposure Pathway.

Exposure Pathway is the broader abstraction this entry instantiates. Risk, Containment, Defense in Depth, Asymmetric Attack–Defense Cost, Propagation, and Attribution are related primes.

Relationships to Other Abstractions

Current abstraction Cyberattack Domain-specific

Parents (1) — outgoing typed relations

• Cyberattack is a kind of Exposure Pathway Prime

  Exposure Pathway is the broader abstraction this entry instantiates.

Children (1) — abstractions linked here by typed relations

• Small Subgroup Confinement Attack Domain-specific is a kind of Cyberattack

  Small Subgroup Confinement Attack is a strict kind of Cyberattack: it is an adversarial cryptographic input strategy that confines secret-dependent results to a small subgroup.

Hierarchy paths (2) — routes to 2 parentless roots

• Cyberattack → is a kind of Exposure Pathway → presupposes, typical Risk → is a kind of Uncertainty

Show alternative path (1)

Neighborhood in Abstraction Space

Cyberattack sits in a sparse region of the domain-specific corpus (99^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Adversarial AI & Security Attacks (14 abstractions)

Nearest neighbors

• Internet Blocking — 0.75
• Input Manipulation Attack — 0.75
• Disinformation attack — 0.74
• Source Protection — 0.74
• Data Extraction Through Prompting — 0.74

Computed from structural-signature embeddings · 2026-10-25

Not to Be Confused With

• Cyber threat.
• Vulnerability.
• Attack surface.
• Security incident.
• Accidental outage or operator error.
• A defensive penetration test performed under authorization.
• One alert treated as conclusive campaign attribution.

References

[1] National Institute of Standards and Technology, “Attack,” Computer Security Resource Center Glossary, definitions sourced to CNSSI 4009 and NIST SP 800-30 Rev. 1, accessed August 29, 2026.not authoritative registry ↩

[2] Joint Task Force Transformation Initiative, Guide for Conducting Risk Assessments, NIST Special Publication 800-30 Rev. 1 (2012), doi:10.6028/NIST.SP.800-30r1. registry ↩ Show verification details

[3] MITRE, ATT&CK for Enterprise, behavior-based adversary tactics and techniques knowledge base, accessed August 29, 2026, https://attack.mitre.org/. registry ↩

[4] Robert Shirey, Internet Security Glossary, Version 2, RFC 4949 (Internet Engineering Task Force, 2007), doi:10.17487/RFC4949. registry ↩ Show verification details