Cyberattack¶

Conduct a deliberate hostile action through or against digital systems to gain unauthorized access, steal or manipulate information, disrupt availability, or maliciously control computing resources.

Version: v2 · 2026-09-06 · History
Domain-specific #: 1608
Origin domain: computer science
Subdomain: cybersecurity
Aliases: Cyber attack, Computer attack, Computer network attack

Core Idea¶

A cyberattack is a deliberate hostile attempt conducted through or against digital systems, networks, software, services, identities, or data. Its objectives include unauthorized access, collection, disclosure, manipulation, destruction, denial, degradation, or malicious control. The NIST glossary captures both the broad malicious-activity sense and the narrower “via cyberspace” sense directed at an enterprise's computing environment or information.^[1]

An attack is an action or campaign, not merely a possibility. It may fail and still be an attack. When it succeeds or imminently jeopardizes protected information or systems, it may become a security incident under the applicable operational or legal definition.

Structural Signature¶

An adversary or adversarial principal.
A deliberate objective and target selection.
A digital target, dependency, identity, service, or information asset.
A cyber access path or machine-mediated action channel.
One or more techniques, procedures, or malicious payloads.
Exploited vulnerability, credential, trust relation, capacity limit, or human–machine interface.
A sequence from reconnaissance or preparation through attempted effect.
An intended security-property impact: confidentiality, integrity, availability, authenticity, or control.
Observable events, indicators, or artifacts, even if incomplete.
A success condition distinct from the mere attempt.
A scope and temporal boundary for grouping actions into one campaign.
Defenses capable of preventing, detecting, containing, recovering, or attributing.
Residual uncertainty about actor, intent, path, and achieved effect.

What It Is Not¶

It is not a vulnerability, which is a weakness; a threat, which is a potential source of adverse action; an attack surface, which is the set of reachable opportunities; or an incident, which is a qualifying realized or imminent security violation. Ordinary hardware failure and accidental misconfiguration are not attacks without adversarial intent, although an attacker may exploit them.

Scope of Application¶

The abstraction covers credential attacks, exploitation of software flaws, malware delivery, ransomware, distributed denial of service, destructive wipers, data theft, supply-chain compromise, and adversarial manipulation of digital processes. NIST risk assessment separates threat sources, threat events, vulnerabilities, likelihood, and impact, preventing the attack action from absorbing the entire risk model.^[2]

Clarity¶

Name the adversary, target, objective, access vector, technique, exploited condition, attempted effect, observed evidence, and success criteria. Distinguish a single action from a multi-stage campaign. State whether social engineering counts only when it drives a cyber-mediated effect. Do not infer attribution or success solely from an alert.

Manages Complexity¶

Cyberattack organizes heterogeneous technical events into an adversarial path. Analysts can map initial access, execution, persistence, privilege, movement, collection, command, and impact without treating every log line as an independent incident. The path model also exposes control opportunities before, during, and after compromise.

Abstract Reasoning¶

Declare the protected system and security properties.
Identify plausible adversarial principals and objectives.
Reconstruct the action sequence from evidence and dependencies.
Separate access path, exploited condition, technique, and payload.
Determine which steps were attempted and which succeeded.
Trace effects on confidentiality, integrity, availability, authenticity, and control.
Bound the campaign in time, identity, infrastructure, and objective.
Map preventive, detective, containment, recovery, and attribution controls.
Preserve uncertainty and alternative hypotheses.

The MITRE ATT&CK knowledge base supplies a public, behavior-oriented vocabulary for observed adversary tactics and techniques rather than treating malware names as the primary unit.^[3]

Knowledge Transfer¶

The portable pattern is an intentional hazard follows a constructed path through reachable interfaces and dependencies to change a protected state; analyze the path stepwise and keep possibility, attempt, success, and consequence distinct. The proposed immediate parent is Exposure Pathway.

Examples¶

A credential-stuffing campaign automates stolen username-password pairs against an Internet service to obtain unauthorized sessions. A ransomware campaign gains execution, spreads, encrypts data, and demands payment. A volumetric denial-of-service campaign exhausts a service's finite capacity without needing privileged access.

RFC 4949's Internet-security vocabulary distinguishes attack, threat action, incident, and related concepts, illustrating why precise role separation matters.^[4]

Structural Tensions¶

Open connectivity versus controlled access.
Attacker anonymity versus defender attribution.
Prevention versus usability and availability.
Fast containment versus evidence preservation.
Local compromise versus systemic propagation.
Technique observability versus adversarial concealment.
Attempt evidence versus proof of achieved effect.

Structural–Framed Character¶

Intentional exposure-path traversal is structural. Computing resources, networks, digital identities, software execution, data, and information-security properties are constitutive. The abstraction is domain-specific.

Structural Core vs. Domain Accent¶

The structural core is adversary + reachable path + exploit or abusive action -> attempted protected-state change. The domain accent is cyberspace and information-system security.

Exposure Pathway is the proposed immediate parent. Risk, Containment, Defense in Depth, Asymmetric Attack–Defense Cost, Propagation, and Attribution are related primes.

The prospective queue contains one strict edge to prime:exposure_pathway. No live DAG mutation is authorized.

Relationships to Other Abstractions¶

Current abstraction Cyberattack Domain-specific

Parents (1) — more general patterns this builds on

Cyberattack is a kind of Exposure Pathway Prime

Exposure Pathway is the proposed immediate parent.

Hierarchy paths (3) — routes to 3 parentless roots

Cyberattack → Exposure Pathway → Risk → Uncertainty

Show alternative paths (2)

Neighborhood in Abstraction Space¶

Cyberattack sits in a sparse region of the domain-specific corpus (98^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (1565 abstractions)

Nearest neighbors

Internet Blocking — 0.75
Input Manipulation Attack — 0.75
Source Protection — 0.74
Data Extraction Through Prompting — 0.74
Multi-Instrument Coordinated Campaign — 0.74

Computed from structural-signature embeddings · 2026-09-08

Not to Be Confused With¶

Cyber threat.
Vulnerability.
Attack surface.
Security incident.
Accidental outage or operator error.
A defensive penetration test performed under authorization.
One alert treated as conclusive campaign attribution.

References¶

[1] National Institute of Standards and Technology, “Attack,” Computer Security Resource Center Glossary, definitions sourced to CNSSI 4009 and NIST SP 800-30 Rev. 1, accessed August 29, 2026. registry ↩

[2] Joint Task Force Transformation Initiative, Guide for Conducting Risk Assessments, NIST Special Publication 800-30 Rev. 1 (2012), doi:10.6028/NIST.SP.800-30r1. registry ↩

[3] MITRE, ATT&CK for Enterprise, behavior-based adversary tactics and techniques knowledge base, accessed August 29, 2026, https://attack.mitre.org/. registry ↩

[4] Robert Shirey, Internet Security Glossary, Version 2, RFC 4949 (Internet Engineering Task Force, 2007), doi:10.17487/RFC4949. registry ↩