Cyberattack

Conduct a deliberate hostile action through or against digital systems to gain unauthorized access, steal or manipulate information, disrupt availability, or maliciously control computing resources.

Version

v3 · 2026-09-19 · History

Domain-specific #

1608

Domain group

Applied Sciences & Engineering

Origin domain

Computer Science & Software Engineering

Subdomain

Cybersecurity → Computer Science & Software Engineering

Aliases

Cyber attack, Computer attack, Computer network attack

Core Idea

A cyberattack is a deliberate hostile attempt conducted through or against digital systems, networks, software, services, identities, or data. Its objectives include unauthorized access, collection, disclosure, manipulation, destruction, denial, degradation, or malicious control. The NIST glossary captures both the broad malicious-activity sense and the narrower “via cyberspace” sense directed at an enterprise's computing environment or information.

An attack is an action or campaign, not merely a possibility. It may fail and still be an attack. When it succeeds or imminently jeopardizes protected information or systems, it may become a security incident under the applicable operational or legal definition.

How would you explain it like I'm…

Computer Break-In Try

A cyberattack is when someone uses computers on purpose to break into, spy on, mess up, or shut down other people's computers or information. It is like someone trying to sneak into your house through the internet instead of the door. Even if they don't get in, trying still counts as an attack.

Attacks on Computers

A cyberattack is when someone deliberately tries to harm computers, networks, apps, online accounts, or the information stored on them. They might try to get in without permission, steal or leak information, change it, delete it, or stop a service from working. An attack is something that actually happens, not just a worry that it might. Even if it fails, it still counts as an attack. If it succeeds or puts protected information in real danger, it may become a 'security incident.'

Deliberate Digital Attack

A cyberattack is a deliberate, hostile attempt carried out through or against digital systems, such as networks, software, online services, user identities, or data. Its goals can include getting unauthorized access, collecting or leaking information, altering or destroying data, denying or slowing down service, or taking control of systems for malicious purposes. It is an action, not just a possibility: a weakness nobody has exploited is a vulnerability, not an attack. An attempt that fails is still an attack. When an attack succeeds, or seriously threatens protected systems or information, it may qualify as a security incident depending on the operational or legal definition being used.

 

A cyberattack is a deliberate hostile action or campaign conducted through or against digital systems, networks, software, services, identities, or data. Its objectives span unauthorized access, collection, disclosure, manipulation, destruction, denial, degradation, or malicious control of those resources. Definitions such as NIST's cover both a broad sense (malicious activity against information systems) and a narrower sense (an attack via cyberspace targeting an enterprise's computing environment or information). The concept is about an action, not a threat or vulnerability that merely makes attack possible. Success is not required: a failed attempt is still an attack. When an attack succeeds, or imminently jeopardizes protected information or systems, it may qualify as a security incident under the applicable operational or legal definition, which is a separate classification.

Scope of Application

The abstraction covers credential attacks, exploitation of software flaws, malware delivery, ransomware, distributed denial of service, destructive wipers, data theft, supply-chain compromise, and adversarial manipulation of digital processes. NIST risk assessment separates threat sources, threat events, vulnerabilities, likelihood, and impact, preventing the attack action from absorbing the entire risk model.

Clarity

Name the adversary, target, objective, access vector, technique, exploited condition, attempted effect, observed evidence, and success criteria. Distinguish a single action from a multi-stage campaign. State whether social engineering counts only when it drives a cyber-mediated effect. Do not infer attribution or success solely from an alert.

Manages Complexity

Cyberattack organizes heterogeneous technical events into an adversarial path. Analysts can map initial access, execution, persistence, privilege, movement, collection, command, and impact without treating every log line as an independent incident. The path model also exposes control opportunities before, during, and after compromise.

Abstract Reasoning

1. Declare the protected system and security properties.
2. Identify plausible adversarial principals and objectives.
3. Reconstruct the action sequence from evidence and dependencies.
4. Separate access path, exploited condition, technique, and payload.
5. Determine which steps were attempted and which succeeded.
6. Trace effects on confidentiality, integrity, availability, authenticity, and control.
7. Bound the campaign in time, identity, infrastructure, and objective.
8. Map preventive, detective, containment, recovery, and attribution controls.
9. Preserve uncertainty and alternative hypotheses.

Knowledge Transfer

The portable pattern is an intentional hazard follows a constructed path through reachable interfaces and dependencies to change a protected state; analyze the path stepwise and keep possibility, attempt, success, and consequence distinct. The proposed immediate parent is Exposure Pathway.

Relationships to Other Abstractions

Current abstraction Cyberattack Domain-specific

Parents (1) — outgoing typed relations

• Cyberattack is a kind of Exposure Pathway Prime

  Exposure Pathway is the broader abstraction this entry instantiates.

Children (1) — abstractions linked here by typed relations

• Small Subgroup Confinement Attack Domain-specific is a kind of Cyberattack

  Small Subgroup Confinement Attack is a strict kind of Cyberattack: it is an adversarial cryptographic input strategy that confines secret-dependent results to a small subgroup.

Hierarchy paths (2) — routes to 2 parentless roots

• Cyberattack → is a kind of Exposure Pathway → presupposes, typical Risk → is a kind of Uncertainty

Show alternative path (1)

Neighborhood in Abstraction Space

Cyberattack sits in a sparse region of the domain-specific corpus (99^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Adversarial AI & Security Attacks (14 abstractions)

Nearest neighbors

• Internet Blocking — 0.75
• Input Manipulation Attack — 0.75
• Disinformation attack — 0.74
• Source Protection — 0.74
• Data Extraction Through Prompting — 0.74

Computed from structural-signature embeddings · 2026-10-25