What Is a Cyber-attack?

A cyber-attack is a deliberate act by an individual, group, or automated system to compromise the confidentiality, integrity, or availability of a target's information systems, data, or networked infrastructure. The target may be a private organization, a government body, a critical infrastructure operator, or an individual user, and the method may range from automated scanning for known software vulnerabilities to highly targeted intrusion campaigns planned over months. The unifying characteristic is the unauthorized use of computing or network capabilities to achieve an objective the target has not consented to.

The study of cyber-attacks sits at the intersection of computer science, network engineering, and security policy. It draws on knowledge of operating system internals, cryptography, protocol design, and human psychology, since many attacks succeed not by breaking mathematics but by exploiting predictable human behavior. The field has grown substantially in scope and sophistication since the early internet era, as the systems subject to attack now encompass cloud platforms, mobile devices, embedded controllers in physical infrastructure, and supply chains spanning many organizations.

Attack Types and Methods

Cyber-attacks are commonly classified by the mechanism of compromise. Malware-based attacks introduce malicious software, including viruses, worms, trojans, ransomware, and spyware, through phishing emails, drive-by downloads, or exploitation of vulnerabilities in network-facing services. CISA's resources on malware, phishing, and ransomware describe how ransomware encrypts victim files and demands payment for decryption keys, a model that has expanded from targeting individuals to targeting hospitals, municipalities, and industrial operators.

Network-layer attacks such as distributed denial-of-service (DDoS) campaigns overwhelm a target's connectivity or server resources with traffic generated by botnets of compromised machines, making services unavailable to legitimate users. Injection attacks, including SQL injection and command injection, exploit insufficient input validation in web applications to execute arbitrary database queries or operating system commands. Man-in-the-middle attacks intercept communications between two parties, enabling eavesdropping or modification of transmitted data. Supply-chain attacks compromise software or hardware before delivery to the final target, inserting malicious functionality into trusted update mechanisms or hardware components.

Motivation and Threat Actors

Cyber-attacks originate from actors with widely differing motivations. Financial gain drives criminal organizations that deploy ransomware, operate phishing campaigns to steal credentials, and conduct fraudulent transactions using stolen payment data. Espionage motivates nation-state intelligence services and state-directed groups to conduct persistent intrusions against government, defense, and research targets. Hacktivism describes attacks carried out for political or ideological expression, typically through website defacement or DDoS campaigns against symbolic targets. Destructive attacks, intended to cause operational damage or physical harm, appear in the context of geopolitical conflict and have been attributed to state actors targeting energy and industrial control systems.

NIST's glossary of cybersecurity terms provides a standardized vocabulary for classifying attacks and their characteristics, supporting consistent communication across organizations and between government and industry in incident response contexts.

Detection and Mitigation

Defending against cyber-attacks requires a combination of preventive controls and detection capabilities. Preventive measures include patch management, strong authentication, network segmentation, and application security practices that reduce the density of exploitable vulnerabilities. Detection relies on security information and event management (SIEM) systems that correlate logs from across the infrastructure, intrusion detection systems that identify known attack signatures and behavioral anomalies, and threat intelligence feeds that distribute indicators of compromise derived from observed attacks.

The NIST Cybersecurity Framework organizes these activities into the Identify, Protect, Detect, Respond, and Recover functions, providing a structured basis for assessing and improving an organization's security posture against the full range of cyber-attack types.

Applications

Cyber-attack defense practices are applied across all sectors that depend on digital systems, including:

• Financial services, protecting transaction processing and customer account systems
• Healthcare, securing electronic medical records and network-connected devices
• Defense and government, protecting sensitive data and command networks
• Industrial control systems in energy, water, and manufacturing operations
• Telecommunications and internet service infrastructure