Cybersecurity
How cyber attacks start, and what to do about each one.
See seven common attacks as simple flows: how they begin, the warning signs, what to do right away and what stops them from happening again.
The big picture
Every attack has stages, and each stage is a chance to stop it.
Attackers rarely reach your data in one step. Layers of protection mean that if one fails, the next can still limit the damage.
- Stage 1
- Stage 2
- Stage 3
- Stage 4
- Stop it with
Stage 1
Getting in
- Phishing
- Stolen password
- Unpatched system
Stop it with
Block entry
- Strong MFA
- Patching & training
Blocks
Stage 2
Gaining control
- More privileges
- Spreads to more systems
Stop it with
Limit the spread
- Least privilege
- Access reviews
Limits
Stage 3
Reaching your data
- Finds sensitive files
- Copies or encrypts them
Stop it with
Protect the data
- Encryption & logging
- Cloud guardrails
Reduces
Stage 4
Business impact
- Downtime & lost data
- Fraud or ransom demand
Stop it with
Recover quickly
- Tested backups
- Rehearsed response plan
Attack 1 of 7
Phishing and stolen passwords
One convincing message or reused password gives an attacker a real employee's account. From there, they can read email, reach files and trick other people.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Fake login email or text
- Password reused elsewhere
- Fake help desk call
What happens
The attacker acts
- Signs in as your employee
- Reads email and files
- Phishes other staff
Warning signs
What you may see
- Unknown sign-in alerts
- New mailbox rules
- Colleagues get odd emails
Do this now
Immediate action
- Report it to IT
- Reset password, end sessions
- Check mailbox rules
Prevent it
Put this in place
- Phishing-resistant MFA
- Single sign-on
- Staff training
How we help:Identity & Access Management Security Awareness Training
Attack 2 of 7
Business email and payment fraud
A criminal pretends to be your CEO or a supplier and asks for an urgent payment or new bank details. No malware is needed, which makes this attack easy to miss.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Fake CEO or supplier email
- Hacked supplier mailbox
- AI-cloned voice call
What happens
The attacker acts
- Creates urgency or secrecy
- Asks for a payment
- Changes bank details
Warning signs
What you may see
- Unusual payment request
- New bank details
- Pressure to skip checks
Do this now
Immediate action
- Call your bank at once
- Verify on a known number
- Secure the mailbox
Prevent it
Put this in place
- Two-person approval
- Callback for bank changes
- Finance team training
How we help:Security Awareness Training Incident Response Readiness
Attack 3 of 7
Ransomware
Attackers get in, spread quietly, steal data and then lock your systems for payment. Your preparation decides whether this is a bad week or a business-threatening event.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Stolen remote access login
- Unpatched public system
- Malicious attachment
What happens
The attacker acts
- Spreads across systems
- Steals data
- Encrypts files and backups
Warning signs
What you may see
- Locked or renamed files
- Ransom note
- Unusual admin activity
Do this now
Immediate action
- Isolate affected devices
- Protect your backups
- Call counsel and insurer
Prevent it
Put this in place
- Tested offline backups
- Fast patching
- Incident response plan
How we help:Incident Response Readiness Vulnerability Assessment
Attack 4 of 7
Cloud exposure
A storage bucket left public or a leaked access key can expose data without anyone breaking in. Automated tools continually look for these mistakes.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Public storage or database
- Leaked access key
- Open admin port
What happens
The attacker acts
- Finds it by scanning
- Copies your data
- Creates hidden access
Warning signs
What you may see
- Unknown API activity
- Unexpected cloud bill
- New users or resources
Do this now
Immediate action
- Close public access
- Rotate exposed keys
- Review audit logs
Prevent it
Put this in place
- Regular cloud reviews
- Least-privilege access
- Policy guardrails
How we help:Cloud Security Review & Hardening Identity & Access Management
Attack 5 of 7
Unpatched software and applications
When a flaw becomes public, attackers quickly scan the internet for systems that have not been fixed. Weak custom code can also give them a way in.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Known flaw left unpatched
- Weak application code
- Vulnerable open-source library
What happens
The attacker acts
- Scans for the weakness
- Runs an exploit
- Gains system access
Warning signs
What you may see
- New critical alert
- Strange server activity
- Unexpected new accounts
Do this now
Immediate action
- Patch or isolate the system
- Check for signs of entry
- Reset affected access
Prevent it
Put this in place
- Prioritized patching
- Dependency scanning
- Secure code review
How we help:Vulnerability Assessment Application Security
Attack 6 of 7
Vendor and supply chain breach
A supplier you trust is breached, and your data or systems are affected through them. You may be responsible to your own customers even when the failure was theirs.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Vendor gets breached
- Compromised software update
- Excess vendor access
What happens
The attacker acts
- Uses the trusted connection
- Reaches your data
- Moves to your customers
Warning signs
What you may see
- Vendor breach notice
- Unusual vendor activity
- Customers report issues
Do this now
Immediate action
- Disable vendor access
- Find what was shared
- Check notification duties
Prevent it
Put this in place
- Vendor risk reviews
- Limited vendor access
- Contract notice terms
How we help:Compliance Readiness Virtual CISO
Attack 7 of 7
AI tool and agent misuse
Sensitive data pasted into public AI tools can leave your control. AI agents connected to real systems can also be tricked by instructions hidden in emails and documents.
- How it starts
- What happens
- Warning signs
- Do this now
- Prevent it
How it starts
The way in
- Data pasted into public AI
- Hidden prompt instructions
- Agent with excess access
What happens
The attacker acts
- Tricks the AI system
- Extracts information
- Triggers unwanted actions
Warning signs
What you may see
- Unapproved AI tools in use
- Odd agent actions
- Sensitive data in outputs
Do this now
Immediate action
- Pause the agent
- Rotate exposed secrets
- Review the audit logs
Prevent it
Put this in place
- Clear AI rules
- Least-privilege agents
- Human approval and logs
How we help:AI Security & Governance Security Awareness Training
These flows are general guidance for preparation. If you are dealing with a real incident, follow your incident response plan and contact your legal counsel, insurer and a qualified response provider right away.
Serving clients across the USA and India
Let's talk about what NPLUS Global can do for you.
Tell us about your goals. A specialist will get back to you with practical next steps.
- A specialist reads your message
- We reply with practical next steps
- No obligation to continue
Send us a message
Fields marked * are required.