Attack Vector
An attack vector is the path or method an attacker uses to gain unauthorized access to a system or exploit a vulnerability.
“A path or means by which an attacker can gain access to a system for malicious purposes.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Attack Vector?
Attack vectors describe how security threats reach a target system, such as through phishing, vulnerable software, weak authentication, or exposed network services.
Entry points: Attack vectors identify where systems may be vulnerable.
Risk assessment: Understanding attack vectors helps prioritize security testing.
Prevention: Security controls reduce the likelihood of successful attacks.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Attack vector points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Attack vector helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
Which observation MOST suggests a new attack vector in an e‑commerce API?
Question 2
Which action BEST reduces exposure to common attack vectors?
Test your knowledge with real ISTQB-style questions
You’ve learned Attack Vector. Test your understanding with topic-specific questions in our Mock Exams.