Almost every breach starts through a small number of doors, and most of those doors are known, inventoried and closable before an attacker reaches them. This guide is written for defenders and authorised testers only, and it describes techniques at the level of the MITRE ATT&CK descriptions, not as attack procedures. It explains the eleven techniques ATT&CK v20 lists under Initial Access (TA0001), how each one shows up in telemetry, and which prevention, detection and response measures close it. It is for security architects, SOC leads, vulnerability managers and anyone owning internet-facing services or remote access. For a ranked view of the vectors ransomware groups use most, see the Top 10 Ransomware Initial Access Vectors, which this page complements rather than repeats.
Key takeaways
- Initial access is a short list. ATT&CK v20 has eleven Initial Access techniques; exploitation of public-facing applications, valid accounts, external remote services and phishing account for most real intrusions.
- Exploits and stolen credentials lead. Mandiant's M-Trends 2025 reports exploits as the most common initial infection vector at 33% and stolen credentials second at 16%.
- Your external attack surface is the scope. You cannot close doors you have not inventoried, so asset discovery and exposure management come before any control.
- Phishing-resistant MFA closes several doors at once. It blunts valid account abuse, remote service logins and most credential phishing together.
- Machine credentials are doors too. Leaked API keys, cloud access keys and third-party tokens give direct, MFA-free entry and need the same attention as user passwords.
What it is
MITRE defines Initial Access as the techniques adversaries use through various entry vectors to gain their first foothold in a network. ATT&CK notes that some footholds give continued access, such as valid accounts and external remote services, while others are short lived because passwords change. Initial access is distinct from reconnaissance (finding the door) and from execution and persistence (what happens once inside), though in practice the boundary blurs. In v20 the tactic contains these techniques:
| Technique | What it covers (ATT&CK, paraphrased) | Primary control | Key telemetry |
|---|---|---|---|
| T1190 Exploit Public-Facing Application | A software bug, glitch or misconfiguration in an internet-facing host or service, including web apps, databases and device management protocols | Patch internet-facing and known exploited vulnerabilities first; reduce exposure | WAF and reverse proxy logs, appliance logs, unexpected child processes on servers |
| T1133 External Remote Services | VPNs, Citrix and other remote access gateways reachable from outside | MFA on every gateway; remove unused services and accounts | Gateway authentication logs, session origin and device |
| T1078 Valid Accounts | Abuse of existing credentials, including cloud accounts (T1078.004) | Phishing-resistant MFA, credential leak monitoring, disable dormant accounts | Identity provider sign-in logs, Windows 4624/4625 |
| T1566 Phishing | Electronically delivered social engineering: attachments (T1566.001), links (T1566.002), voice (T1566.004) and third-party services | Email filtering, DMARC, macro blocking, reporting culture | Mail gateway logs, user reports, browser and process telemetry |
| T1199 Trusted Relationship | Access through a third party such as an IT provider or MSP that already has a connection | Least privilege and separate monitored accounts for suppliers | Partner account activity, remote management tool logs |
| T1195 Supply Chain Compromise | Manipulation of products or delivery before receipt, including software (T1195.002) | Supplier assurance, integrity checks, staged rollout of updates | New behaviour of trusted software after updates |
| T1189 Drive-by Compromise | Access via a user visiting a compromised or malicious website | Browser patching, web filtering, isolation for risky browsing | Proxy and DNS logs, browser child processes |
| T1659 Content Injection | Injecting malicious content into data in transit on a compromised channel | Encrypted transport, certificate validation | Network traffic analysis |
| T1200 Hardware Additions | Introducing devices into systems or networks | Network access control, port security | NAC and switch port events, new device inventory |
| T1091 Replication Through Removable Media | Malware spreading on removable media into systems, including air-gapped ones | Removable media policy and scanning | Device connection events, autorun policy |
| T1669 Wi-Fi Networks | Gaining access through wireless networks | Enterprise Wi-Fi authentication, rogue access point detection | Wireless controller logs |
Help desk and voice manipulation sits partly under T1566.004 and, in v20, under T1684 Social Engineering in the Stealth tactic.
How it works
Every initial access technique exploits one of four weaknesses. Thinking in these four groups makes prioritisation easier than working technique by technique.
- A vulnerable or misconfigured exposed service (T1190, T1133): edge devices such as VPN appliances, file transfer servers and web applications are reachable by anyone. When a flaw is published, exploitation often follows quickly. The Ivanti Connect Secure exploitation 2024 chained CVE-2023-46805 and CVE-2024-21887 to run commands on VPN gateways and then harvest credentials. See the Edge Device Security Guide and VPN Security Guide.
- A credential that works (T1078, T1133): passwords stolen by infostealers, reused from other breaches, sprayed or phished open remote access portals and cloud consoles. The Change Healthcare breach 2024 began with compromised credentials on a Citrix remote access portal that did not require MFA. See the Infostealer Threat Guide and Password Spraying and Credential Stuffing Defence Guide.
- A person who can be persuaded (T1566, T1684): email, messaging, voice and QR code lures lead users to open content, enter credentials or approve access. In the MGM Resorts breach 2023 attackers reportedly called the help desk while impersonating an employee, though MGM has not confirmed the details. See the Phishing Guide.
- Someone you already trust (T1199, T1195): suppliers, MSPs and software vendors have legitimate paths in. In the SolarWinds supply chain compromise, a backdoor shipped inside signed Orion updates. See the Software Supply Chain Security Guide.
Physical and local vectors (T1200, T1091, T1669) are rarer in enterprise incident data but matter for OT, retail and high-security sites; see the Social Engineering and Physical Penetration Testing Guide for authorised testing of them.
How defenders detect, prevent and respond
Prevention by door
The CISA, MS-ISAC, NSA and FBI #StopRansomware Guide groups prevention by initial access vector. Its main recommendations, with ATT&CK mapping, are below.
| Door | Controls from the #StopRansomware Guide | D3FEND | NIST SP 800-53 Rev. 5 |
|---|---|---|---|
| Internet-facing vulnerabilities (T1190) | Regular vulnerability scanning; patch internet-facing servers and known exploited vulnerabilities first; disable unneeded services; scan infrastructure as code for drift | D3-SWI Software Inventory | RA-5, SI-2, CM-7 |
| Remote services (T1133) | Keep RDP off the internet; patch VPNs; MFA on all VPN connections (15+ character passwords if MFA is impossible); block TCP 445 and 137 to 139 at the perimeter | D3-ITF Inbound Traffic Filtering | AC-17, SC-7 |
| Compromised credentials (T1078) | Phishing-resistant MFA for email, VPN and critical systems; unique passwords of 15+ characters; account lockout; separate admin accounts; dark web credential monitoring | D3-MFA Multi-factor Authentication | IA-2 |
| Phishing (T1566) | Gateway filtering; attachment filters; treat password-protected archives as risky; DMARC with SPF and DKIM; block macros from the internet; disable Windows Script Host | D3-FA File Analysis | AT-2, SI-3 |
| Precursor malware | Application allowlisting (WDAC or AppLocker) and EDR on all assets; central IDS for command and control | D3-EAL Executable Allowlisting | CM-7, SI-4 |
| Third parties and MSPs (T1199) | Assess supplier hygiene; least privilege and separation of duties for supplier access; contract requirements | D3-UBA User Behavior Analysis | SR-3, AC-17 |
The NCSC phishing guidance adds a useful layered model: make it hard for attackers to reach users, help users identify and report, limit the damage when a message gets through, and respond quickly. It warns against relying on phishing simulations and recommends measuring reporting as well as clicks.
Detection
- Exposed services: watch web server and appliance processes spawning shells or scripting engines, new files in web roots, and appliance configuration changes. Ingest edge device logs, which are often missing from the SIEM.
- Remote access and identity: alert on successful logins after many failures (4625 followed by 4624, or identity provider equivalents), logons from new countries or hosting providers, logon type 10 (RDP) from the internet, and sessions without an MFA claim.
- Phishing: correlate user reports with mail logs to purge similar messages, and watch Office applications spawning script interpreters.
- Trusted relationships: give each supplier a named account and alert on use outside agreed hours or from unexpected sources.
- Supply chain: baseline what trusted software normally does; new outbound destinations after an update are a strong signal.
Response
- Close the door: patch or isolate the exposed service, or disable the abused account and revoke its sessions and tokens.
- Assume credential theft: exploited gateways often harvest credentials, so reset passwords and secrets that passed through the device, not only the exploited account.
- Scope from the entry point: use the initial access time as the start of the timeline and hunt forward for persistence and lateral movement. See the Phishing Incident Response Playbook.
- Check for the same door elsewhere: the same vulnerable version, the same supplier or the same unmanaged remote service is probably present on other assets.
Measuring it
- Exposure time: median days from publication of a known exploited vulnerability to remediation on internet-facing assets.
- Remote access MFA coverage: percentage of VPN, VDI and cloud console logins carrying a phishing-resistant MFA claim.
- Unknown asset rate: internet-facing assets discovered by scanning that were not in the inventory.
- Phishing report rate and time: share of simulated or real phish reported, and minutes from first report to purge.
- Supplier access hygiene: third-party accounts without an owner, MFA or review in the last quarter.
Why it matters
Initial access is the cheapest point to stop an intrusion: everything after it costs more to detect and more to recover from. M-Trends 2025 reports a global median dwell time of 11 days, and the doors used most often, exploitable edge devices and credentials without MFA, are also the ones defenders can inventory and test. Penetration tests and red team exercises, run under written scope and rules of engagement, should check these doors first. See the Penetration Testing Guide and Penetration Test Scoping Checklist.
| Framework | Where initial access defence sits |
|---|---|
| NIST CSF 2.0 | ID.AM asset management, PR.AA identity and access control, PR.PS platform security, DE.CM continuous monitoring, GV.SC supply chain risk |
| CIS Controls v8.1 | Control 1 Enterprise Assets, Control 7 Continuous Vulnerability Management, Control 6 Access Control Management, Control 9 Email and Web Browser Protections, Control 15 Service Provider Management |
| ISO/IEC 27001:2022 Annex A | A.8.8 Management of technical vulnerabilities, A.5.17 Authentication information, A.5.19 to A.5.22 supplier relationships, A.6.3 awareness and training |
| CISA | Known Exploited Vulnerabilities Catalog as a patch priority list |
Where identity fits
Valid accounts are both an initial access technique and the payoff of most others: phishing steals credentials, exploited gateways harvest them, and suppliers hold them. Non-human identities widen the door. Cloud access keys, API tokens and OAuth grants usually bypass MFA entirely, and leaked keys in code or build logs give direct entry to cloud tenants. Treat secrets scanning, key rotation and third-party token review as initial access controls. See the MITRE ATT&CK T1078 Valid Accounts Guide and Phishing-Resistant MFA Guide.
Common misconceptions
- "Phishing is the main way in." Phishing remains important, but M-Trends 2025 places exploits and stolen credentials ahead of it as initial infection vectors.
- "Any MFA is enough." Push, SMS and one-time codes can be relayed or fatigued; see the MFA Fatigue and Bypass Guide and AiTM Phishing Guide.
- "Patched appliances are clean." Patching closes the door but does not remove an attacker already inside or credentials already stolen; check for compromise and rotate secrets.
- "Awareness training solves phishing." The NCSC treats training as one layer, not the main defence, and warns that blame discourages reporting.
- "Suppliers are covered by contract." Contracts do not monitor sessions; supplier access needs the same technical controls as staff access.
- "We know our perimeter." Forgotten test servers, acquired company assets and shadow cloud services are common entry points; see the Attack Surface Management Guide.
Related concepts
- Reconnaissance and discovery: what attackers learn before and after entry. See the Discovery and Reconnaissance Techniques Guide.
- Defence evasion: how attackers stay hidden once in. See the Defence Evasion Techniques Guide.
- Exposure management: continuous discovery and validation of reachable weaknesses. See the Exposure Management and CTEM Guide.
- Patch management: the operational process behind closing T1190. See the Patch Management Guide.
- Authorised emulation: red and purple teams validate initial access controls safely. See the Red Teaming Guide and Purple Teaming Guide.
Practitioner checklist
- Maintain a complete inventory of internet-facing assets and reconcile it monthly with external scan results.
- Patch entries in the CISA Known Exploited Vulnerabilities Catalog on internet-facing systems ahead of all other work.
- Remove RDP and other management interfaces from the internet; front remaining remote access with MFA.
- Roll out phishing-resistant MFA for remote access, email, cloud consoles and administrators first.
- Disable dormant accounts and monitor for leaked credentials, including cloud keys and API tokens.
- Enforce DMARC, block internet-origin macros and give users a one-click reporting route.
- Give every supplier named, least-privilege, monitored accounts with periodic review.
- Ingest edge device, VPN and identity provider logs into the SIEM with alerts for new-geography and no-MFA sessions.
- Test initial access controls each year through an authorised, scoped penetration test or red team exercise.
Standards and references
- MITRE ATT&CK: Initial Access (TA0001)
- MITRE ATT&CK: Exploit Public-Facing Application (T1190)
- MITRE ATT&CK: Valid Accounts (T1078)
- CISA, MS-ISAC, NSA and FBI: #StopRansomware Guide
- CISA: Known Exploited Vulnerabilities Catalog
- NCSC: Phishing attacks, defending your organisation
- MITRE D3FEND: Multi-factor Authentication
- Google Cloud (Mandiant): M-Trends 2025
Related NHI Mgmt Group resources: Top 10 Ransomware Initial Access Vectors · Edge Device Security Guide · Phishing-Resistant MFA Guide · Penetration Testing Guide · Red Teaming Guide