How does Access Vector work?

What Access Vector Actually Measures

access vector describes the attacker’s position relative to the vulnerable system. A network vector means the flaw can be reached remotely, while local or physical vectors require the attacker to be on the machine or physically near it. That distinction matters because it tells you whether exposure begins at the edge of the environment or only after an attacker already has some form of foothold.

Because it measures proximity rather than exploit difficulty, Access Vector helps separate broadly reachable weaknesses from those that are much harder to trigger in practice. A remotely reachable issue generally deserves faster attention than a flaw that only matters after device access, console access, or another internal presence is already achieved.

For teams doing vulnerability management, this is one of the first filters used to sort exposure by likely exploit path, not by abstract severity alone.

Why Proximity Changes Prioritisation

Access Vector changes how you think about blast radius. If a vulnerability can be reached from the network, it may be exposed to scanning, opportunistic exploitation, and repeated probing from untrusted zones. If it is local, the attacker usually needs a prior compromise, a stolen session, or physical access before the flaw becomes useful.

That is why access vector is often used alongside other vulnerability signals. The practical question is not just, “Can this be exploited?” but “How much access must the attacker already have before the exploit path becomes available?” The smaller the required proximity, the more likely the issue can be hit at scale.

Good prioritisation also depends on asset context. A local vulnerability on a hardened admin workstation may be less urgent than a network-reachable flaw on an internet-facing service, even if both are technically exploitable. The vector helps you place the issue in the right operational queue.

How Defenders Should Use It in Triage

Access Vector is most useful when you treat it as a reachability signal. Network-reachable flaws should be reviewed first on systems exposed to the internet, shared service tiers, partner connections, and less trusted internal segments. Local-only exposures can often wait behind anything that can be reached without prior compromise.

It also helps separate prevention work from containment work. If the vector is network-based, network filtering, segmentation, service hardening, and exposure reduction may materially lower risk before a patch is available. If it is local, the immediate concern is often privilege boundaries, endpoint trust, and whether an attacker can realistically get to the affected host.

For broader control mapping, authoritative sources such as CIS Controls v8 and NIST SP 800-53 Rev 5 Security and Privacy Controls both reinforce the importance of limiting exposure, managing access paths, and prioritising remediation based on real attack reachability.

Risk and Threat Considerations

Access Vector is a risk filter because it helps distinguish exposed weaknesses from ones that are only dangerous after an attacker is already inside the environment. Remote reachability increases the chance of opportunistic scanning, mass exploitation, and rapid repeat attempts across many targets.

Failure mechanism: When a vulnerability is network-reachable, the attacker does not need local presence, trusted adjacency, or physical access, so the exploit path becomes easier to automate and scale. When the vector is local or physical, the attacker generally needs a prior foothold or direct access, which raises the effort required and narrows who can exploit it.

Impact: Externally reachable flaws usually create a larger and faster-moving exposure window, especially on internet-facing services or lightly segmented internal networks. Local-only flaws can still be serious, but they tend to matter most after another control has already failed, such as endpoint compromise, insider access, or device theft.

Practitioner Guidance

What to prioritise: Treat network-accessible issues as the first remediation queue, especially where the affected service is exposed beyond a trusted admin zone. If the same vulnerability exists in both internet-facing and internal-only assets, the exposed instance should usually win first place in the backlog.

What to verify: Confirm the actual attack path, not just the assigned vector. A “local” finding may be effectively reachable through remote administration, exposed management tooling, or a compromised adjacent system, which changes the practical urgency.

Practitioner takeaway: Access Vector is most valuable when it is used to rank real-world reachability, because proximity to the flaw often determines whether the issue is a theoretical weakness or an immediately exploitable one.

Related resources from NHI Mgmt Group

• How does Privileged Access Never (PAN) work?
• How does Internet Message Access Protocol (IMAP) work?
• How does Terminal Access Controller Access Control System (TACACS) work?
• How does Supervisor Mode Access Prevention (SMAP) work?