Discovery-First Attack Pattern

Expanded Definition

Discovery-first attack pattern refers to an adversary workflow that prioritises reconnaissance before impact. Rather than moving immediately to exfiltration, encryption, or fraud, the attacker enumerates identities, services, storage locations, permissions, and exposed interfaces to find the lowest-friction path to value. In cloud and identity-centric environments, that often means probing directory structures, API surfaces, object storage, privileged roles, and service accounts that can be reused or chained. This behaviour overlaps with classic reconnaissance, but the emphasis here is on sequencing: discovery is not incidental, it is the main enabler of the intrusion path.

For security teams, the term is most useful when describing early-stage adversary behaviour that can be seen in logs before the blast radius grows. It aligns well with the reconnaissance and resource-development stages described in the MITRE ATT&CK Enterprise Matrix, although ATT&CK is technique-focused rather than a formal definition of this glossary term. In practice, the pattern is especially relevant where identity, permissions, and exposed cloud resources determine how quickly an attacker can pivot. The most common misapplication is treating discovery as benign admin activity, which occurs when teams ignore repeated enumeration from unusual identities or IP ranges.

Examples and Use Cases

Implementing detection for discovery-first behaviour often introduces more logging and alert tuning, requiring organisations to balance earlier visibility against operational noise and storage overhead.

• A cloud attacker lists storage buckets and checks naming conventions to identify backups, public datasets, or misconfigured permissions before attempting access.
• An adversary queries directory services and IAM roles to map high-value accounts, then targets weakly protected service accounts for lateral movement.
• A threat actor enumerates exposed management endpoints and API routes to find administrative functions, especially where authentication is inconsistently enforced.
• An AI-enabled intruder uses automation to accelerate discovery across many tenants or namespaces, a pattern discussed in the Anthropic — first AI-orchestrated cyber espionage campaign report.
• Security operations teams correlate scan bursts, unusual identity lookups, and storage enumeration with telemetry from CISA cyber threat advisories to decide whether a reconnaissance campaign is underway.

In mature environments, discovery-first activity is also used as a test of defensive coverage. Red teams and purple teams may emulate it to validate whether cloud audit logs, identity telemetry, and asset inventories can reveal the attacker’s first meaningful moves. In agentic workflows, the same pattern can arise when an AI agent has tool access that is broader than intended, because the agent can rapidly enumerate resources across systems without a human noticing the pace of queries.

Why It Matters for Security Teams

Discovery-first attack pattern matters because it often reveals compromise before direct damage occurs. Once an adversary knows which identities exist, which permissions are overbroad, and which services are reachable, the rest of the intrusion becomes a matter of choosing the quickest route. That makes this pattern especially important in identity-heavy environments where privilege sprawl, stale credentials, and cloud misconfiguration create visible stepping stones. It also connects naturally to NHI governance: service accounts, tokens, API keys, and automation identities are frequently the first resources an attacker tries to enumerate, because they can expose durable access paths that humans overlook.

From a control perspective, discovery signals should be treated as part of preventive monitoring, not just incident response. Logging, asset inventory, identity telemetry, and permission review all become more valuable when they can expose the early phase of attacker movement. Relevant control guidance appears in NIST SP 800-53 Rev 5 Security and Privacy Controls, particularly around auditing, access control, and system monitoring, while the MITRE ATLAS adversarial AI threat matrix is useful when discovery is accelerated or orchestrated by AI tooling. Organisations typically encounter the operational cost of this pattern only after an enumeration burst is followed by privilege abuse, at which point discovery-first analysis becomes unavoidable to reconstruct the path into the environment.

Related resources from NHI Mgmt Group

• Should teams prioritise discovery or policy first for NHI governance?
• Should organisations prioritise discovery or access restriction first for shadow AI?
• Should organisations prioritise secret rotation or secret discovery first?
• Should organisations prioritise remediation or discovery first in SaaS security?