A Drive-by Target is a system or user exposed to malicious code delivered automatically through a web page, advertisement or embedded content. Attackers choose targets with weak browser controls, outdated software or permissive plugin settings. Defenders should harden browsers, patch client software and block untrusted web content.
What Makes a Drive-by Target Dangerous
A drive-by target is dangerous because exposure can occur passively, simply by loading a web page, ad, or embedded object. The attacker does not need the user to download and run a file manually, which makes browser weakness, plugin abuse, and outdated client software the critical entry conditions.
The practical security issue is not the page itself, but the client-side trust boundary it crosses. If browser defenses are weak, the target may execute malicious code before users or security teams recognise anything unusual.
How Drive-by Target Exposure Arises
Exposure usually depends on a combination of vulnerable software, permissive browser settings, and unsafe web content sources. A system becomes a target when it can be reached by content that the browser, renderer, or plugin stack will process automatically.
That means the risk is often shaped by the endpoint baseline, not by a single campaign. Older browsers, unsupported extensions, and relaxed content execution settings all expand the set of pages that can be used as delivery mechanisms.
Why Attackers Prefer This Delivery Path
Drive-by attacks are attractive because they scale well and can be embedded in ordinary browsing activity. Attackers benefit from opportunistic exposure, meaning they can wait for the victim to visit a compromised or malicious page instead of relying on direct user action.
In practice, this makes the browser part of the attack surface, alongside the operating system and any helper components that process web content. A page can become a payload carrier even when the visible content looks routine.
Reducing the Chance of Becoming a Drive-by Target
Defensive value comes from reducing what the browser can automatically trust. Hardening browser settings, removing or restricting unnecessary plugins, patching client software quickly, and limiting untrusted web content all reduce the conditions that make drive-by delivery work.
Organisations should treat browser exposure as an endpoint hygiene issue, not only a web filtering issue. A system that is broadly reachable from the internet but poorly maintained is more likely to be selected as a target than one with current software and stricter content controls.
Risk and Threat Considerations
Drive-by targeting creates a high-probability infection path because exploitation can begin as soon as a vulnerable client renders malicious web content. The user may never intend to interact with the payload, which makes this technique effective for mass compromise and opportunistic intrusion.
Failure mechanism: The browser, plugin, or embedded-content handler processes attacker-controlled content and triggers code execution or a malicious redirect before the user can recognise the threat.
Impact: A successful drive-by can lead to malware installation, credential theft, session hijack, or further compromise of the endpoint and any authenticated services reachable from it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Drive-by exposure depends on outdated client software and known browser weaknesses. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Browser hardening and plugin restriction are core to reducing drive-by attack surface. | |
| Recommendation — Prioritise patching and exposure reduction for browsers, plugins, and endpoint software. Harden browser and endpoint settings to block unsafe content execution paths. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Drive-by targets are exposed to malicious code delivered through web content. |
| SI-2 — Flaw Remediation | Patched client software materially reduces the exploitation window for drive-by attacks. | |
| SC-7 — Boundary Protection | Blocking untrusted web content helps limit inbound web-based delivery paths. | |
| Recommendation — Deploy malware filtering and execution controls that inspect web-delivered content. Apply updates promptly to reduce exposure to client-side exploitation. Filter or restrict risky web content at network boundaries and web gateways. | ||
Practitioner Guidance
Why practitioners should care: Drive-by targeting is often a control-gap problem, not a single-vulnerability problem. Even when patching is current, permissive browser configuration or unnecessary legacy components can keep a system exposed.
What to watch for: Prioritise endpoints that browse the public web, have inconsistent patch levels, or still rely on older browser add-ons and embedded media handlers. Those systems are more likely to be selected because they broaden the attacker’s success rate.
Practitioner takeaway: The most effective defence is to shrink the browser’s trust surface, keep the client stack current, and remove avoidable paths for automatic content execution.
Related resources from NHI Mgmt Group
- When should teams move from target-phase controls to advanced OT Zero Trust controls?
- Should organisations allow pull_request_target for automated dependency workflows?
- How should security teams price identity platforms when non-human identities drive most activity?
- What should IAM teams review when SAML attributes drive access control?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org