An adversary technique where access is established and maintained without immediate disruption. In critical infrastructure, pre-positioning matters because the attacker is preparing for a future event, not just collecting data today. That makes persistence itself a strategic threat.
What Pre-Positioning Means in Cyber Conflict
Pre-positioning is not a noisy smash-and-grab intrusion. It is a deliberate posture of access, patience, and concealment, where an adversary preserves footholds so they can be used later when conditions are more favourable.
That makes the technique especially concerning in critical infrastructure, where the immediate objective may be long-term access rather than immediate theft or disruption. The strategic danger is that the intrusion can remain latent until a crisis, conflict, or operational window turns a hidden foothold into a high-impact capability.
Why Pre-Positioning Is So Dangerous
The central risk is time. A pre-positioned adversary can study the environment, adapt to defensive changes, and preserve access while appearing inactive. That creates a mismatch between observed calm and actual compromise, which is hard for defenders to judge from routine alerts alone.
Pre-positioning also shifts the defender's problem from event response to trust recovery. Once an attacker has maintained access for an extended period, the question is not only what they touched, but what they learned, what they staged, and what access paths may still exist.
How Defenders Look for Pre-Positioning
Detection usually starts with asset visibility and behaviour that does not match normal administration. Long-lived remote access, unusual administrative paths, unexpected persistence mechanisms, and changes that keep systems reachable without obvious disruption are all relevant signals.
Defenders also need to compare present activity with historical baselines. In critical infrastructure, the absence of obvious damage does not mean the environment is clean, so review should focus on authentication patterns, remote-management exposure, lateral movement indicators, and any evidence that access was preserved quietly over time.
Public threat reporting on cyber warfare explains why pre-positioning is so often discussed in the context of state conflict, while the Volt Typhoon Threat Actor Profile and China State Cyber Operations Guide show how long-term access, credential abuse, and critical-infrastructure targeting fit that pattern.
Containment and Recovery After Suspected Pre-Positioning
When pre-positioning is suspected, containment is about more than blocking the obvious entry point. Organisations usually need to assume persistence, review exposed trust relationships, and identify whether the adversary may have retained alternative access paths.
Recovery often requires broader confidence-building than a standard incident clean-up. That can mean revalidating privileged access, checking for hidden persistence, and treating the environment as potentially observed until the compromise timeline is understood well enough to support restoration.
For the broader conflict context, the Cyber Warfare Guide helps frame why hidden access can be strategically significant even before any disruptive action occurs.
Risk and Threat Considerations
Pre-positioning is dangerous because the adversary's value increases the longer they stay hidden. A foothold that is maintained quietly can support later sabotage, espionage, or disruption at a moment chosen by the attacker rather than the defender.
Failure mechanism: The attacker preserves access, blends into normal administration, and avoids triggering immediate alarms while building a latent capability for future use.
Impact: Organisations may face delayed detection, broader compromise than expected, and a much harder recovery because the original intrusion time and the full scope of persistence are unknown.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1071 — Application Layer Protocol | Pre-positioning commonly relies on stealthy, long-lived remote access and covert command paths. |
| Recommendation — Map hidden access channels to T1071 and hunt for low-noise persistence across remote protocols. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Pre-positioning is often only visible through careful log review and timeline reconstruction. |
| IA-5 — Authenticator Management | Adversaries that pre-position often depend on stolen, long-lived, or preserved credentials. | |
| Recommendation — Use AU-6 to review logs for dormant access, abnormal authentication, and preserved persistence. Apply IA-5 to rotate and invalidate credentials that may have enabled sustained covert access. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Pre-positioning is detected through anomaly monitoring over time rather than immediate disruption. |
| Recommendation — Use DE.CM-01 to baseline normal access and investigate persistent deviations promptly. | ||
Practitioner Guidance
What to watch for: Treat long-lived but low-noise access as a high-value investigative lead, especially where critical systems, remote administration, or exposed edge services are involved. The key judgment is whether access exists that should not still be trusted, even if the attacker has not yet acted openly.
Practitioner takeaway: The absence of damage is not evidence of absence, pre-positioning is a compromise pattern whose real payload may arrive much later.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org