Beginners picture hacking as a single dramatic moment — a genius types furiously and "I'm in!" Reality is slower and more methodical. A serious breach is a campaign that unfolds over days, weeks or months, in stages. Understanding those stages is what turns you from someone who reacts to individual bugs into someone who can defend a whole system — because each stage is a chance to catch the attacker.
The attack lifecycle
Most intrusions move through roughly these phases (see the diagram):
- Reconnaissance — the attacker studies the target: employees, exposed servers, technologies, leaked credentials. Much of this uses public information and triggers no alarms.
- Initial access — they get a first foothold, often not through a clever exploit but through a phished password, an unpatched service, or a leaked key.
- Privilege escalation — a normal-user foothold isn't enough, so they exploit a flaw or misconfiguration to gain administrator rights.
- Lateral movement — from one machine they pivot across the network, hunting for valuable systems, quietly expanding their access.
- Actions on objectives (exfiltration) — finally they do what they came for: steal data, encrypt everything for ransom, or sabotage.
Why stages matter: defence in depth
The single most important insight here is defensive. Because an attack is a chain, a defender only has to break one link. If reconnaissance is noticed, or initial access is blocked, or privilege escalation fails, or lateral movement is contained, the campaign stalls before real damage. This is why defence in depth — many independent layers — beats one strong wall: any single layer might fail, but all of them failing in sequence is far less likely. And the earlier you catch it, the cheaper it is.
Mapping the enemy: MITRE ATT&CK
Defenders don't have to imagine attacker behaviour — it has been catalogued. MITRE ATT&CK is a public, constantly updated knowledge base of the real tactics and techniques attackers use, organised by lifecycle stage. Security teams map their defences and detections against ATT&CK to find blind spots ("we have nothing that would catch lateral movement via technique X") and close them systematically. It turns "think like an attacker" from a slogan into a checklist.
With the shape of an attack clear, the next lessons go deeper on the terrain it crosses — the network — and then on what happens when, inevitably, something gets through.
