Common types of cyber attack and how to defend against each
In short: Most incidents come from a small set of attack families: malware, phishing, credential attacks, denial of service, interception, injection, exploited flaws, supply chain compromise and insider misuse. Each family has well-known defences, and a handful of basic controls blocks a large share of them.
Why learn attack families?
New attack names appear every month, but almost all of them are variations on a few old ideas. If you understand the families, you can read a news story or an alert and quickly ask the right questions: how did it get in, what did it want, and which control should have stopped it? This note gives a defender's overview. For the basics of viruses, worms and Trojans see threats, vulnerabilities and risk.
The families and their defences
| Attack | What happens | Main defences |
|---|---|---|
| Malware | Harmful software runs on a device. Ransomware encrypts files; infostealers grab saved passwords and session cookies. | EDR, patching, application control, offline backups |
| Phishing | A fake email, text or call tricks someone into clicking, paying or giving a password. | Email filtering, training, phishing-resistant MFA, verify requests another way |
| Credential attacks | Leaked passwords are reused (stuffing) or common passwords are tried on many accounts (spraying). | MFA, unique passwords, lockout and sign-in monitoring |
| Denial of service (DoS/DDoS) | A service is flooded or crashed so real users cannot reach it. | Upstream DDoS protection, rate limiting, spare capacity |
| Interception (man-in-the-middle) | Traffic is read or altered between two parties, for example on a rogue Wi-Fi hotspot. | TLS everywhere, certificate checks, VPNs, secure Wi-Fi |
| Injection | Untrusted input is treated as a command, as in SQL injection. | Parameterised queries, input validation, secure frameworks |
| Exploiting known flaws | Attackers scan for unpatched internet-facing systems such as VPNs and firewalls. | Fast patching of exposed systems, reducing what is exposed |
| Supply chain | A trusted supplier, software update or library is compromised and used as a way in. | Supplier checks, least privilege for vendors, software inventories |
| Insider misuse | Staff or contractors misuse access, on purpose or by mistake. | Least privilege, logging, prompt leaver processes |
Opportunistic and targeted attacks
Most organisations are hit by opportunistic attacks: automated tools that try leaked passwords or a newly published flaw against anything that answers. They are not personal, and they succeed against whoever is easiest. Targeted attacks are rarer but more determined; the attacker studies one organisation and keeps trying. Basic hygiene defeats most opportunistic attacks, while targeted ones need layers of defence plus good detection and response.
Real-world example: a dental practice
A receptionist at a fictional dental practice receives an email that looks like a delivery notice and opens the attachment. It installs an infostealer that copies passwords saved in the browser, including the practice's booking system login. Two days later an attacker signs in to the booking system from abroad. Because the practice had turned on MFA for the booking system the month before, the sign-in fails and an alert goes to the IT supplier. The supplier rebuilds the PC, resets the saved passwords and turns off password saving in the browser. Three families appear in one incident (phishing, malware and credential theft) and one control broke the chain.
Attack goals
Families describe how an attack works; it also helps to ask what the attacker wants. Most criminal attacks aim for money, through ransom, fraud or selling stolen data. Others aim to disrupt a service, to spy, or to make a political point. The goal shapes what happens after the way in: a ransomware group moves towards backups and file servers, while a spy stays quiet and copies email for months. Thinking about goals helps you decide which systems to protect and watch most closely.
Tip: when you read about any attack, write one line each for "way in", "goal" and "control that would have helped". It is a quick way to build real understanding.
Practice
What is the difference between credential stuffing and password spraying?
Which defence is most effective against SQL injection?
Why do basic controls stop so many attacks?
Key takeaways
- A few attack families explain most incidents.
- Each family has standard defences, such as MFA, patching, TLS and parameterised queries.
- Real incidents often chain several families together.
- Most attacks are opportunistic, so basic hygiene blocks a large share.
- Targeted attacks need layered defences plus detection and response.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.