How a hacker actually breaks in

The single most useful shift in learning security is to stop thinking like a builder and start thinking like an attacker. A builder asks "how do I make this work?" An attacker asks "how do I make this do something it was never meant to do?" Almost every real breach comes from that second question.

This mindset has a defining principle: systems fail at their weakest link, not their strongest. You can have military-grade encryption and a hardened firewall, and an attacker will simply walk around all of it by tricking an employee into revealing a password. Attackers do not attack your strengths; they hunt for the one overlooked weakness, because they only need to find a single way in, while a defender must cover every possible way at once.

That asymmetry, attacker needs one hole, defender must close them all, is why security is hard, and why understanding the attacker's process is the foundation of defense. You cannot protect against something you do not understand.

This lesson walks through how a real attack actually unfolds, stage by stage. The goal is not to make you an attacker but to give you the map attackers use, because every stage on that map is also a place a defender can catch and stop them.

The movie image of hacking, a person furiously typing and suddenly shouting "I'm in!", is almost entirely wrong. Real attacks are slow, patient, multi-stage campaigns that can unfold over weeks or months. Seeing the stages is the key to understanding, and defending against, all of them.

Security professionals model this as a chain of stages, an idea popularized as the "cyber kill chain." A simplified but accurate version has five:

• Reconnaissance: studying the target and mapping its weaknesses.
• Initial access: getting the first foothold inside.
• Privilege escalation: turning limited access into powerful access.
• Lateral movement: spreading from the entry point to valuable systems.
• Actions on objective: doing the actual damage, stealing data, deploying ransomware.

The power of this model is a crucial defensive insight: an attack is only successful if it completes the whole chain, but a defender only has to break it at one link. If you can detect and stop the attacker at any single stage, the attack fails. This turns defense from an impossible "block everything" problem into a more tractable "catch them at one of several stages" problem.

The rest of this lesson takes each link in turn, so you understand both how attackers advance and where each link can be cut.

Every serious attack begins with reconnaissance: gathering information about the target before touching it. Attackers, like any professional, do their homework, and the amount they can learn without doing anything illegal is startling.

The goal is to map the attack surface: every possible point where the target could be entered. That includes technical assets, what servers, websites, and software the organization runs, and human assets, who works there, their roles, their emails, gathered from public sources like the company website, social media, and job postings. A job listing seeking an engineer with a specific database skill quietly tells an attacker exactly what technology you run.

Much of this is passive: reading public information, which leaves no trace and is impossible to detect. Some is active: probing the target's systems directly, such as scanning which network ports are open, which is more detectable.

The defensive lesson from recon is attack surface reduction: the less you expose, the less there is to attack. Every unnecessary service running, every bit of oversharing about your systems, every unused account, is a gift to reconnaissance. You cannot stop attackers from reading public information, but you can control how much there is to find, and minimizing your footprint is one of the cheapest, most effective defenses there is.

Initial access is the moment the attacker gets their first foothold inside, and knowing the common routes tells you where to spend your defenses. In practice, the ways in are surprisingly few and predictable.

The data is clear about the top routes. According to Verizon's 2025 Data Breach Investigations Report, which analyzed over 22,000 incidents, stolen credentials were the single most common initial access vector, used in about 22 percent of breaches, and phishing began about 16 percent. The report found the human element, errors and social engineering, played a role in around 60 percent of breaches. The three dominant doors are:

• Stolen or guessed credentials: logging in as a legitimate user, no "hacking" required.
• Phishing: tricking someone into revealing credentials or running malware.
• Exploiting a vulnerability: abusing a software flaw in an exposed system.

Notice that two of the three top routes target people, not technology. This is the central practical truth of modern security: attackers overwhelmingly log in rather than break in, using credentials a human handed over or reused. The next lesson is devoted entirely to this human layer for exactly this reason.

The defensive priority follows the data: since stolen credentials and phishing dominate, the highest-leverage defenses are strong authentication (especially multi-factor), user awareness, and prompt patching of exposed software, in roughly that order.

Getting inside is rarely the end; the first foothold is usually low-privilege, a single ordinary user's account or a limited process. To do real damage, the attacker needs more power, and gaining it is called privilege escalation.

The goal is to go from a limited account to an administrator or root account, one that can control the whole system. There are two directions. Vertical escalation means gaining higher privileges than you started with, an ordinary user becoming an admin. Horizontal escalation means taking over other accounts at the same level to widen your reach.

How do attackers escalate? Common paths include exploiting a software bug that grants elevated permissions, finding credentials carelessly left on the system (passwords in a config file, a script, or a document), or abusing a misconfiguration where an account has more power than it should.

This stage is exactly why the principle of least privilege is so important, a theme that runs through all of defense. If every account and process has only the minimum access it needs, then an attacker who compromises one gains very little, and has far fewer routes to escalate. When accounts are over-privileged, one compromised login can hand over the entire system. Escalation is only easy when the environment is careless with permissions, which makes disciplined access control one of the strongest defenses available.

The system an attacker first lands on is rarely the one holding the valuable data. So they spread sideways through the network toward their real target, a stage called lateral movement, and they take steps to make sure they cannot be easily kicked out, called persistence.

Lateral movement is the attacker hopping from the initially compromised machine to others, reusing harvested credentials, exploiting internal trust between systems, and repeating the escalate-and-move pattern until they reach the valuable systems, the database, the financial records, the source code. This stage is why a breach of one unimportant laptop can end in the theft of the crown jewels: the attacker used it as a stepping stone.

Persistence is the attacker ensuring continued access even if the original hole is closed, by creating hidden accounts, installing backdoors, or planting scheduled tasks that quietly let them back in. This is why simply removing the initial malware often fails: the attacker has established several other ways back in.

The defensive concept that fights this stage is network segmentation: dividing the network into isolated zones so that compromising one does not grant access to the rest. Combined with least privilege, segmentation contains an intruder to a small area instead of letting them roam freely. Lateral movement thrives on flat, open networks where one foothold reaches everything, and it is starved by networks built in compartments.

Finally, the attacker does what they came to do. This last stage, actions on the objective, is where the actual harm happens, and it takes a few characteristic forms depending on the attacker's goal.

The common objectives:

• Data theft (exfiltration): quietly copying valuable data, customer records, intellectual property, credentials, out of the network, often disguised to blend in with normal traffic.
• Ransomware: encrypting the organization's data and demanding payment for the key, and increasingly also stealing the data first to threaten leaking it.
• Sabotage or fraud: destroying systems, or manipulating them to divert money or cause disruption.

A sobering detail: attackers often sit undetected for a long time before acting. The interval between initial compromise and discovery, called dwell time, is frequently measured in weeks or months, during which the attacker is quietly moving, escalating, and preparing. Many organizations learn they were breached not from their own systems but from an outside party.

This long, quiet presence points to the final piece of defense: detection. Because you cannot prevent every intrusion, the ability to notice an attacker who is already inside, before they reach the objective, is essential. A short dwell time, catching them during recon, escalation, or lateral movement, is often the difference between a contained incident and a catastrophe. Detection breaks the chain before its last, damaging link.

An attack advances through five stages from reconnaissance to the objective, and it only succeeds if it completes the whole chain; each stage has a matching defense that can break the chain and stop the attack.