# What is initial access in a cyberattack?

Initial access is the tactic of getting a first foothold in your network. The common ways in are phishing that makes someone run a file or enter a password, exploiting a vulnerability in an internet-facing system such as a VPN gateway or firewall, logging in to remote services with stolen or guessed passwords, abusing a supplier's access, and drive-by downloads from compromised websites. CISA's ransomware advisories list these routes again and again. Most defences sit outside a network sensor: patching internet-facing devices first, multi-factor authentication (MFA) on every remote login, e-mail filtering and closing services you do not need. Initial access itself is often only partly visible on the network, but what follows usually is: the compromised machine contacting the attacker's server. NetSenX flags that beaconing on every plan, Free included.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-initial-access

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What does execution mean in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-execution-in-mitre-attack)
- [What is persistence in a cyberattack?](https://netsenx.com/en/faq/what-is-persistence-in-a-cyberattack)
- [What is privilege escalation?](https://netsenx.com/en/faq/what-is-privilege-escalation)
- [What is the Stealth tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-stealth-tactic-in-mitre-attack)
- [What is Defense Impairment in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-defense-impairment-in-mitre-attack)