What Is Initial Access? How Do Attackers Gain Their First Foothold?

One of the most critical stages of a cyber attack is the moment the threat actor gains their first access from outside the organisation into internal systems or user accounts.

In cyber security literature this stage is called initial access.

Initial access is the stage at which the attacker obtains their first persistent or temporary access to the target organisation's network, applications, user accounts or cloud environments.

That access may come through;

a phishing email,

a compromised user account,

a vulnerability in an internet-facing application,

a misconfigured remote access system,

a third-party supplier account,

stolen credentials,

or another attack vector entirely.

But there is an important point:

Initial access is not the end of the attack.

In most advanced attacks the first foothold only means the door has been opened.

The real question begins after that:

How far can the attacker progress with this access?

This is why initial access in Red Team operations is not judged simply as “we managed to get in”.

After the initial foothold, the analysis covers;

• what privileges the attacker holds,
• which systems they can see,
• whether credentials could be captured,
• whether privilege escalation opportunities exist,
• whether lateral movement was possible,
• whether the SOC and EDR systems noticed the attack.

All of this is examined in turn.

In the modern security approach, initial access is one of the starting points of the entire attack chain.

What Is Initial Access?

Initial access describes the methods a threat actor uses to gain their first access to a target organisation.

Within the MITRE ATT&CK framework, initial access is defined as a distinct tactic covering various attack techniques.

Those techniques generally include methods such as;

• phishing,
• valid accounts,
• external remote services,
• public-facing application exploitation,
• trusted relationship,
• supply chain compromise.

Any of these can be the entry point.

Not every attack starts from the same place.

Some attacks target the human factor.

Some exploit vulnerabilities in internet-facing applications.

Some use previously leaked user credentials.

And some target the supplier rather than the organisation directly.

In a professional Red Team engagement, the initial access scenario must therefore be chosen according to the organisation's real attack surface and threat profile.

Why Does Initial Access Matter So Much?

An organisation's security architecture is usually designed to block attacks coming from outside in.

Firewall,

WAF,

email security systems,

EDR,

MFA,

VPN,

identity security,

SIEM

are all solutions that try to reduce initial access risk.

But if the attacker somehow gets past one of those layers, the whole security strategy must not collapse.

One of the core ideas of the modern defensive approach emerges here:

Assume breach – assume the compromise may already have happened.

This approach asks the question:

Even if the attacker gains initial access, can we stop them inside?

The purpose of initial access security is therefore not only to protect the front door.

It is also to limit the attacker's freedom of movement after that first foothold.

1. Phishing: One of the Best-Known Initial Access Methods

Phishing is the social engineering method by which attackers try to trick users into performing a particular action.

But not all phishing attacks are the same.

While generic phishing attacks can be sent to very large user groups, spear phishing is prepared far more selectively.

Through OSINT work an attacker may have learned;

the employee's name,

their department,

their manager,

the technologies they use,

the company's suppliers,

its current projects.

All of it publicly available.

This information can make the phishing message look far more genuine.

Instead of an ordinary:

“Your password is expiring.”

message, content can be crafted that appears connected to the user's real business processes.

Phishing security can therefore not be left to spam filters alone.

User awareness, email security, MFA and behavioural analysis must work together.

What Is the Difference Between Spear Phishing and Phishing?

Phishing generally describes social engineering attacks aimed at broad audiences.

Spear phishing describes more personalised attacks aimed at specific people or groups.

For example:

Phishing

A generic fake email sent to thousands of people.

Spear Phishing

A targeted attack sent to a particular finance manager, referencing an internal business process.

The main reason spear phishing attacks are more dangerous is that they use context.

The message appears consistent with the user's daily work.

That makes it much harder to spot.

2. Valid Accounts: The Use of Legitimate User Accounts

One of the most serious risks in modern attacks is the attacker entering the system not by “hacking” it, but by logging in with a valid user account.

In MITRE ATT&CK terminology this approach is called valid accounts.

If an attacker holds a genuine username and password, the activity can look entirely normal to many security systems at first glance.

The user might, for instance;

connect to the VPN,

sign in to a Microsoft 365 account,

access corporate applications,

connect to cloud resources.

All of it apparently routine.

The critical problem here is this:

Authentication may succeed, but the person signing in may not be the real user.

In modern security architecture, password verification alone is therefore not enough.

MFA,

conditional access,

risk-based authentication,

device trust,

location analytics,

behaviour analytics

all gain importance.

Credential Stuffing and Password Reuse Risk

If users use the same or similar passwords across different platforms, a data breach at another service can also affect the organisation's security.

This risk is tied to password reuse.

A third-party platform an employee uses personally may, for instance, have been breached.

If the same email and password combination is also used in corporate systems, the attacker may try to make use of those credentials.

Attacks of this kind are generally associated with the credential stuffing approach.

It is therefore not enough for organisations to apply a strong password policy alone.

Additional layers must be used at the same time, such as;

MFA,

breached credential monitoring,

conditional access,

passwordless authentication.

Each closes a different part of the gap.

3. Does MFA Block Every Initial Access Attack?

Multi-factor authentication (MFA) is one of the most important controls in protecting user accounts.

But using MFA does not mean initial access risk has disappeared entirely.

Modern threat actors can develop various social engineering and identity-based attack methods.

An organisation's security strategy should therefore not rest solely on the;

“We use MFA, we're safe.”

assumption.

Additional controls such as;

phishing-resistant MFA,

FIDO2,

passkeys,

device compliance,

conditional access,

anomalous session detection

have become important parts of modern identity security architecture.

Red Team operations can also measure how effective identity security controls are against real attacker behaviour.

4. Public-Facing Applications: Internet-Exposed Systems

Organisations may have a great many systems on the internet.

For example;

web applications,

VPN systems,

mail gateways,

remote access platforms,

API services,

customer portals,

file sharing systems,

management panels

may all be reachable over the internet.

A critical vulnerability in any one of these systems can become an initial access point for an attacker.

Within MITRE ATT&CK this is generally associated with the exploit public-facing application technique.

Knowing every asset reachable on the internet is therefore critically important.

The core problem here is usually not the main systems.

The real risk emerges in internet assets that are;

old,

forgotten,

without a clear owner,

left unpatched.

These are the ones nobody is watching.

Why Does External Attack Surface Management Matter?

An organisation cannot protect a system it does not know it has.

External attack surface management (EASM) therefore plays an important role in the modern security approach.

EASM work helps with the continuous discovery of systems visible from the outside world, such as;

domains,

subdomains,

IP addresses,

cloud resources,

internet services,

certificates,

shadow IT assets.

All of it mapped continuously.

This approach matters for reducing initial access risk.

Because the system attackers use to gain their first foothold may be an old internet asset the organisation's security team is not actively tracking.

5. VPN and Remote Access Systems

With the spread of remote working models, VPN and other remote access solutions have become critical parts of corporate infrastructure.

They are also valuable targets from the attacker's perspective.

The risk may stem from;

out-of-date VPN systems,

weak authentication,

a lack of MFA,

leaked user accounts,

incorrect access policies.

Any of these can open the door.

The security approach here should not be merely keeping the VPN system up to date.

Sign-in behaviour must also be monitored.

Signals such as;

an unusual location,

an unfamiliar device,

an out-of-hours time,

a high number of failed logins,

a new device registration

matter greatly for identity security and SOC processes.

6. Third-Party Access and Trusted Relationship

Organisations work with many third-party companies.

Software firms,

maintenance teams,

integrators,

cloud providers,

support companies,

outsourcing firms

may all hold access to certain systems.

Those accesses can form an alternative initial access route for an attacker.

MITRE ATT&CK covers such attacks under the trusted relationship approach.

Rather than targeting a large organisation with strong security controls directly, an attacker may target a supplier with weaker security.

They can then use the existing trust relationship to try to reach the main organisation.

Third-party risk management is therefore not merely a contractual compliance topic.

It is a direct part of the cyber attack surface.

What Is a Supply Chain Attack?

A supply chain attack describes an attack carried out through a product, service or supplier the organisation uses, rather than targeting the organisation directly.

These attacks may take place through;

the software supply chain,

update mechanisms,

third-party access,

service provider accounts.

Each is a route the organisation does not fully control.

Organisations must therefore evaluate not only their own security level, but also the security maturity of their critical suppliers.

Supplier relationships can be analysed from this angle in Red Team and threat intelligence work.

7. Cloud and Microsoft 365 Initial Access Risk

As corporate infrastructure has moved to cloud environments, the attack surface has changed with it.

Platforms such as;

Microsoft 365,

Azure,

AWS,

Google Cloud

now host the critical business processes of many organisations.

Modern initial access attacks may therefore start on user identity rather than on the corporate network.

The attacker's target may not be;

VPN access,

but a Microsoft 365 account.

Because through that account one can reach many resources, including;

email,

SharePoint,

OneDrive,

Teams,

corporate documents.

All from a single set of credentials.

This is why the identity is the new perimeter approach is gaining ever more importance in modern security architecture.

8. What Is an Initial Access Broker?

One of the important concepts in the cyber crime ecosystem is the initial access broker (IAB).

Rather than running ransomware operations themselves, initial access brokers may focus on obtaining access to organisations and selling it on to other threat actors.

Accesses such as;

VPN access,

RDP access,

a compromised user account,

web shell access

can become commercial commodities in the criminal ecosystem.

This shows why the initial access stage matters so much.

The first access an attacker obtains does not have to be used by that same threat actor.

The access can be handed to another group.

The compromise of any company account or system can therefore be the first step of a much larger attack.

9. What Happens After Initial Access?

Once an attacker obtains initial access they have usually not yet reached their final objective.

The first foothold is often at the level of a low-privileged user or endpoint.

The attacker then tries to gather information about the environment.

This process may progress into MITRE ATT&CK stages such as;

Discovery

Credential Access

Privilege Escalation

Persistence

Lateral Movement

Each stage builds on the last.

The attacker may, for example, try to understand;

which user they are signed in as,

which computer they are on,

which domain they are in,

which servers are reachable,

which security products are running.

Visibility after initial access is therefore critically important for the defence.

The Difference Between Initial Access and Persistence

These two concepts are frequently confused.

Initial access describes the attacker reaching the system for the first time.

Persistence is the attacker's attempt to build mechanisms that let them return after losing that access.

An attacker may, for instance, reach the system for the first time using a user account.

That is initial access.

Their subsequent attempt to establish a different access method falls into the persistence stage.

This distinction is important in MITRE ATT&CK-based Red Team and detection engineering work.

How Does a SOC Detect an Initial Access Attack?

Detecting initial access attacks is not the job of a single security product.

The SOC team must correlate signals arriving from different sources.

For example;

email security logs,

Microsoft 365 audit records,

identity provider logs,

VPN logs,

EDR/XDR telemetry,

WAF records,

firewall logs,

conditional access records

can all be assessed together.

A single login record may look normal on its own.

But;

a new device,

an unusual location,

followed by unexpected file access,

then connections to different corporate services

become far more meaningful when assessed together.

One of the most important capabilities of modern SOC operations is therefore correlation.

How Is Detection Engineering Used for Initial Access?

Detection engineering teams can analyse attackers' initial access techniques and build detection scenarios around them.

The aim is not to catch every attack through a single signature.

Behavioural indicators are sought instead.

Signals such as;

an unusual authentication pattern,

an unexpected country or location,

a device new to that user,

unusual SaaS access,

a high number of authentication failures,

a risky sign-in

are evaluated.

Red Team operations can also be used to test whether these detections actually work in the real world.

What Does a Red Team Measure in Initial Access Testing?

In a professional Red Team operation, initial access should not be measured only by whether the access succeeded.

Metrics such as the following should also be assessed;

Time to Detect

How long did it take for the first attacker behaviour to be noticed?

Time to Investigate

How long did the SOC take to begin investigating the incident?

Time to Contain

How long did it take for the user account or endpoint to be brought under control?

Detection Coverage

Which security layers saw the attack technique used?

User Response

Did the user report the suspicious activity?

Identity Controls

Did MFA and conditional access stop the attack?

Together these paint the real picture.

What Should Organisations Do to Reduce Initial Access Risk?

No single technology can eliminate initial access risk entirely.

A layered security approach is therefore required.

In particular;

MFA,

phishing-resistant authentication,

email security,

EDR/XDR,

up-to-date patch management,

external attack surface management,

vulnerability management,

conditional access,

identity protection,

security awareness,

third-party risk management,

SOC monitoring

should be considered together.

Alongside these, the organisation's internet assets must be penetration tested regularly and vulnerabilities closed quickly.

The Difference Between a Pentest and an Initial Access Test

There is an important difference between a penetration test and a Red Team initial access scenario.

A pentest mostly focuses on identifying vulnerabilities in specific systems.

A Red Team assesses whether those vulnerabilities, or other attack vectors, can be used to reach an operational objective.

A web penetration test might find a vulnerability in a portal.

The Red Team asks a different question:

“Can this vulnerability be used to reach the organisation's internal network or critical user accounts?”

The Red Team approach therefore focuses on the attack path rather than on individual vulnerabilities.

How Does Threat Intelligence Change Initial Access Scenarios?

The behaviour of attackers targeting each sector is not the same.

In advanced Red Team operations, initial access scenarios can therefore be supported by cyber threat intelligence.

If threat actors targeting the organisation's sector are observed to have made heavy recent use of methods such as;

phishing,

internet-facing application exploitation,

valid accounts,

third-party access,

then the Red Team engagement can prioritise those techniques.

This approach is the basis of the threat-informed defense and threat-informed Red Teaming concepts.

The aim is not to test every attack at once.

The aim is to test the threats that are most meaningful for the organisation.

What Should an Initial Access Report Contain?

A professional initial access assessment or Red Team report should contain more than the statement “access was achieved”.

The report should be able to answer these questions:

Which attack surface was used?

Which security control was bypassed?

Which control stopped the attack?

Did the SOC notice the incident?

Did the user raise the alarm?

What privilege level did the access carry?

Which systems could be reached after the initial foothold?

Could the attack chain be continued?

This approach makes the report meaningful both for technical teams and for senior management.

Why Is Initial Access Now an Identity Security Problem?

In the past the corporate security boundary was mostly defined by the network.

Being inside the organisation could imply trustworthiness.

With the spread of cloud and SaaS services this model has changed significantly.

Today an employee can reach the same applications;

from the office,

from home,

from a mobile device,

from a different country.

The location tells you very little.

The security boundary is therefore no longer the firewall alone.

Identity, device, context and behaviour must be assessed together.

This approach is also one of the core principles of Zero Trust architecture.

Never trust, always verify.

In other words, even when a user's identity has been authenticated, access must be continuously evaluated against context.

Conclusion: Initial Access Is the Door to the Attack, Not Its End

An attacker gaining initial access to an organisation is a serious security incident.

But the most critical part of the attack usually begins afterwards.

Once the attacker has that first foothold they ask these questions:

Where am I?

Which user am I?

Which systems can I see?

Which accounts can I reach?

Can I escalate my privileges?

Can I move to other systems?

At this point the attack begins moving from initial access deeper into the corporate network.

A successful cyber security strategy should therefore not focus only on stopping the attacker at the door.

It must also limit their freedom of movement on the assumption that they got inside.

This is where the core value of the modern Red Teaming approach appears.

A Red Team does not merely test whether the door opens.

It also assesses how far the attacker can go once it has.

And in many corporate environments one of the most critical points on that route is Microsoft Active Directory.