Cyberattack

A cyberattack is a targeted attempt to gain unauthorized access to IT systems and cause damage there. Most attacks follow a recurring sequence that defenders can interrupt at several points if they know it.

Reports of hacked companies have become part of the daily news. Behind the headlines lies almost always the same finding: the attack ran for weeks and was only noticed when the systems were encrypted. Anyone who understands how cyberattacks work can interrupt them much earlier.

For IT decision-makers, a sober view pays off. Cyberattacks are predominantly labor-divided, economically motivated processes with recurring patterns, and it is precisely these patterns that make them calculable.

What is a cyberattack?

A cyberattack is a deliberate act against IT systems or data with the aim of violating their confidentiality, integrity or availability. Behind it are different actors with different intentions:

Financially motivated criminals: extort ransom, trade in stolen data or redirect payments. They are responsible for the largest share of attacks on companies.
State-backed groups: conduct espionage and sabotage, usually long-term in nature and hard to detect.
Insiders: misuse legitimate access, out of frustration or for payment.
Hacktivists: seek public attention for their causes through overload attacks or data leaks.

For defense, this distinction matters because it sets the yardstick: against automated mass attacks, solid basic measures help, while targeted campaigns additionally require detection and containment inside the network.

How such an attack works

Most attacks follow a sequence described in the field as the kill chain. Defenders can disrupt each individual phase:

Reconnaissance: Attackers gather information about the target's technology and employees, for example from public sources and leaked credentials.
Initial access: Through phishing, exploited vulnerabilities on internet-facing systems or purchased credentials, they get their first foot in the door.
Establishing a foothold: Malware or misused remote maintenance tools secure access permanently, usually connected to a channel to a control server.
Spreading: From the first system, attackers move laterally through the network, expand their privileges and look for worthwhile targets. This phase often lasts the longest and is the most likely to go unnoticed.
Impact: At the end come data exfiltration, encryption or sabotage, depending on the motive. Only now does the attack become visible to many of those affected.

From this sequence comes the most important insight for defense: there is time between initial access and impact. Anyone who impedes and observes internal movements gains room to act precisely there. Frameworks such as MITRE ATT&CK catalog the techniques used and help teams test their own detection specifically against them.

Why protection against cyberattacks matters

Business interruption: standstill in production or logistics costs money from the first day, regardless of any ransom question.
Reporting and liability obligations: GDPR and NIS2 require prompt notifications and effective precautions, and violations carry the risk of significant sanctions.
Follow-up costs: recovery and forensic analysis frequently exceed the immediate damage considerably.
Supply chain risk: a compromised supplier quickly becomes a gateway for its customers, so the requirements of clients rise accordingly.
Insurability: cyber insurers tie policies and premiums to demonstrable protective measures such as segmentation and multi-factor authentication.
A permanent state rather than an exception: attempted attacks hit companies constantly, mostly automated. What matters is that attempts do not turn into successful breaches.

Typical attack types and scenarios

Among the most common forms is phishing along with its targeted variant, spear phishing, as well as ransomware, which combines encryption with data theft. Overload attacks (DDoS) paralyze publicly accessible services. In credential stuffing, attackers automatically try stolen password lists against login pages. Business email compromise works entirely without malware: perpetrators pose as an executive or supplier and redirect payments. Supply chain attacks compromise software updates or service providers and thereby hit many companies at once. The boundaries are fluid, and a single incident often combines several of these techniques. Added to this is the quiet, constant barrage of automated scans that search around the clock for open services and outdated software.

Cyberattack vs. security incident

The terms are frequently mixed up but denote different things. A cyberattack is the deliberate act of an attacker. A security incident is any event that violates or seriously endangers protection goals, even without a perpetrator: the misconfiguration that makes data publicly accessible, or the failure of a data center. Every successful attack is thus a security incident, but by no means is every incident an attack. The distinction has practical consequences: reporting obligations and internal response processes attach to the incident, regardless of whether an attacker was involved. A repelled attack, in turn, may remain exempt from reporting and still yields valuable insights for defense. For internal communication, it is worthwhile to define both terms cleanly, so that reporting chains work in an emergency without a debate over first principles.

Protection against cyberattacks at KAEMI

KAEMI starts where attacks cause the greatest damage: at the spread through the network. Microsegmentation limits compromised systems to their segment and makes lateral movements visible, while SASE/SSE controls access from sites and mobile teams. In addition, we assess together with you how well your emergency processes are prepared for the sequence described. For an assessment of your defensive capability, reach our team via the contact page .

Frequently asked questions about Cyberattack

What is the difference between a cyberattack and a security incident?

A cyberattack is the deliberate act of an attacker against IT systems or data. A security incident is any event that violates protection goals, even without malicious intent, such as a misconfiguration with data leakage. Every successful attack is an incident, but the reverse does not hold. Reporting obligations and internal processes usually attach to the incident, regardless of the trigger.

What motives lie behind cyberattacks?

By far the most common motive is money: extortion through encryption and data theft, fraud through redirected payments or the sale of stolen credentials. In addition, state-backed groups conduct espionage and sabotage. Hacktivists seek public attention for political causes, while insiders act out of frustration or for payment. For defense, the route used matters more than the motive.

Why do cyberattacks often go undetected for a long time?

After breaking in, attackers prefer to use legitimate tools and stolen credentials, so their behavior resembles normal administration. The attack often becomes conspicuous only at the point of impact, such as encryption. Anyone who monitors internal connections and detects unusual access shortens this phase considerably. Segmentation additionally forces movements that become visible in monitoring.

Are small and medium-sized companies even a worthwhile target?

Yes, because many attacks find their target automatically: the entire internet is scanned, and whatever is vulnerable is attacked. Company size plays no role here. Mid-sized companies are also of interest as suppliers because they hold access to larger clients. Tighter security budgets also make them attractive, because the effort for a successful attack decreases.

What should a company do first during an ongoing attack?

Isolate affected systems, secure evidence and activate the prepared emergency plan, including clear responsibilities and communication channels. Deleting or reinstalling prematurely destroys forensic traces. Also check the reporting obligations early, for example toward the data protection authority. If there is no emergency plan of your own, external specialists should be brought in immediately. What matters is that these procedures were rehearsed before the emergency.