Read as
Why this module exists. Initial access — getting first execution in a target environment — has evolved as defences have improved. Spear-phishing still works but with refined techniques. Cloud-credential abuse is rising. This module covers the 2026 initial-access landscape and the operator’s modern toolkit.
The initial-access categories
- Phishing: targeted email with malicious link or attachment.
- Valid accounts: stolen / purchased credentials; password spray.
- Exposed services: VPN, RDP, web-app vulnerabilities.
- Supply chain: compromise a vendor; reach the target.
- Drive-by compromise: malicious website; user visits and is compromised.
- Removable media: USB drops, infected media.
Need a real pentest?
Get a VAPT scoping call
Senior practitioner-led VAPT — not a checklist run by juniors. CVSS-scored findings, free retest, attestation letter. India's SMBs and SaaS teams.
Book VAPT scoping call
Replies in 4 working hrs · India-only · Senior consultants