Ask what the cyber security threats are and you get a list of twenty attack types with no indication of which ones matter. That is the wrong shape for the question. A handful of routes account for the large majority of real breaches, the annual reports measure them, and the ranking changed this year. Here is the list in proportion, with how each threat works and what stops it.
Threat vs Attack vs Vulnerability
Three words that get used interchangeably and should not be. A vulnerability is a weakness: an unpatched flaw, a reused password, an employee who has never seen a phishing email. A threat is someone or something that could use it. An attack is the threat actually using it. Risk is the combination: how likely the attack is, times how bad it would be. Defenses reduce risk by removing vulnerabilities, blocking threats, or limiting the damage when an attack lands.
The list below is ordered by the first factor, likelihood, because that is what the data measures best.
Where Cyber Security Threats Come From
| Actor | Motivation | What they typically do |
|---|---|---|
| Financially motivated criminals | Money | Ransomware, extortion, fraud, at scale against whoever is easiest |
| State-sponsored groups | Espionage, disruption | Long, quiet intrusions into governments, infrastructure, contractors and their suppliers |
| Insiders | Money, grievance, or an honest mistake | Misuse of legitimate access, or an error that exposes data |
| Hacktivists | Attention for a cause | Denial of service, defacement, leaks |
| Opportunists | Anything available | Automated scanning for exposed, unpatched systems |
For nearly everyone, the first row is the threat. The FBI's Internet Crime Complaint Center recorded $20.877 billion in reported losses in 2025, 26 percent more than the year before, per the 2025 IC3 Annual Report. Cyber-enabled fraud accounted for 85 percent of it. None of that came from states or activists.
The Most Common Cyber Attack Entry Points
The 2026 Verizon Data Breach Investigations Report, built from thousands of confirmed breaches, put the entry points in this order for the first time in its 19 years:
- Exploiting vulnerabilities, at 31 percent of breaches, now the top way in.
- Stolen credentials, the leader every previous year.
- Social engineering, including phishing, with success rates on mobile up 40 percent.
- Third parties, involved in 48 percent of breaches, up 60 percent in a year.
Those are the doors. Everything else on the list is either a way of opening one of them or what happens after it opens. The matrix below places the twelve by how likely they are to reach a typical organization and how bad it is when they do.
The 12 Types of Cyber Security Threats
1. Exploited Software Vulnerabilities
Every piece of software has bugs. Some of them let an outsider run their own code or read data on the machine. When a vendor publishes a fix, it also publishes, in effect, a description of the flaw, and attackers race the patching. The 2026 DBIR's headline was that this race is now the number one breach entry point, at 31 percent, and that AI has cut the time from a flaw being disclosed to it being exploited from months to hours.
What stops it: installing updates promptly, and knowing which ones matter most. CISA's Known Exploited Vulnerabilities catalog lists the flaws attackers are actively using right now, which is a far shorter and more useful list than "everything." Internet-facing systems such as VPN gateways, firewalls and remote access tools go first.
2. Stolen and Guessed Passwords
Attackers do not need to break in if they can log in. Passwords are stolen by phishing, harvested by malware, or simply bought: every large breach releases millions of email-and-password pairs, and people reuse passwords, so a password from a breached forum in 2021 often still opens a bank login today. That reuse attack is called credential stuffing and it is automated.
What stops it: multi-factor authentication, which makes a stolen password insufficient on its own, and unique passwords, which make a stolen one useless anywhere else. CISA's guidance is that any MFA is better than none and that phishing-resistant forms, such as a security key or a passkey, are the standard to aim for.
3. Phishing and Social Engineering
A message, a call or a text designed to make a person do something: type a password into a fake page, approve a login prompt, install a tool, move money. It is the most reported crime type to the FBI by count, at 191,561 complaints in 2025, and it is the way in for a large share of the breaches attributed to stolen credentials, because that is how the credentials were stolen.
The full mechanism, the types, and what to do in the ten minutes after a click are in what phishing is and how it works.
4. Ransomware and Data Extortion
Ransomware is malware that encrypts files and demands payment for the key. The modern version adds a second lever: the attackers copy the data out before encrypting it and threaten to publish it, so a good backup no longer ends the negotiation. Increasingly the encryption is skipped altogether. A group takes the data, demands payment, and publishes it when nobody pays, which is the pattern behind most of the breaches on this site.
- EntryA phished login, an exposed remote access tool, an unpatched gateway
- FootholdA persistent tool so they can return
- SpreadAdmin credentials harvested, servers and backups located
- ExfiltrateData copied out, often hundreds of gigabytes
- EncryptFiles locked; sometimes skipped
- ExtortPay for the key, pay so the data stays private, or both
IBM's 2026 Cost of a Data Breach study found ransomware in 39 percent of the breaches it examined, up from 34 percent the year before. What stops it: everything that stops the first three threats, plus backups an attacker on the network cannot reach, segmentation so one compromised machine cannot see the rest, and someone watching for the spread stage. CISA's StopRansomware program publishes the checklist.
5. Third-Party and Supply Chain Attacks
Your data lives with your suppliers: the payroll provider, the marketing platform, the IT contractor with admin access, the software you install. Breach one of them and you reach everyone downstream. The 2026 DBIR put third-party involvement at 48 percent of breaches, up 60 percent in a year, the biggest single shift in the report. The same shape appears in the ShinyHunters campaign that runs through many of this year's reports: one hosted platform, hundreds of victims.
What stops it: knowing which suppliers hold what, giving them the least access that works, asking for their attestations, and monitoring the accounts they use. The compliance frameworks most customers now ask for are largely about this.
6. Business Email Compromise
A specific and expensive form of social engineering aimed at money. The attacker impersonates an executive, a supplier or a lawyer and asks the person who moves money to move it: a changed bank account for a real invoice, an urgent wire for an acquisition, gift cards for a client. No malware, no link, just a plausible email at the right moment. The FBI recorded $3.05 billion in losses to it in 2025, second only to investment fraud.
What stops it: a rule that no bank detail changes or unusual payments happen on the strength of an email alone, verified by a phone call to a number already on file. It is the cheapest control on this page and the one most often missing.
7. Malware and Infostealers
The umbrella term for software written to do harm: trojans that give remote control, spyware that watches, and infostealers, which have become the workhorse of the criminal economy. An infostealer runs briefly on a machine, harvests every saved password, session cookie and wallet it can find, and sends the lot to the attacker, who sells it in bulk. Many "stolen credential" breaches start here.
What stops it: endpoint detection and response on every device, which watches for behavior rather than known signatures, and not installing cracked software, browser extensions of unknown origin, or "updates" delivered by a website.
8. Insider Threats
Someone with legitimate access who misuses it, or makes a mistake with it. The malicious version is rare and severe; the accidental version is common and mostly cheap. Both are hard to detect because the access is real.
What stops it: least privilege, so no single person can reach everything; logging of who accessed what; and removing access the day someone leaves.
9. DDoS and Denial of Service Attacks
Flooding a website or service with traffic until it cannot serve real users, usually from a botnet of thousands of compromised devices. It steals nothing; it costs availability, and for a company that sells online, availability is revenue. It is also used as a distraction or an extortion lever.
What stops it: a content delivery network or DDoS protection service in front of anything public, which absorbs the flood before it reaches you.
10. Man-in-the-Middle Attacks
An attacker positions themselves between you and the service you are talking to, reading or altering the traffic. Classic examples are a fake public wifi hotspot or a compromised router. Encryption has made the raw version far less common, which is why the modern variant targets the login flow instead: a proxy site that sits between you and the real login page, forwards your password and your MFA code in real time, and keeps the session.
What stops it: the padlock, meaning HTTPS everywhere; and for the proxy variant, phishing-resistant MFA such as passkeys, which are bound to the real site's address and simply do not work on the fake one.
11. Web Application Attacks
Attacks on the software behind a website: SQL injection, where malicious input tricks the database into returning or altering data; cross-site scripting, where an attacker's script runs in other users' browsers; and broken access controls, where one customer can see another's records by changing a number in a URL.
What stops it: secure development practices, testing before release, a web application firewall, and periodic penetration testing by someone paid to break it.
12. AI-Enabled Cyber Attacks
Not a new door, but a faster hand on the old ones. The 2026 DBIR found AI accelerating exploitation of published flaws from months to hours and social engineering on mobile succeeding 40 percent more often, with AI-generated lures a stated factor. IBM's study found one in four malicious breaches were AI-enabled, a 56 percent increase, and that those breaches cost about $6 million each, roughly a million more than average. Deepfaked voices and video calls have moved business email compromise from email to the phone.
What Are the Current Cyber Security Threats?
Three shifts from the 2026 data are worth carrying around:
- Patching is now the first job, not the third. When the top entry point is a known flaw, the response is to install the fix, starting with anything reachable from the internet.
- The supplier is you. Half of breaches involve a third party. Every hosted platform your company signs into is part of your attack surface, and the accounts that administer them need the same protection as your own.
- Shadow AI is a data leak waiting to happen. The DBIR found frequent employee use of unapproved AI tools tripled from 15 to 45 percent in a year. Pasting customer data into a chatbot is exfiltration with good intentions.
How to Protect Your Business From Cyber Threats
An individual defends against threats two, three and seven, and the program is the six habits that page describes. A business has to cover all twelve, which is impossible all at once, so the order is the order of the list.
Key takeaways
- Four doors account for most breaches: exploited flaws (31 percent, now first), stolen passwords, social engineering, and compromised suppliers (involved in 48 percent).
- Ransomware and data extortion are what happens after entry. Increasingly the encryption is skipped and the data is simply published.
- Business email compromise cost $3.05 billion in 2025 and is stopped by a phone call to a number already on file.
- AI is not a new threat; it is a faster version of the old ones. Exploit windows have shrunk from months to hours.
- Small organizations are the volume target, not an exception.
- The priority order for a business is MFA, patching, endpoint detection with someone watching it, offline backups, a payment verification rule, and supplier access.
Common questions
What are the top 5 cyber security threats?
By how often they cause breaches: exploited software vulnerabilities, stolen or guessed passwords, phishing and social engineering, compromised suppliers, and ransomware or data extortion. The first four are ways in; the fifth is what attackers do once inside.
What are the 7 types of cyber security threats?
Common lists name malware, phishing, ransomware, denial of service, man-in-the-middle, insider threats and web application attacks. That grouping is fine as a vocabulary but says nothing about proportion, which is why this page ranks twelve by likelihood instead.
What are the current cyber security threats?
Faster exploitation of published flaws, now the top entry point; extortion campaigns that publish stolen data rather than encrypting it; social engineering on mobile, up 40 percent; supplier compromises reaching many victims at once; and AI-generated lures and deepfaked voices in fraud.
What is the most common cyber attack?
Phishing, by the number of reports to the FBI in 2025. By what causes confirmed breaches at organizations, exploiting software vulnerabilities, at 31 percent in the 2026 Verizon report.
What is the difference between a threat and a risk?
A threat is something that could cause harm. A risk is how likely that is combined with how bad it would be. Two organizations face the same threats and very different risks, depending on what they have exposed and what they would lose.
What is a zero-day?
A software flaw that attackers are using before the vendor has a fix. The name refers to the vendor having had zero days to patch it. They are rarer than unpatched known flaws, which are the far bigger problem.
What is an advanced persistent threat?
A well-resourced group, usually state-sponsored, that gets into a network and stays quietly for months to gather information. Most organizations will never meet one; the ones that supply governments, infrastructure or defense contractors should assume they will.
Is ransomware still a threat?
Yes, and growing. IBM found it in 39 percent of the breaches it studied in 2026, up from 34 percent. The shape has shifted toward stealing data and threatening to publish it, with or without encryption.
How do I protect a small business from cyber threats?
Multi-factor authentication everywhere, prompt patching of anything internet-facing, endpoint detection with someone watching the alerts, a backup attackers cannot reach, a rule that payment changes are verified by phone, and a list of what your suppliers can access. Most small businesses hire the monitoring rather than build it.
What is social engineering?
Manipulating a person into doing something that helps the attacker: giving up a password, approving a login, installing software, moving money. Phishing is the email version; vishing is the phone version; business email compromise is the version aimed at payments.
What is a supply chain attack?
A breach that reaches you through a supplier: software you install, a platform you use, or a contractor with access. It is involved in about half of breaches now, because breaching one supplier reaches all of its customers at once.
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.