Initial access is the first step in which an attacker gets into a target network. In MITRE ATT&CK it is a tactic, which means a goal at one stage of an attack. It covers the different ways an attacker can establish a first foothold.
- Also Called3other namesInitial compromise · Initial foothold · TA0001
- Related Terms3linked entriesPhishing · Persistence · Initial access broker
What Is Initial Access?
Initial access is how an attacker first gets in. MITRE ATT&CK lists Initial Access as tactic TA0001 and describes it as the adversary trying to get into your network. A tactic is a goal. A technique is one specific way to reach that goal.
MITRE says the tactic covers techniques that use various entry vectors to establish a foothold in a network. Two examples it gives are targeted spearphishing and exploiting weaknesses on public-facing web servers.
How Does Initial Access Work?
MITRE lists several techniques under this tactic. The names below are as MITRE gives them.
- Phishing (T1566)
- Exploit Public-Facing Application (T1190)
- Valid Accounts (T1078)
- External Remote Services (T1133)
- Supply Chain Compromise (T1195)
- Drive-by Compromise (T1189)
Some of these depend on a person acting, such as opening a message. Others depend on a weakness in a system that faces the internet.
For longer lists, see our guides to initial access techniques and how attackers get into companies.
What Happens After the First Foothold?
Initial access is the point where an attack starts to become an incident inside your network. Stopping or spotting an attacker here can mean the later stages never happen. Because the entry routes are so varied, defenders often need to cover people, exposed systems and accounts at the same time.
Which Checks Cover the Common Entry Points?
MITRE’s mitigation for multi-factor authentication says it requires users to give at least two forms of verification before access is granted. The same entry points have other mitigations on MITRE’s technique pages. Each step below comes from one of them.
- Patch what faces the internetUpdate externally exposed applications and scan those systems often for flaws.
- Close what should not be openCheck that each public service is meant to be public. Disable remote services you do not need.
- Put MFA on remote accessUse MFA for VPN and other remote service accounts, and across all account types.
- Authenticate your mailUse SPF and DKIM, enforced by a DMARC policy, and train users to spot phishing.
- Switch off legacy sign-inDisable legacy authentication, which cannot use MFA, and require modern authentication.
Is Initial Access the Same as a Breach?
Not necessarily. Initial access is the stage where an attacker gets a foothold. A breach is the wider result, such as exposure of data. An attacker with a foothold still has later goals, such as staying in, gaining more permissions or moving to other systems.
Is Initial Access the Same as an Initial Access Broker?
No. Initial access is the stage of an attack. An initial access broker is a type of seller who deals in access. The terms are related by name, but one describes a step and the other describes a role.
Related terms on this site include phishing, persistence and initial access broker.
Related Pages in the Knowledge Hub
- Phishing 101
- Valid Accounts
- External Remote Services
- Drive-by Compromise
- How to defend against exploited vulnerabilities
- Email spoofing
Sources
- MITRE ATT&CK: MITRE describes Initial Access (TA0001) as the adversary trying to get into your network, using entry vectors such as targeted spearphishing. It also names exploiting weaknesses on public-facing web servers.
- MITRE ATT&CK: MITRE says multi-factor authentication requires at least two forms of verification before access is granted.
- MITRE ATT&CK: Exploit Public-Facing Application (T1190) mitigations: update software, vulnerability scanning, limit exposed services.
- MITRE ATT&CK: External Remote Services (T1133) mitigations: disable unneeded services, multi-factor authentication.
- MITRE ATT&CK: Valid Accounts (T1078) mitigations: disable legacy authentication, multi-factor authentication.
- MITRE ATT&CK: Phishing (T1566) mitigations: SPF, DKIM and DMARC, user training.
Also Called.
- NameInitial compromise
- NameInitial foothold
- NameTA0001
Questions.
-
What is initial access in cyber security?
Initial access is the first step in which an attacker gets into a target network. In MITRE ATT&CK it is tactic TA0001, described as the adversary trying to get into your network.
-
What are common initial access techniques?
MITRE lists several under this tactic, including Phishing (T1566), Exploit Public-Facing Application (T1190), Valid Accounts (T1078), External Remote Services (T1133), Supply Chain Compromise (T1195) and Drive-by Compromise (T1189).
-
How can you reduce the risk of initial access?
MITRE's technique pages give concrete steps: patch and scan exposed applications, disable remote services you do not need, use multi-factor authentication on remote access, authenticate mail with SPF, DKIM and DMARC, and turn off legacy authentication.
-
Is initial access the same as an initial access broker?
No. Initial access is the stage of an attack. An initial access broker is a type of seller who deals in access. The terms are related by name, but one describes a step and the other describes a role.
In Our Research
- 1 Initial access techniques: all 11 in MITRE ATT&CK October 2026
- 2 ‘Network Access for Sale’ on the Dark Web: The Anatomy of Initial Access Broker Listings June 2026
- 3 Initial Access Methods: How Malicious Actors Do Infiltrate Companies? September 2022
- 4 Storm-3358 and ARTEX: How a Financial-Sector Intrusion Campaign Works November 2026
- 5 Second Attack Wave on European Refrigeration Controllers: What Censys Counted and What Owners Do November 2026
- 6 POEA Data Leak Reported: 27 Backups Named After Agency Systems, Contents Unconfirmed November 2026