What is a cyber attack? Types, stages and how to prevent one

A cyber attack is a deliberate attempt to break into computer systems, networks or data, usually to steal something, to disrupt something or to extort money. That covers a lot of ground: a fraudulent email that tricks an employee into transferring money is a cyber attack, and so is malicious software that locks up an entire hospital. What they share is intent. Something breaking by accident is an outage; someone breaking it on purpose is an attack.

Below we look at who carries out these attacks and what they are after, the types you are most likely to encounter, how an attack typically unfolds, what to do when you are in the middle of one, and why the most effective prevention has less to do with technology than most people expect.

Who attacks, and why

The image of the lone hacker in a hoodie is decades out of date. The overwhelming majority of attacks come from organized criminal groups that operate like businesses, with support desks, subscription models and affiliates who rent out their tools. Their motive is money, and their targets are chosen the way any business chooses customers: by how easy the sale is.

That is why the assumption “we are too small to be interesting” is such a costly one. Small and mid-sized organizations are attractive precisely because they hold valuable data and payment flows while rarely employing a dedicated security team. Attacks on them are usually not personal; they are automated, running through lists of addresses and known weaknesses until something answers. We looked at that dynamic in more detail in our piece on why SMEs are so vulnerable to cyber attacks.

Alongside the criminal majority there are other motives: competitors or state actors after intellectual property, activists after attention, and the occasional insider acting out of frustration. Different motives, but largely the same techniques, which is convenient: defending against the common case covers most of the rest.

The most common types of cyber attacks

New attack names appear constantly, but nearly all of them are variations on a handful of mechanisms. Knowing the mechanism is more useful than memorizing the vocabulary.

• Phishing and its variants. A message that impersonates someone you trust to get credentials, a payment or a click. It remains the most common entry point by a wide margin. How it works, and how the sms and voice variants differ, is covered in our guide to phishing.
• Ransomware. Malicious software that encrypts your files and demands payment for the key, increasingly combined with the threat of publishing the data. Our article on ransomware goes through how an infection spreads.
• Malware more broadly. Keyloggers, banking trojans, spyware and cryptominers all install themselves quietly and do their work in the background. See our overview of malware.
• Social engineering without any malware at all. A convincing phone call, a fake supplier changing bank details, an urgent request from a director. There is no file to scan, which is what makes social engineering so hard to filter.
• Credential attacks. Reusing passwords leaked elsewhere, or guessing weak ones at scale. Cheap for the attacker, and the reason MFA matters so much.
• Exploiting unpatched software. Known weaknesses in systems that have not been updated. Automated scanners find these within hours of a vulnerability becoming public.
• Denial of service. Flooding a service with traffic so it becomes unreachable. Rarely about theft, often about disruption or extortion.
• Supply chain attacks. Compromising a supplier, a software update or a service provider to reach everyone who uses it. Your own security is only part of the picture here.

Notice how many of these begin with a person rather than a machine. Phishing, social engineering and credential reuse all need someone to act, which is exactly where an organization has the most room to improve.

How a cyber attack unfolds

Attacks are rarely the single dramatic moment they look like in the news. In practice they run through recognizable phases, and the gap between the first foothold and the visible damage is often weeks. That gap is also the opportunity: an attack noticed in week one is an incident, an attack noticed in week six is a crisis.

Roughly, the sequence runs from reconnaissance, where the attacker gathers names, addresses and supplier relationships from public sources, to gaining access through a click or a stolen password, to quietly expanding that access, to the final act of encryption, theft or fraud. Each phase leaves traces, and each phase offers a chance to intervene. We break the sequence down step by step in our article on the stages of a cyber attack.

What to do during and after an attack

The first hour matters more than the technology you bought last year. What people need is not a thick binder but a handful of steps they can actually recall under pressure.

1. Report immediately, before you try to fix it. Speed of reporting decides how much room the attacker gets. Nobody should hesitate because they are not certain yet.
2. Isolate rather than shut down. Disconnecting an affected machine from the network limits the spread; pulling the power can destroy evidence you will need later.
3. Assume credentials are compromised. Reset passwords and sessions for the accounts involved, and check for newly added devices, mail forwarding rules and changed recovery addresses.
4. Preserve the evidence. Logs, the original message, screenshots. Insurers and investigators will ask, and so will the regulator if personal data was involved.
5. Check your reporting obligations. A data breach involving personal data carries notification duties, and organizations in scope of NIS2 have their own incident reporting timelines. Involve whoever owns that responsibility on day one, not day five.
6. Do the review afterwards, without hunting for a culprit. The useful question is which signal was missed and why, not who clicked. Blame guarantees the next incident stays hidden longer.

Why prevention starts with people

Technical measures do the heavy lifting on volume. Multi-factor authentication, timely updates, tested backups kept offline, and limiting who can access what will filter out the majority of automated attempts. None of that is optional, and none of it is where attacks actually succeed anymore.

What gets through the filters is aimed at people, because people can be persuaded and software cannot. An employee who recognizes an odd payment request, checks it through a second channel and reports it has stopped an attack that no scanner would have flagged. That is a skill, and like any skill it fades without practice, which is why a single annual training session produces so little. Short, recurring exercises that follow the current threat landscape work considerably better, and a phishing simulation shows you where you actually stand rather than where you assume you stand.

How Guardey helps you reduce the risk

Guardey’s security awareness training is built for that rhythm: weekly challenges of about three minutes, gamification with leaderboards and streaks, and content that follows the threats actually circulating. Employees train in the mobile app for iOS and Android or in the browser, which means colleagues without a desk are included too.

Integrated phishing simulations show whether recognition turns into behavior, and audit-ready reporting turns the whole programme into evidence for frameworks such as NIS2 and ISO 27001. Setup takes minutes, and more than 500 organizations work this way, including the European Parliament.

Frequently asked questions about cyber attacks

What is the difference between a cyber attack and a data breach?

An attack is the attempt; a data breach is one possible outcome. An attack that is blocked never becomes a breach, and a breach can also happen without any attack at all, for instance when someone emails a file to the wrong recipient. The distinction matters because reporting obligations attach to the breach, not to the attempt.

How long does it take to notice an attack?

Longer than most organizations expect. Attackers who get in through a stolen password often move carefully to avoid triggering alarms, and the visible damage comes at the end rather than the beginning. That is why reports from employees are so valuable: they frequently surface something odd well before the monitoring does.

Is a small organization really a target?

Yes, and usually not by choice. Most attempts are automated and target whatever answers, so being small offers no protection, while having fewer specialists often means a longer response time. Being uninteresting is not a defense against a script.

Does insurance cover a cyber attack?

Cyber policies exist and can cover recovery costs, but insurers increasingly require you to demonstrate basic measures, including staff training, and they will ask for evidence after an incident. Treat a policy as a backstop for the financial damage, not as a substitute for the measures themselves.

The uncomfortable truth about cyber attacks is that most of them are not sophisticated. They rely on a password reused across sites, a system that was never patched, or a colleague in a hurry on a Friday afternoon. That is also the encouraging part: the same handful of habits blocks the large majority of them, and every one of those habits is something a team can learn.