Cyber Security Threats: Types, Examples, Defenses
Cyber security threats target systems, networks and data: phishing, ransomware, DDoS, supply chain. Types, an example and layered defenses.
What are cyber security threats?
Cyber security threats are malicious actions or events that target computer systems, networks, applications or data, with the aim of stealing, destroying, disrupting or extorting. A threat is the attacker's action; a vulnerability is the weakness it exploits, such as unpatched software or a reused password. No single tool stops every threat, so defence works in layers: identity, network, endpoint, application and data each need their own controls.
The main categories of threat
| Category | What it does | Example |
|---|---|---|
| Phishing and social engineering | Tricks a person into giving up credentials or running malware | A fake login email that imitates a bank |
| Ransomware | Encrypts data and demands payment, often after stealing a copy | LockBit |
| Malware | Malicious software such as trojans, spyware and worms | Emotet |
| Denial of service | Overwhelms a service so legitimate users cannot reach it | The Mirai botnet |
| Supply chain attack | Compromises a trusted vendor to reach its customers | SolarWinds, MOVEit |
| Insider threat | An employee or contractor misuses legitimate access | A leaver exporting customer data |
| Account takeover | Uses valid stolen credentials | Credential stuffing |
| Web and API attacks | Exploit flaws in applications and exposed endpoints | SQL injection, broken access control |
| Cloud misconfiguration | Exposes data through settings, not exploits | A public storage bucket holding personal data |
| Zero-day exploit | Attacks a flaw before a patch exists | Log4Shell |
How an attack usually unfolds
Most incidents are a chain rather than a single event. An attacker gets in through a phished password or an unpatched server, moves sideways to find valuable systems, steals or encrypts data, and only then announces itself. That is why detection and response matter as much as prevention: extended detection and response (XDR) and a rehearsed incident response plan shorten the time between the first foothold and the first reaction.
Example: a ransomware case
An employee opens an invoice attachment. The malware harvests saved credentials, finds the file server and copies the data out before encrypting it. The ransom note then threatens to publish what was copied. CISA's ransomware guidance lists the defences that matter here: offline, encrypted and tested backups, phishing-resistant multifactor authentication and prompt patching. It also advises contacting law enforcement about possible decryptors rather than treating payment as the only way back.
Defences by layer
| Layer | Controls |
|---|---|
| Identity | MFA, least privilege, identity and access management |
| Network | Firewalls, segmentation, DNS filtering, DoS protection |
| Anti-phishing filters, attachment sandboxing, DMARC | |
| Application and API | Web application firewall, dependency scanning, rate limits, API security |
| Data | Encryption at rest and in transit, backups and tested restores |
| Cloud | Configuration scanning, access audits |
| Detection and response | Logging, alerting, a practised response plan |
Frameworks help you decide what to cover first. The NIST Cybersecurity Framework organises security outcomes, MITRE ATT&CK catalogues attacker techniques, ISO 27001 covers management systems, and the OWASP Top 10 lists the most critical web application risks.
Common mistakes
- Treating security as a one-off project. Threats change, so controls need regular review.
- Confusing compliance with security. Passing an audit shows you met a standard, not that you cannot be breached.
- Backups that were never restored. You find out they are corrupt during the incident.
- Ignoring third-party risk. A vendor breach becomes your breach.
- Phishable MFA only. SMS codes and push prompts are targeted; hardware keys or passkeys resist phishing better.
- No response plan. Nobody knows who calls whom when the alert fires.
Threats, availability and monitoring
LoadFocus is not a security product and does not test for attacks. It helps with the availability side of the picture. API monitoring checks your endpoints from outside and alerts you when they slow down or fail, and free checks run every 5 minutes. The free SSL checker catches certificate problems before visitors see a browser warning. If you want to know how your own site behaves under heavy legitimate traffic, and whether your rate limits answer with 429 as designed, run a load test against a system you own. Read API rate limiting causes and cloud testing security best practices for the practical details.
FAQ: cyber security threats
What is the difference between a threat and a vulnerability?
A vulnerability is a weakness, such as unpatched software or a weak password. A threat is a malicious actor or action that could exploit it. Risk is the combination of the two and the impact if it happens.
Which threats should a small company worry about first?
Phishing and account takeover, ransomware and unpatched internet-facing systems. MFA, tested offline backups and prompt patching address all three.
How do I know if I have been breached?
Often you do not know straight away. Warning signs include logins from unusual places, unexpected data transfers, encrypted files and ransom notes. Logging and alerting are what turn those signs into something you can act on.
Should I pay a ransomware demand?
Payment does not guarantee you get your data back and it funds further attacks. Involve law enforcement and your incident response plan first, and check whether a decryptor exists.
Is a DDoS attack a cyber security threat?
Yes. It targets availability rather than data. See how to stop DDoS attacks for the layered defence.
Related terms
Related LoadFocus Tools
Put this concept into practice with LoadFocus, the same platform that powers everything you just read about.