According to the leading global tech research firm Gartner, the most common types of cybersecurity attacks include:

• Phishing and social-engineering-based attacks.
  Attackers trick legitimate users with proper access credentials into taking action that opens the door for unauthorised users, allowing them to transfer information and data out (data exfiltration).
• Internet-facing service risks (including cloud services).
  These threats relate to the failure of enterprises, partners and vendors to adequately secure cloud services or other internet-facing services (for example, configuration management failure) from known threats.
• Password-related account compromises.
  Unauthorised users deploy software or other hacking techniques to identify common and reused passwords they can exploit to gain access to confidential systems, data or assets.
• Misuse of information.
  Authorised users inadvertently or deliberately disseminate or otherwise misuse information or data to which they have legitimate access.
• Network-related and man-in-the-middle attacks.
  Attackers may be able to eavesdrop on unsecured network traffic or redirect or interrupt traffic as a result of failure to encrypt messages within and outside an organisation’s firewall.
• Supply chain attacks.
  Partners, vendors or other third-party assets or systems (or code) become compromised, creating a vector to attack or exfiltrate information from enterprise systems.
• Denial-of-service attacks (DoS).
  Attackers overwhelm enterprise systems and cause a temporary shutdown or slowdown. Distributed DoS (DDoS) attacks also flood systems, but by using a network of devices. (Also see “What is a DDos attack?”)
• Ransomware.
  This malicious software infects an organisation’s systems and restricts access to encrypted data or systems until a ransom is paid to the perpetrator. Some attackers threaten to release data if the ransom isn’t paid.