Day 1: Credential Compromise
The Attack Begins
A phishing email slips through. An employee clicks a link. Within minutes, attackers have valid credentials to your network.
Attacker
Your Network
[2026-04-17T17:56:03.072Z] ALERT: Unauthorized access detected from 185.220.101.xxx
Here's what's happening: The attacker now has the same access as your IT admin. They can see everything—including where your backups are stored.