Most intrusions still begin at the edge of the network. Attackers rarely need malware to get through the door. Unit 42, the threat intelligence team at Palo Alto Networks, ranked the initial access vectors it watched in September 2026. Exploitation of public-facing applications came first, with valid credential abuse second and phishing third.
- Exploitation of public-facing applications is the top entry point, as attackers compromise exposed web apps, databases, and perimeter services.
- Valid credentials and credential abuse, where attackers use stolen or sprayed logins chained to edge-service flaws.
- Phishing and targeted social engineering, aimed mostly at public sector, defense, and regional enterprise targets.
- Supply chain compromise, ranked lower but high in impact, spreading through trusted technology relationships.
- Drive-by compromise and watering-hole attacks, which hit a visitor who only loads a booby-trapped page.
Edge Flaws and Valid Logins Work as One Intrusion
The ranking reads like five separate initial access vectors, but the top two work as one. Unit 42 says attackers chain stolen or sprayed logins to edge-service flaws. That combination slips past perimeter defenses and blends in with real user activity. An attacker breaks into an exposed appliance, then logs in with valid credentials that look like any other employee’s. In our reading, that pairing is the real story: once a session rides a real account, malware-hunting tools have nothing left to flag. A firm that only hunts for strange processes and bad files can still miss a normal-looking login arriving from an edge box it just patched. Rankings like this shift where defenders look, as our coverage of Forrester’s 2026 threat list has tracked.
Supply chain compromise and drive-by attacks ranked lower in September, but Unit 42 still flags both for cascading impact across connected technology ecosystems. The edge-and-credential pattern is already familiar from the field: we recently covered a PeopleSoft zero-day wave that turned one exposed application into a wide intrusion.
Harden the Edge and the Login Before the Malware Hunt
The ranking shows where a limited budget does the most good, in the order attackers actually move.
Patch internet-facing systems first – Exploitation of public-facing applications led Unit 42’s September ranking. An accurate external asset inventory and fast edge patching close the most-used door.
Watch valid-credential use coming off the perimeter – Attackers chain stolen logins to edge exploits to blend in. Traffic from edge services and remote-access gateways needs anomaly detection and phishing-resistant multi-factor authentication (MFA).
Extend the same checks to vendors and browsers – Supply chain compromise and drive-by attacks ranked lower but hit hardest. Treat vendor connections and web traffic as part of the same initial access problem.
The network edge and the ordinary login were the two initial access vectors attackers used most in September, and closing both together removes the opening they kept walking through most that month.
Join our LinkedIn group Information Security Community!
