Day 1: Credential Compromise
The Attack Begins
A phishing email slips through. An employee clicks a link. Within minutes, attackers have valid credentials to your network.
Attacker
Your Network
[2026-01-11T10:41:23.616Z] ALERT: Unauthorized access detected from 185.220.101.xxx
Here's what's happening: The attacker now has the same access as your IT admin. They can see everything—including where your backups are stored.