Discovery

Once attackers have initial access, begin execution, and avoid detection through defense evasion, their next step is to learn the environment they’ve entered.

This phase is called discovery.

Discovery is when attackers explore a network to understand:

what systems exist
where sensitive data lives
which accounts have high privileges
what tools defenders use
and which paths will let them move deeper

Think of it like a burglar quietly walking through a building:

checking room numbers
reading office nameplates
testing which doors are locked
noting where the cameras are
and mapping the fastest route to the vault

They’re gathering intel before making their next move.

Digitally, attackers perform discovery by:

scanning the network
identifying servers and shared drives
enumerating user accounts
checking for EDR or other security tools
probing for misconfigurations
locating high‑value assets like databases or backups

Why this matters for insurance:
Discovery is the moment when a small intrusion becomes a strategic operation.
It’s how attackers figure out:

where to deploy ransomware
which accounts to target for credential access
where sensitive data is stored for exfiltration
and how to move laterally without being noticed

If a company lacks internal visibility — especially through SIEM, EDR, or a well‑run SOC — discovery often goes completely unnoticed.

When a company says, “The attacker didn’t get very far,” the real question is:

“How much did the attacker learn about your environment before you detected them?”

The takeaway:
Discovery is reconnaissance inside the network.
The more an attacker learns, the more damaging the incident can become.

Pop Culture Parallel:
In Ocean’s Eleven, the crew spends as much time studying the casino’s layout, cameras, and security routines as they do executing the heist. Discovery works the same way in cyber attacks.

Real‑World Example:
During the 2017 NotPetya attack, malware rapidly scanned internal networks to identify systems it could spread to — a textbook example of automated discovery enabling massive lateral movement.

Vocabulary Reinforcement (from earlier posts)

Initial Access — introduced in Cyber Term #18
Execution — introduced in Cyber Term #19
Defense Evasion — introduced in Cyber Term #20
EDR — introduced in Cyber Term #4
SIEM — introduced in Cyber Term #2
SOC — introduced in Cyber Term #3
Credential Access — introduced in Cyber Term #21
Data Exfiltration — introduced in Cyber Term #16
Lateral Movement — introduced in Cyber Term #12

Previous Episode:
17. Credential Access ←

Next Episode:
19. Collection →

Browse the Series:
View all Cyber in Plain English episodes →

Cyber Orientation Hub:
Explore the full Cyber Orientation hub →

Learn more at https://insurancedesignationlookup.com/cyber-orientation/
#CyberForInsurance #CyberInPlainEnglish #LettersForSuccess