Preattack

Preattack is a term used in cybersecurity to describe the preparatory phase of an adversary’s operation, occurring before the first breach of a target network or system. It covers planning, information gathering, target selection, and the development of capabilities or infrastructure that enable later exploitation. The concept is often discussed in threat intelligence, risk assessment, and security operations as a way to understand how attackers prepare to attack. Some writers use “pre-attack” interchangeably with early-stage activities that precede infiltration.

Typical preattack activities include open-source intelligence collection about a target’s people, technologies, and networks; reconnaissance of defenses; social engineering planning; procurement or development of tools, malware, and infrastructure (for example domain registrations, hosting, and exploit kits); and testing payloads in isolated environments. Preattack events are frequently predecessors to initial access and exploitation, though some sources describe overlap with early attack steps.

Framework references: MITRE Pre-ATT&CK documents pre-attack behaviors to help defenders model and mitigate threats before infiltration. This framework complements the ATT&CK knowledge base by focusing on actions and capability development that occur before a breach, rather than on actions taken within a compromised environment.

Defensive implications: identifying preattack indicators—such as unusual procurement patterns, new domain registrations linked to an organization, or targeted OSINT findings—enables proactive defense, threat hunting, and stronger supply-chain and employee training controls. While the term is mostly used in security contexts, its exact scope can vary between organizations and literature.