V01 · Social engineering and trusted-person impersonation
The attacker exploits a trusted role, urgency or a routine business process to obtain information or a decision. Public business context can make the approach plausible.
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026
Reusable attack-vector library
Define a technique once. Each scenario references its version and supplies its own target, permission, resource and measurement parameters.
Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.
V02 · Phishing, smishing and deceptive messages
A deceptive email or SMS leads the recipient toward a harmful action or a false trust decision. This is a delivery technique that can be combined with V01.
V03 · Man-in-the-middle and traffic trust
An adversary interposes on a communication path or abuses a trust mistake to observe or alter traffic. Not every packet observation is a successful MITM.
V04 · Evil portal and misleading wireless onboarding
A false access point or captive portal imitates trusted onboarding. It can be combined with social engineering but requires its own radio/network permission.
V05 · Malicious files, removable media and device content
A file, attachment or peripheral is used to exploit software or induce execution; a lost unencrypted device can also expose data without a software exploit.
V06 · Exposed services and application-input abuse
An attacker reaches a service and abuses a flaw in input handling or application logic to access data or functions outside the intended boundary.
V07 · Credential, session, recovery and privilege abuse
An adversary uses a stolen, weak or wrongly privileged identity/session, or a defective recovery process, to cross an access boundary.
V08 · Supplier access and remote-administration abuse
A trusted supplier account or remote-management path gives an adversary an entry point or wider reach. Legitimate administration software can be misused.
V09 · Lateral movement, data theft and ransomware impact
After an initial foothold, an adversary seeks more systems or privileges, copies valuable data or disrupts operation. This guide concerns validation of containment and impact, not deployment of destructive malware.
V10 · Prompt injection and AI trust-boundary abuse
Untrusted content attempts to become an instruction or an authority for a model-connected action. The policy must be enforced outside the model.