Public advisories on advanced intrusions list ordinary entry points: unpatched edge devices, weak or exposed administrative credentials, password spraying, stolen valid accounts and trusted software updates. Closing these first is a better use of a small team than chasing exotic exploits.
The doors named in two CISA documents
Unpatched edge devices. The Volt Typhoon advisory says the actor gets in mainly through known or zero-day flaws in routers, VPNs and firewalls, and gives a case with a known CVE on an unpatched device.
Credentials on appliances. The same advisory describes credentials stored insecurely on edge devices and advises against it.
Valid accounts. It says the actor primarily relies on valid credentials for persistence.
Password guessing and spraying. The SolarWinds alert lists password guessing and spraying among initial access methods.
Weak administrative credentials on remote access. The same alert mentions poorly secured administrative credentials on external remote access services.
Forged tokens. It also mentions abuse of SAML tokens forged with a stolen signing certificate.
Software supply chain. It describes a malicious version of a signed file inserted into a software vendor's product lifecycle.
Rank them for your company
Score each door from 0 to 3 on exposure and on your control strength. Then work on doors with high exposure and low control.
- Edge devices. Exposure: do we have internet-facing appliances? Control: patched within target time?
- Stored credentials. Exposure: do devices hold secrets? Control: checked and rotated?
- Spraying. Exposure: is login exposed to the internet? Control: MFA everywhere, lockout and alerting?
- Admin on remote access. Exposure: do external services have admin logins? Control: strong secrets and phishing-resistant MFA?
- Valid accounts. Exposure: do old accounts exist? Control: offboarding and regular reviews?
- Vendor software. Exposure: do we run vendor agents with wide privilege? Control: network limits and monitoring?
Cheap moves with big effect
- Turn on MFA for every internet-facing login, with phishing-resistant methods for administrators.
- Remove standing admin rights where you can.
- Alert on repeated failed logins across many accounts.
- Put privileged vendor software on a restricted network segment.
The vendor software door
The SolarWinds alert notes that the affected product typically ran with broad privileges, which made it valuable to the actor. If you run similar tools, limit what they can reach and watch their outbound connections.
What zero-days mean for planning
Zero-days exist and advisories mention them. You cannot patch what is unknown, so layered controls matter: segmentation, least privilege and logging make a surprise exploit less useful.
Quick check
Should we stop worrying about zero-days?
No, but plan for them with layers, and fix the doors you already know are open.
What is password spraying?
Trying a few common passwords against many accounts, to avoid lockouts that come with many guesses on one account.
Sources
Last reviewed: 19 October 2026.
