An attack workflow is the sequence of activities an intruder uses to pursue an objective. It may include reconnaissance, probing for weaknesses, gaining access, escalating privileges, exploring systems, and taking follow-on actions such as viewing or copying data. The steps can overlap or change as the attacker responds to defenses and new information.
Understanding the workflow helps defenders investigate incidents and interrupt attacks at multiple points. For example, unusual probing may be detected before access is gained, while monitoring account activity and application logs can reveal suspicious searches or exports after access. AI-assisted tools may speed up parts of this process, such as reconnaissance or scripting, but their use alone does not establish how access occurred or whether data was taken. Reconstructing events from reliable logs helps distinguish attempted actions from confirmed impact.