Attack orchestration is the coordination layer that decides which attack step happens next, where it is sent, and how results from one step feed the next. Instead of treating scanning, exploitation, credential testing, and follow-on actions as isolated tasks, orchestration links them into a single workflow across many targets.
In cyber security, this matters because automation can turn a familiar attack chain into a scalable campaign. Orchestration software can route probes to exposed services, retry failures, prioritize promising targets, and switch tactics when a defense blocks one path. Defenders see this as bursty requests, repeated probing, and coordinated activity across domains, accounts, or APIs. The same concept also appears in defense tooling, where orchestration helps security teams sequence alerts, containment, and logging. When attackers use it, the key risk is speed: even simple vulnerabilities can be abused faster and at larger scale.