Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is Delivery in Cybersecurity?
Delivery in cyber security is the stage in an attack where an adversary sends a malicious payload, link, file, script, or instruction to a target environment. In the cyber kill chain, delivery comes after weaponization and before exploitation. It is the point where the attacker’s prepared capability first reaches the user, device, application, or network.
Delivery does not mean the attack has succeeded. It means the threat has arrived at a place where it may be opened, executed, trusted, or processed.
How Delivery Works in an Attack
Attackers choose delivery methods based on the target’s behavior, defenses, and exposed systems. A phishing email may carry a malicious attachment. A compromised website may serve drive-by content. A software supply chain attack may deliver malicious code through an update, package, or dependency.
In threat intelligence and adversary modeling, delivery helps analysts understand how an attacker gains initial access opportunities. For defenders, it is a key stage because blocking delivery can stop the attack before exploitation begins.
Common Delivery Methods
| Delivery method | What it involves |
|---|---|
| Phishing | Emails, messages, or links designed to trick users into opening malicious content. |
| Malicious attachments | Documents, archives, or installers that contain harmful code or macros. |
| Web delivery | Compromised websites, fake login pages, or downloads hosted on attacker-controlled sites. |
| Supply chain delivery | Malicious components introduced through trusted software, updates, or third-party tools. |
Why Delivery Matters for Threat Hunting
Delivery creates early signals that hunters can investigate before an incident spreads. These signals may include suspicious email patterns, unusual attachment types, newly registered domains, unexpected script downloads, or blocked endpoint events.
Threat hunters often map delivery techniques to frameworks such as MITRE ATT&CK to understand adversary behavior. This helps them ask sharper questions: How did the payload enter? Which users or systems were exposed? Was the delivery attempt part of a broader campaign?
How Organizations Can Reduce Delivery Risk
Organizations reduce delivery risk by combining user awareness, email security, endpoint protection, browser controls, and application hardening. Device management also matters because unmanaged or poorly configured endpoints are easier places for malicious content to land.
Solutions such as Hexnode can support this defensive layer by helping teams enforce device policies, manage app access, restrict risky configurations, and maintain visibility across endpoints. That makes delivery-stage defense more consistent across distributed work environments.
FAQs
No. Delivery is when malicious content reaches the target. Exploitation happens only if the target processes that content in a way that lets the attacker run code, steal data, or gain access.
A delivery attempt may fail if security tools block it, a user ignores it, or the payload cannot run on the target system. Still, failed attempts are useful indicators for threat intelligence.
