Exploiting software vulnerabilities (buffer overflows, SQL injection, remote code execution) - Credential attacks (password spraying, brute forcing, credential stuffing with leaked passwords) - Social engineering (phishing, pretexting, physical intrusion — if in scope) - Misconfigurations (default c