What occurs in the reconnaissance stage of the cyber attack lifecycle?

Reconnaissance is the information-gathering stage of the cyber attack lifecycle. During this phase, attackers attempt to understand the target environment before selecting a delivery path or exploit. A host sweep is a reconnaissance activity because it identifies live systems within an address range. This helps an attacker map reachable hosts, discover exposed services, and prioritize later scanning or exploitation. File exfiltration occurs much later, during actions on objectives, after access has been obtained. SQL injection is an exploitation technique against an application or database-backed service. A phishing campaign is normally associated with delivery, where the attacker attempts to place a malicious link, attachment, or credential-harvesting page in front of a user. Reconnaissance is the attacker’s “survey the terrain” phase: it does not yet require compromise, but it materially improves the attacker’s chance of success. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, common attack types.