| Attack | What it does | Planning use |
|---|---|---|
| Phishing | Fake emails, SMS or messages pretend to come from trusted companies and rely on a person acting on them. | Start with people: train staff, check sender addresses, hover over links before clicking, and add multi-factor authentication. |
| Ransomware | Malware that encrypts files or locks the computer system and demands payment. | Maintain malware protection, patch known vulnerabilities and have an incident plan ready before it is needed. |
| DDoS | Thousands of infected devices in a botnet overload a service with traffic. | Matters most where you run public-facing services; prepare for disruption and keep monitoring for unusual activity. |
| Password attacks | Automated tools guess passwords. | Set a password policy and make sure it is followed, then add a second verification step. |
Attack descriptions follow GeeksforGeeks, and the control recommendations follow the NCSC white paper on common cyber attacks.
What are the most common types of cyber security attacks? Phishing, ransomware, DDoS and password attacks make up the practical core, and the NCSC says basic security controls can protect organisations from the most common attacks.
If you are weighing the legal side of protecting personal data, our guide to data privacy laws explained covers the wider rules around the technical threats described here.
What these attacks put at risk
Each attack type threatens something different, so the sensible way to rank them is by the consequence you can least afford. The list below sets out the consequence first and the decision it points to.
- Phishing puts a person’s decision at risk. The message pretends to be a trusted company, so the damage depends on what the recipient is persuaded to open, enter or approve. The decision it points to is training and simple checking habits, which cost far less than recovering from a successful lure.
- Ransomware puts the use of your own systems at risk. Encrypted files or a locked computer mean work stops, and a payment demand follows. This suits any organisation that depends on its files day to day, and it points to protection and incident planning rather than hope.
- DDoS puts availability at risk. The service is disrupted rather than the data being read. If you run no public-facing service, this is a lower priority than the other threats; if customers reach you online, it moves up.
- Password attacks put account access at risk. Automated guessing turns a weak or unprotected password into a way in. This is the cheapest risk to reduce, because a password policy and a second verification step apply to every account at once.
A reasonable triage order for most organisations and households is therefore phishing and passwords first, ransomware readiness second, and DDoS planning third unless an online service is central to what you do. That order is a judgement about cost and consequence, not a published ranking of how often each attack occurs. The mechanisms behind each one explain why the defences differ.
How the common attacks work
Phishing and message lures
Phishing works by impersonation. Attackers send fake emails, SMS or other messages pretending to be trusted companies, and the attack succeeds only if the recipient acts on the message. Because the entry point is a person rather than a software flaw, no patch removes it.
That is why the NCSC lists user training, education and awareness among its additional controls: staff should understand their role in keeping the organisation secure and report unusual activity. The same point holds at home. Reporting a suspicious message is a useful habit even when nothing was clicked.
Ransomware and malware
Ransomware is a type of malware that encrypts a victim’s files or locks their computer system, then demands payment, as GeeksforGeeks describes it. The practical consequence is that the attacker controls access to your own data, so the cost is measured in downtime as much as in the payment itself.
Defence begins with the NCSC’s malware protection control: establish and maintain malware defences to detect and respond to known attack code. The word “known” matters. Protection of this kind catches familiar code, which is why it works best alongside patching and a plan for the incidents that get through.
DDoS and service disruption
A distributed denial-of-service attack overloads a service rather than breaking into it. Attackers use infected devices, called a botnet, to send traffic at a target. The volumetric form, which Clarusway describes as overwhelming network bandwidth with massive traffic volumes, is the most common DDoS technique.
The disruption is not always the whole story. University of San Diego material notes that these attacks can serve as a smokescreen for more invasive attacks. Teams that see an outage should therefore keep watching for other unusual activity at the same time, rather than treating the traffic flood as the only incident.
Password guessing
Password attacks use automated tools to guess passwords. The tools do the repetitive work, so a weak password can fail quickly. The defensive question is therefore less about how clever an attacker is and more about whether every account is protected by something stronger than one guessable secret.
Defence priorities in practical order
Baseline controls that cover several attacks
The NCSC white paper, published in October 2016, explains how basic security controls can protect organisations from the most common cyber attacks. Its Cyber Essentials controls map directly onto the threats above:
- Malware protection. Maintain defences that detect and respond to known attack code. This is the main line against ransomware delivered as ordinary malware.
- Patch management. Patch known vulnerabilities with the latest version of the software. Where your tools allow it, enabling automatic updates keeps protection current without manual effort, a practical point made by GeeksforGeeks.
- Password policy. Ensure an appropriate policy is in place and actually followed. A policy nobody follows protects nothing.
Controls aimed at phishing and stolen passwords
Multi-factor authentication adds a layer of security by requiring a second verification step in addition to the password. It suits every account that matters, because it means a guessed or tricked-out password alone is no longer enough. For messages, two quick checks help before anyone acts: hover over links to see the real URL, and verify the sender’s email address.
Planning for the day something gets through
From the NCSC’s additional controls in its 10 Steps to Cyber Security, two matter most for ransomware and DDoS. Security incident management means putting plans in place to deal with an attack, which reduces its impact on the business. Security monitoring identifies unexpected or suspicious activity, and the NCSC points it at organisations likely to face a more technically capable attacker. A household or a very small team can reasonably treat monitoring as optional; an organisation running public services or holding sensitive records should not.
Where to read next
Automated tools also shape how personal data is collected and misused, and AI And Privacy Concerns: What You Need To Know In 2026 – Technopolicy looks at that side. For the US legal framework around these threats and the duties on organisations, see US Cybersecurity Laws: A Practical Guide For Businesses And Individuals (2026 Update) – Technopolicy.
Frequently asked questions
Do smaller organisations need to worry about these attacks?
Yes. The NCSC states that every organisation is a potential victim, and the basic controls in its white paper are aimed at common attacks rather than only at large targets.
Where do basic controls stop being enough?
The NCSC paper does not provide a comprehensive review of sophisticated or persistent attacks. Organisations likely to face a more technically capable attacker should add security monitoring and look beyond the baseline.
Is ransomware different from other malware?
Ransomware is a type of malware. What sets it apart is the demand: it encrypts files or locks the system so the victim is pressed to pay.
