An attack vector is an exploitable asset in the attack surface. An attack vector can be used by a threat actor for initial compromise.