Skip to main content
Readiness Authority
Category: Cyber Threats & Attacks

Drive-by Compromise

Also known as: Strategic Web Compromise, Watering Hole Attack, T1189
Simply put

Drive-by compromise is a type of cyberattack in which malicious code is delivered to a victim's system simply by visiting a compromised or malicious website, often without the user needing to click or download anything. Attackers typically inject harmful code into a legitimate website so that scripts run automatically when a visitor's browser loads the page. This is a security threat concept, not an insurance coverage term; whether losses arising from such an attack are insurable depends entirely on the specific policy wording.

Formal definition

Drive-by Compromise (MITRE ATT&CK Technique T1189) is an initial-access technique in which an adversary gains access to a system through a user's normal web browsing. In a typical sequence, an adversary injects malicious code (for example, scripts) into a legitimate but compromised website; when a targeted user visits the site, the scripts execute automatically to deliver a payload. When the compromised site is chosen to target a specific population of visitors, the activity is commonly described as a strategic web compromise or watering hole attack. This entry describes an adversary technique for framing threat and control discussions; it is distinct from any insurance coverage trigger, and it does not by itself indicate whether resulting first-party or third-party losses would be covered under a given cyber policy.

Why it matters

Drive-by compromise matters because it undermines a common assumption that users must actively click, download, or open an attachment to be infected. Malicious code can execute automatically when a browser loads a compromised page, meaning that ordinary web browsing by employees can become an initial-access vector. This has direct implications for organizational resilience: it raises the importance of browser patching, script controls, network segmentation, and endpoint monitoring, none of which are insurance measures but rather risk-mitigation controls intended to reduce the likelihood of a successful intrusion.

For insurance and risk-transfer purposes, the technique itself is not a coverage trigger. Whether losses flowing from a drive-by compromise, such as first-party costs (for example business interruption, data restoration, or cyber extortion) or third-party liabilities (for example privacy claims or regulatory defense), would be covered depends entirely on the specific policy wording, applicable endorsements, exclusions, and conditions precedent. Some cyber policies impose conditions relating to the maintenance of security standards or patching; an intrusion that exploits an unpatched browser could, subject to the specific wording and jurisdiction, raise questions under a failure-to-maintain-standards exclusion or similar condition. These are wording-dependent questions, not automatic outcomes.

The distinction is important for risk managers and underwriters evaluating exposure. Because strategic web compromise (watering hole) variants can be aimed at a specific population of visitors, the technique can be used in targeted campaigns against particular sectors or organizations. Recognizing the technique helps in framing control discussions and in assessing the adequacy of an organization's mitigation posture, but it does not by itself resolve how any resulting loss would be treated under a given cyber policy.

Who it's relevant to

CISOs and Security Teams
Because infection can occur through ordinary browsing without a user click or download, security teams treat drive-by compromise as an initial-access vector requiring layered mitigation, browser and endpoint patching, script and content controls, and monitoring for anomalous execution. These are risk-mitigation controls aimed at reducing the likelihood of intrusion; they are distinct from, and not a substitute for, risk transfer through insurance.
Underwriters and Brokers
The technique is relevant when assessing an applicant's control posture and exposure to initial-access risk, but it is not itself a coverage trigger. Underwriters and brokers should focus on how the specific policy wording, endorsements, and exclusions, including any conditions relating to maintenance of security standards or patching, would respond to losses arising from such an intrusion, rather than assuming any particular outcome.
Resilience and Business Continuity Planners
Because a drive-by compromise can serve as the entry point for follow-on activity such as ransomware or data theft, planners should account for it within incident response and recovery planning. Recognizing the technique supports realistic scenario planning and control validation, but insurance recovery of any resulting loss remains a separate, wording-dependent question and does not by itself constitute resilience.
Legal and Compliance Professionals
Where a drive-by compromise leads to unauthorized access to personal or regulated data, it may give rise to notification obligations and potential third-party exposure. Whether and how such consequences are covered, and how they are defined, can vary across regulatory regimes and insurer forms, so the specific policy wording and applicable jurisdiction should be reviewed rather than assumed.

Inside Drive-by Compromise

Compromised or Malicious Website
The delivery vector for a drive-by compromise, in which a user's browser is exposed to malicious code simply by visiting a website that has been compromised or purpose-built by an attacker, often without any deliberate download by the user.
Browser or Plugin Exploitation
The technical mechanism whereby vulnerabilities in a web browser, its extensions, or associated plugins are leveraged to execute code on the visiting endpoint. This is a security concept describing an attack technique, not an insurance coverage trigger.
Initial Access Function
Drive-by compromise typically serves as an initial access method, establishing a foothold from which further activity such as privilege escalation, lateral movement, or payload deployment may follow. It describes how an intrusion begins rather than the full extent of resulting harm.
Potential Loss Consequences
Downstream events that may flow from such an intrusion, which can include data compromise, business interruption, extortion, or third-party liability. Whether any resulting loss is covered depends on the specific policy wording, endorsements, exclusions, and conditions precedent rather than on the technique itself.
MITRE ATT&CK Classification
Drive-by compromise is catalogued as an initial access technique within the MITRE ATT&CK framework. This is a security taxonomy reference and does not constitute a policy term or coverage definition.

Common questions

Answers to the questions practitioners most commonly ask about Drive-by Compromise.

Does a drive-by compromise require the user to click a link or download a file?
No. The defining characteristic of a drive-by compromise is that it can execute without deliberate user action such as clicking a malicious link or knowingly downloading a file. Merely loading a compromised or malicious web page can be sufficient when the browser or a plugin has an exploitable vulnerability. This distinguishes it from phishing techniques that depend on the victim taking a specific action. Note, however, that not all such attacks are fully automatic; some variants still rely on a limited interaction, so treat the mechanism as vulnerability-driven rather than assuming a single behavior applies universally.
Is a drive-by compromise itself an insured loss under a cyber policy?
Not by itself. A drive-by compromise is a security concept describing an initial access technique, not a coverage trigger. Whether the resulting harm is covered depends on the specific policy wording, applicable endorsements, exclusions, and conditions precedent, and on which category of loss follows. First-party consequences such as business interruption or data restoration and third-party consequences such as privacy liability are addressed under different coverage grants. The technique's presence in an attack chain does not determine coverage; the nature and proof of the resulting loss, subject to the policy terms and jurisdiction, does.
What technical controls typically reduce exposure to drive-by compromise?
Because the technique exploits vulnerabilities in browsers, plugins, and related client software, controls that many practitioners emphasize include timely patch management, removal or restriction of legacy plugins, browser hardening and sandboxing, web filtering or reputation-based blocking, and endpoint detection. These are risk mitigation measures aimed at reducing likelihood or impact; they are distinct from risk transfer through insurance, which does not lower the probability of an incident. The effectiveness of any specific control depends on the environment, and reasonable professionals may weigh these measures differently.
How might failure to maintain patching affect a claim involving a drive-by compromise?
Many cyber policies contain conditions or exclusions relating to the maintenance of security standards or the timely application of patches. Where an attack exploited an unpatched vulnerability, an insurer may examine whether such a provision applies, subject to the specific wording. This is not a universal outcome, and interpretation varies by form and jurisdiction. Insureds and brokers generally review these conditions precedent before binding coverage and document patching practices, rather than assuming that any exploited vulnerability automatically voids coverage.
How should a drive-by compromise be handled within incident response versus crisis management?
Incident response addresses the technical containment, eradication, and recovery activities, such as isolating affected hosts, identifying the exploited vulnerability, and restoring systems. Crisis management addresses the broader organizational decisions, including stakeholder communication, legal and regulatory notification considerations, and executive coordination. These are distinct functions that may run in parallel. A drive-by compromise that leads to wider intrusion may activate both, and treating them as interchangeable can leave gaps in either the technical or the organizational response.
What information should be preserved to support both recovery and a potential claim?
Preserving forensic evidence such as logs, affected system images, and records of the exploited vulnerability supports the technical investigation and can be relevant to demonstrating the cause and scope of loss under a policy. Documentation of timelines, the point of initial access, and the affected data or systems may bear on both first-party recovery measures and any third-party liability that follows. Because coverage depends on the specific wording and proof requirements, insureds commonly coordinate evidence preservation with counsel and their insurer's response procedures rather than acting solely on internal judgment.

Common misconceptions

A drive-by compromise requires the user to knowingly download or install something malicious.
The defining characteristic is that exposure can occur through the act of visiting a page, without deliberate user action such as clicking a download. That said, the precise conditions under which code executes depend on the browser, plugins, and vulnerabilities involved.
Having a cyber insurance policy prevents or reduces the likelihood of a drive-by compromise.
Insurance is a risk-transfer mechanism and does not reduce the probability of an incident occurring. It may respond to certain losses after the fact, subject to the policy's wording and exclusions, but it is not a substitute for technical controls or resilience measures that address the underlying vulnerability.
Because a drive-by compromise is an initial access technique, any loss it eventually causes is automatically covered under a cyber policy.
The technique describes how access is gained, not whether coverage applies. Coverage for resulting first-party losses (such as business interruption or data restoration) or third-party liability (such as privacy claims) is conditional and turns on policy terms, endorsements, exclusions, and jurisdiction.

Best practices

Maintain timely patching of browsers, extensions, and plugins, since drive-by compromise typically relies on exploitable vulnerabilities in these components.
Deploy layered technical controls such as endpoint protection, web filtering, and browser hardening as risk-mitigation measures rather than relying on insurance as a substitute for them.
Map drive-by compromise against the MITRE ATT&CK initial access category to align detection and response capabilities, while keeping this security taxonomy distinct from insurance coverage terms.
Review cyber policy wording, endorsements, and exclusions with a broker to understand which downstream losses (first-party versus third-party) may respond, and note that coverage is conditional and jurisdiction-dependent.
Prepare incident response and business continuity plans that address a foothold gained through this technique, recognizing that RTO and RPO targets govern recovery expectations independently of any coverage decision.
Document the organization's risk decisions, distinguishing where risk is being mitigated through controls, transferred through insurance, or accepted, so that gaps between technical resilience and coverage are made explicit.
Promotional banner for the Pentest Readiness checklist download