Unit 42's monthly roundup (Oct 16) ranks exploitation of public-facing applications as the most frequent entry vector in September, followed by valid credentials and credential abuse (often chained with edge-service bugs), phishing and targeted social engineering, supply-chain compromise, and drive-by or watering-hole compromise. It's a qualitative ranking without counts, so treat it as direction rather than measurement; it matches this week's KEV mix of edge appliances (BeyondTrust, Fortinet, Atlassian, Ivanti) and the AOMEI update-channel compromise.