What Are Initial Access Brokers?

**Executive summary:** This report outlines how initial access brokers (IABs) operate as specialized cybercriminals who gain and sell footholds into organizations—using infostealers, exposed internet-facing systems, and phishing—to downstream attackers (ransomware crews, BEC actors, or data thieves); it emphasizes the commoditization of access, the difficulty of attribution, and recommends mitigations such as enforcing MFA, locking down remote access, rapid patching, security awareness training, and monitoring for suspicious identity behavior.