A threat event is an occurrence that may cause harm, such as an attempted exploit; the case identifies a weakness rather than an occurrence.

An incident requires an actual or suspected compromise or policy violation; an unexploited defect alone is not proof of one.

Residual risk is the exposure remaining after controls are applied; it is not the name for the technical flaw being inventoried.

Cache poisoning changes name-resolution answers; it does not primarily produce massive request volume from numerous separate clients.

ARP spoofing manipulates local link-layer address resolution; attackers across the Internet need not share the victim's broadcast domain.

Credential stuffing tests stolen login pairs and typically produces authentication attempts and failures, neither of which is the defining evidence here.

Privilege escalation changes an actor's authority on a host; the symptom here is reduced service availability from external request volume.

A MAC limit can block extra devices on a port but cannot verify that one permitted host is truthfully claiming a gateway IP in an ARP reply.

Routed IP ACLs do not necessarily inspect ARP frames on the local link, leaving false IP-to-MAC advertisements unvalidated.

DHCP snooping learns address bindings and rejects rogue DHCP replies but does not by itself validate or discard forged ARP advertisements.

Session fixation concerns predictable or attacker-selected application session identifiers; it cannot directly alter a recursive DNS answer.

A local hosts-file change could redirect that one endpoint, but it would not explain incorrect answers supplied by the recursive resolver to multiple clients.

Double-tagging abuses trunk and native VLAN handling at Layer 2, whereas the observed alteration occurs in resolver data.

Replaying an authentication ticket targets identity sessions; the evidence points instead to falsified name-resolution state.

HTTP worker exhaustion occurs after connection establishment and application requests, whereas these sources do not finish the TCP handshake.

An incomplete transport handshake occurs before application session handling, so the cookies are not the resource directly held by SYN-RECV connections.

Receive windows regulate data flow after sessions exist, not the server's backlog of embryonic TCP connections.

CSRF tricks an authenticated browser into issuing a request, but this case describes a telephone request directed at an employee.

Stuffing tests previously leaked credential pairs automatically; the caller instead obtains an MFA reset through impersonation.

Deauthentication disrupts wireless associations; it does not explain a persuasive call that changes an identity account.

ACK probes infer firewall behavior by testing packet handling; they have no natural role in changing invoice payment destinations.

DHCP starvation consumes address leases on a local network, unlike a targeted social-engineering payment request.

Reflected XSS executes injected browser-side content from a response; the observed outcome is fraudulent payment instruction.

Vishing is voice-based deception, while the attackers are using a written email message to reach the developers.

Smishing uses SMS as the delivery channel; the case explicitly identifies an email delivered to selected maintainers.

A watering-hole attack corrupts a site the targets already visit; the case specifies directly delivered email instead.

Network isolation limits reachability but does not stop malicious input already accepted by the portal from changing shell behavior.

Blacklists can miss quoting and parsing edge cases, while eliminating shell interpretation of untrusted data addresses the unsafe pattern more reliably.

A WAF may block known payloads temporarily, but parser and shell execution ambiguities remain in the application code.

Version pinning can aid reproducibility, but a compromised authorized release may still execute with excessive privileges.

Signatures attest to a signer and package integrity, not the good intent of the signer or absence of a compromise.

Disabling behavioral telemetry creates blind spots after a compromised supply chain has delivered apparently trusted software.