Attack Path

Overview

An attack path maps how an adversary can move from an initial entry point to a valuable asset or privileged capability. The route may cross identities, devices, applications, networks, cloud roles, smart contracts, vendors, and operational processes.

Each individual step may appear low risk, yet their combination can enable escalation, lateral movement, credential theft, fund transfer, or data access. Paths often exploit excessive trust relationships, reused credentials, weak segmentation, and overlooked recovery or administrative functions.

Defenders should identify high-impact destinations, enumerate reachable paths, and prioritize controls that break several routes at once. Continuous mapping is necessary because configuration, permissions, software, and dependencies change, creating new combinations even without a newly discovered vulnerability.

An attack path is the sequence of weaknesses, permissions, systems, and actions an attacker can combine to reach a target outcome. Attack-path analysis reveals how ordinary weaknesses combine, helping teams block routes to critical assets instead of treating findings in isolation.

Assessment of Attack Path should trace the sequence of weaknesses, permissions, systems, and actions an attacker can combine to reach a target outcome from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving sequence of weaknesses, permissions, and systems should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Attack Path context should be tested against the architecture associated with sequence of weaknesses, permissions, and systems.

Retesting for Attack Path should reproduce the Attack Path context involving sequence of weaknesses, permissions, and systems, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.