Attack Path

What is an attack path?

An attack path is the sequence of steps an attacker chains together to move from an initial foothold to something that matters — data, credentials or a critical system. Each step is usually unremarkable on its own; the risk lives in the chain, which is why scoring findings one at a time misses it.

Key takeaways

• Attackers chain, scanners score. A foothold, a lateral move and a privilege escalation may each rate as medium severity while the path they form is critical.
• Breaking one link collapses the path. The useful output is the single lowest-effort, lowest-risk change that severs the chain, not a plan to fix every step in it.
• Chokepoints are where paths overlap. One change that sits on several paths is worth more than several changes that each sit on one.
• Chains that cross tool boundaries are the hard case. A path running from an exposed host through a misconfiguration into a reachable code vulnerability spans tools that do not share a data model.
• Path analysis inherits its inputs' quality. A graph built on stale asset data or unvalidated findings produces confident pictures of paths that do not exist.

Why it matters

Single-finding risk scoring is the default in vulnerability management and it is structurally blind to chained risk in both directions. It over-escalates isolated critical-rated findings that lead nowhere, and it under-escalates the medium-rated misconfiguration that is the hinge of a path to a production database.

The remediation consequence is what makes this worth the effort. Treating a path as a set of independent findings generates several change requests across several owners, most of which are unnecessary. Treating it as a chain generates one — and one cheap, low-risk change that neuters a real path is a request an owner will actually run.

What a path is made of

• An entry point. An internet-facing service, a phishing-reachable workstation, an exposed API, or credentials obtained elsewhere.
• A lateral move. Reachability between systems that were not intended to be adjacent — a flat network segment, a shared service account, a trust relationship.
• A privilege escalation. A local vulnerability or misconfiguration that converts limited access into administrative access.
• A target. Data, a crown-jewel system or a control plane. Without one, the path is a curiosity rather than a risk.

Attack paths versus attack surface

Attack surface is the set of places an attacker could interact with an organization. It is a breadth measure, it grows with the estate, and reducing it is a permanent background activity.

An attack path is a specific traversal through that surface to a specific target. It is a depth measure and it is directional. The distinction matters operationally: surface reduction is diffuse work with diffuse benefit, whereas severing a path is a discrete change with a demonstrable consequence, which is a much easier thing to ask an owner to schedule.

A worked example of a chain

A concrete chain illustrates the arithmetic. An internet-facing remote access appliance is missing a patch for a vulnerability rated high, but not critical. Exploiting it yields a shell as a low-privileged service account on a host in a management subnet. That subnet was flattened during a migration and never resegmented, so the host can reach a file server holding build scripts. One of those scripts contains a hardcoded service credential, which a secrets scanner rated medium because the account is not an administrator. The account is, however, in a group with local administrator rights on the build servers, and one of those servers pushes artifacts to production.

Scored individually, the four weaknesses are a high, a low-severity network observation, a medium and a configuration item nobody filed. Scored as a chain, they describe a route from the public internet to the production release pipeline. The cheapest break is not the appliance patch, which needs a maintenance window; it is removing the build group from the local administrators group, a change one team can make in an afternoon.

How a chokepoint is chosen

A chokepoint is a node or edge that several paths traverse, so removing it collapses more than one route at once. Finding candidates is a graph problem; choosing between them is an operational judgment, decided by four inputs.

• Path count. How many distinct routes to a critical target pass through this node. The highest-value chokepoints are rarely the highest-severity findings.
• Change cost. Whether the fix is a permission removal, a configuration change or a patch requiring a maintenance window. Severing a trust relationship can also break a legitimate integration, and that disruption is part of the cost.
• Durability and ownership. A segmentation boundary or a removed standing privilege persists, where a blocking rule tuned to one exploit pattern does not — and a chokepoint with one accountable owner is easier to act on than an equivalent one spanning three teams.

The honest limits of path analysis

A path graph is a model, and it is only as good as the reachability data underneath it. Near-complete network knowledge exists in cloud control planes and almost nowhere else: on-premises and hybrid reachability is non-binary, and a topology model assumes every firewall is correctly configured and never changes.

The deeper limitation is what the model excludes. A network path assumes the way in is over the network, leaving out insider threats, stolen credentials and an attacker already inside. Path analysis is a strong prioritization input and a weak completeness claim.

The third limit is evidential. A modelled path asserts that a route is traversable; it does not establish that each step succeeds. Host hardening, endpoint policy and simple version drift all sit between a theoretical edge and a working one, and only a safe test resolves the difference.

Common misconceptions

• That the longest path is the most dangerous. Length is not severity. A two-step path into a payment system outranks a seven-step path into a lab.
• That paths are stable. A chain severed in one sprint can be reconstituted by an unrelated firewall or group-membership change in the next, so path analysis is continuous rather than an assessment.
• That targets are always on the crown-jewel list. Attackers reach valuable systems through hosts nobody classified as important, which is why observed dependency data outperforms a curated tier-one register.

FAQ

Is an attack path the same as a kill chain? No. A kill chain describes the generic phases of an intrusion in the abstract. An attack path is a specific traversal through one environment, made of its assets and its findings.

Do you need to fix every step in a path? No, and trying to is how path analysis becomes unusable. The point is to find the cheapest link to break — one change that collapses the path even though the other weaknesses remain.

What happens to the exposures left behind on a severed path? They become watch-and-wait rather than escalations. Detection on the residual exposure is the sensible cover, on the basis that the attacker now has no route to anything that matters.

Sources

• Verizon, 2026 Data Breach Investigations Report.
• MITRE Corporation, ATT&CK for Enterprise knowledge base, 2025.
• MITRE Corporation, Common Attack Pattern Enumeration and Classification (CAPEC), 2025.
• Lockheed Martin, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, 2011.
• Gartner, Implement a Continuous Threat Exposure Management (CTEM) Program, 2022.
• CISA, Known Exploited Vulnerabilities Catalog, ongoing.