Topic hub
Attack Paths
Reviewed articles, glossary entries, and product proof related to attack paths. Every claim carries a source.
Articles
Attack Paths
Attack path intelligence: what security leaders should measure first
Understand what an adversary can reach, identify the choke points, and measure whether the changes you make actually break the path.
Attack Paths
Vulnerability remediation is broken
Security teams can offload at least half of their remediation workload with asset-context-aware patch prioritization. The methodology, and the open-source SSVC Ore Miner that automates it end to end.
Attack Paths
The last mile problem: challenges in vulnerability management
Discovery, assessment and prioritization run efficiently; the fix does not get delivered. Why the final leg of vulnerability management looks exactly like logistics’ last mile — and what bridges it.
From the glossary
- Attack path — An attack path is the ordered sequence of steps — pivots, credentials, misconfigurations, and reachable network edges — that an attacker would traverse from a foothold to a business-critical asset. Attack paths are more actionable than isolated findings because they explain which fixes actually reduce reachable risk.
- Exposure — Exposure is the subset of an organization’s attack surface that is reachable from the internet — including domains, records, certificates, services, and dependent third parties — and that could serve as an entry point for an adversary.
- Authorized validation — Authorized validation is the practice of confirming an exposure by executing a scoped, permissioned check against the target — reproducing the evidence an attacker would see without harming the target or leaving persistent artifacts.
- Guardrail — A guardrail is a preventive control that blocks a risky change at the boundary — for example, a policy that prevents a cloud identity from being created with wildcard permissions. Guardrails succeed by narrowing the space of possible misconfigurations rather than reacting to them after the fact.
- Cloud posture — Cloud posture is the aggregate configuration state of an organization’s cloud environment — resources, identities, networks, and controls — measured against a defined policy baseline and expressed as a set of prioritized findings.