What it means
An attack path describes how separate weaknesses and permissions can be chained together. A single misconfiguration may appear low risk in isolation, yet it can become important when it connects an exposed service to a privileged identity, sensitive data, or a critical production system.
How it works
Attack-path analysis begins with likely entry points and desired attacker objectives. Defenders map network reachability, identity privileges, administrative relationships, software dependencies, secrets, and trust boundaries between them. The result is not merely a vulnerability list; it is a model of feasible movement through the environment.
An internet-facing application may have limited privileges, but its service account can read a deployment secret, that secret opens a management platform, and the platform can modify production. The combined path is much more serious than any individual step suggests.
Practical focus
- Model entry points, intermediate pivots, and high-value objectives
- Include identity and cloud-control-plane relationships, not only network routes
- Prioritize controls that break multiple paths at once
- Recalculate paths after architectural, permission, and exposure changes
Common mistakes
- Ranking vulnerabilities without considering reachability or privileges
- Assuming network segmentation alone blocks identity-based movement
- Documenting theoretical paths that ignore required access or preconditions
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: