What is attack path analysis?
Attack path analysis is the process of finding the chains of weaknesses an attacker could link together to move from an entry point, such as the public internet, to a high-value asset, such as a database of customer records. It joins configuration, identity, network, vulnerability and data findings into a graph and ranks the routes by what they reach.
Attack path analysis at a glance
| Question | Answer |
|---|---|
| What is an attack path? | One route from an entry point to a valuable target, made of several linked weaknesses |
| What does analysis produce? | The routes that reach critical assets, ranked, plus the choke points many routes share |
| What data does it need? | Cloud configuration, identities and permissions, network reachability, vulnerabilities, data sensitivity |
| How is it modelled? | As a graph. Resources and identities are nodes, permissions and network routes are edges |
| What does it not do? | Prove that an attacker has used a path. That is detection and response |
| Related terms | Attack path mapping, attack path management, attack graph, choke point |
Why a list of findings is not enough
A typical cloud environment produces thousands of findings. Ranked by severity, the top of the list fills with criticals on resources nobody can reach, while the finding that matters sits far down marked "medium".
Severity is a property of a finding in isolation. Risk is a property of a finding in context. The two diverge constantly:
- A critical CVE on an isolated development instance with no data and no network path is close to harmless.
- A medium-severity IMDSv1 setting on an internet-facing instance whose role can read the customer database is the whole breach.
The second is what an attacker uses. Seeing it requires knowing four things at once: exposure, identity, permissions and data. These usually live in four different tools.
Attack path example: four findings that form a route to data
Entry: an EC2 instance is reachable from the internet on port 443. Hop 1: the instance allows IMDSv1, so a server-side request forgery bug returns its role credentials. Hop 2: that role can assume a second, more privileged role. Hop 3: the second role has s3:GetObject on a production bucket. Target: the bucket holds customer records classified as personal data.Individually: one medium, one low, two informational findings. Together: a complete route to customer data. Breaking any single hop breaks the path. Enforcing IMDSv2 is a one-line change:
metadata_options {
http_tokens = "required" # IMDSv2 only
}A second common shape is identity-only: a CI/CD role with iam:PassRole and lambda:CreateFunction can create a function that runs as an administrator role. That is privilege escalation without touching a single vulnerable package. That is why identity is the backbone of most cloud paths; see What is CIEM?.
How attack path analysis works
- Build a graph: resources, identities, network routes and data stores as nodes; permissions, trust relationships and reachability as edges.
- Mark entry points: anything reachable from the internet, from a partner account, or from a lower-trust boundary.
- Mark targets: your most valuable assets, ideally defined by data classification (DSPM) rather than by hand.
- Traverse: find every route from entry to target, respecting real permission semantics, including transitive role assumption and resource policies.
- Rank: by target value, path length, exploitability of each hop, and how many paths share a node.
- Map to MITRE ATT&CK: label each hop with a technique so detection engineers can check coverage and run tabletop exercises.
Attack path analysis vs attack path mapping vs attack path management
- Attack path mapping is the visual part: drawing the routes from entry to target so people can see them. Often done in a red-team or consulting engagement.
- Attack path analysis is the computation behind it: finding every route in the graph and ranking them by what they reach and how exploitable each hop is.
- Attack path management is the continuous programme: discover, analyse, prioritise, fix the hops that close the most paths, then re-validate that the path is gone. The cycle repeats as the environment changes.
Analysis done once is a snapshot. Cloud environments change with every deploy, so useful attack path work is continuous.
Attack path analysis vs attack surface management
| Attack path analysis | Attack surface management (ASM) | |
|---|---|---|
| Question | What can an attacker reach after getting in? | What can an attacker see and touch from outside? |
| Scope | Inside the environment: identities, permissions, internal networks, data | The external perimeter: domains, IPs, exposed services, certificates |
| Output | Ranked routes to critical assets, and choke points | An inventory of exposed assets and their weaknesses |
| Relationship | Uses ASM's exposed assets as entry points | Stops at the edge |
They work together: ASM finds the doors, attack path analysis shows where each door leads. Both feed continuous threat exposure management (CTEM) programmes.
Attack path vs attack graph vs attack tree
- An attack graph models every possible route across an environment at once.
- An attack path is one route through that graph, from entry to target.
- An attack tree breaks a single attacker goal into sub-goals and steps. It is a planning tool rather than a map of your environment.
Choke points: where to fix first
Once paths are computed, most environments show heavy convergence: many distinct paths routing through a handful of nodes, such as an over-permissive role attached to many services or a single peered network.
A choke point is a node that appears in a disproportionate number of paths. Fixing one can remove more risk than closing many individual findings, which turns an unbounded backlog into a short, ordered list of fixes that each close many paths. Pair it with cloud risk quantification when you need to explain the priority in business terms.
Attack path analysis in cloud vs on-premises
On-premises, attack path analysis grew up around Active Directory. Tools such as BloodHound map how a low-privileged account can reach Domain Admin through group memberships, sessions and ACLs. In the cloud the edges are different: IAM policies, role trust, resource policies, security groups, Kubernetes RBAC and workload identities. The method is the same; the graph has to be built from cloud APIs. Kubernetes adds its own layer (see What is KSPM?), and running workloads add vulnerabilities (see What is CWPP?).
Attack path vs on-path attack
The terms look alike and are unrelated. An on-path attack (the newer name for a man-in-the-middle attack) is a single technique: an attacker positions themselves between two communicating parties to intercept or alter traffic. An attack path is a chain of weaknesses that leads from an entry point to a valuable asset. One is eavesdropping on a conversation; the other is route-finding across an environment. TLS everywhere and certificate validation defend against on-path attacks; breaking hops and choke points defends against attack paths.
Attack path analysis best practices
- Define high-value targets by data. Classification tells you which targets matter, so nobody has to guess.
- Model identity in full. Include role assumption, resource policies and workload identities. Most cloud paths are identity paths.
- Fix choke points first. One shared role or one network route can sit on many paths.
- Break the cheapest hop. You do not need to fix every link. One broken link closes the path.
- Re-validate after each fix. Confirm the path is gone. A finding marked resolved is not proof.
- Run it continuously. A quarterly path review describes an environment that no longer exists.
- Map hops to MITRE ATT&CK so detection covers the paths you cannot close yet.
How Onam approaches attack path analysis
Onam keeps the signals attack path analysis joins in one platform across AWS, Azure, GCP, OCI, Alibaba Cloud, IBM Cloud and Kubernetes: 9,853 CSPM posture rules, and in its rule catalogue 1,459 rule definitions tagged to IAM, 1,166 to network and 1,321 to data protection. One honest limit: a path computed from configuration shows that a route is possible; it is not evidence that anyone has used it.
Frequently asked questions
What is attack path analysis?
Attack path analysis finds the chains of weaknesses an attacker could link together to move from an entry point, such as the internet, to a high-value asset, such as a customer database. It joins configuration, identity, network, vulnerability and data findings into a graph and ranks the routes by what they reach.
What is attack path mapping?
Attack path mapping is the visual side of attack path work: drawing the routes an attacker could take from an entry point to critical assets, so security and engineering teams can see how individual weaknesses connect.
What is attack path management?
Attack path management is the continuous practice of discovering, analysing, prioritising and removing attack paths as the environment changes, then re-validating that each fixed path is gone.
What is the difference between attack path analysis and attack surface management?
Attack surface management inventories what is exposed from outside: domains, IPs and services. Attack path analysis shows what an attacker can reach after getting in, through identities, permissions and internal networks. ASM finds the doors; attack path analysis shows where they lead.
What is a cloud attack path?
A chain of individually low- or medium-severity cloud findings (for example an exposed instance, an over-permissive role and a readable bucket) that together create a route from the internet to sensitive data. Each link is minor; the chain is critical.
What is a choke point in attack path analysis?
A node that appears in a disproportionate number of attack paths, commonly an over-permissive role or a peered network. Fixing one choke point can remove many paths at once, which makes it the highest-leverage fix available.
How is attack path analysis different from vulnerability scanning?
Vulnerability scanning finds weaknesses in individual components and ranks them by CVSS. Attack path analysis determines whether those weaknesses connect to each other and to something valuable. A critical CVE with no path to anything ranks below a medium finding that completes a chain to your customer database.
What is an on-path attack, and is it the same as an attack path?
No. An on-path attack, formerly called man-in-the-middle, is a single technique where an attacker intercepts traffic between two parties. An attack path is a chain of configuration and identity weaknesses leading from an entry point to a high-value asset.