What is a cloud attack path?
A cloud attack path is a chain of individually low- or medium-severity findings that together create a route from an entry point — usually the public internet — to a high-value asset such as a database holding sensitive data. Attack path analysis computes these chains across posture, identity, network and workload data.
Why finding lists fail
A typical cloud environment produces thousands of findings. Ranked by severity, the top of the list is dominated by criticals on resources nobody can reach, while the finding that actually matters sits at position 800 marked "medium".
Severity is a property of a finding in isolation. Risk is a property of a finding *in context*. The two diverge constantly:
- A critical CVE on an isolated development instance with no data and no network path is close to harmless.
- A medium-severity IMDSv1 setting on an internet-facing instance whose role can read the customer database is the whole breach.
The second one is what an attacker uses. Almost no tool surfaces it, because surfacing it requires knowing four things at once.
What a path actually looks like
Entry — an EC2 instance is reachable from the internet on port 443. Hop 1 — the instance has IMDSv1 enabled, so a server-side request forgery yields credentials. Hop 2 — those credentials belong to a role that can assume a second, more privileged role. Hop 3 — the second role has s3:GetObject on a production bucket. Target — that bucket holds 847,000 customer records classified as PII.Four findings. Individually: one medium, one low, two informational. Together: a complete breach path, and every fact needed to see it lives in a different tool in most stacks.
Toxic combinations
A toxic combination is a set of conditions that are each acceptable alone and unacceptable together. Public network exposure is fine on a marketing site. A permissive IAM role is fine on an isolated workload. Sensitive data is fine in a locked-down store. Put all three on one resource and you have a critical exposure that no individual rule flags.
Detecting them requires evaluating combinations, not rules — which is only possible if every signal is on one graph.
Choke points
Once paths are computed, most environments show heavy convergence: hundreds of distinct paths routing through a handful of nodes. That over-permissive role attached to twelve services, or that one peered VPC.
A choke point is a node that appears in a disproportionate number of paths. Fixing one choke point can eliminate more risk than closing a hundred individual findings, and it is the single most useful output of attack path analysis — it converts an unbounded backlog into a short, ordered list of high-leverage fixes.
How it is computed
- Build a graph — resources, identities, network routes and data stores as nodes; relationships as edges.
- Mark entry points — anything reachable from the internet or from a lower-trust boundary.
- Mark targets — crown jewels, typically defined by data classification rather than by hand.
- Traverse — find every route from entry to target, respecting real permission semantics including transitive role assumption.
- Rank — by target value, path length, exploitability of each hop, and how many paths share a node.
Mapping each hop to MITRE ATT&CK techniques makes the output legible to detection engineers and useful for tabletop exercises.
What it changes
The practical shift is from "4,000 findings" to "3 paths that reach crown jewels, converging on 2 choke points". That is a backlog a team can actually clear this sprint — and it is the difference between a tool that reports risk and a tool that reduces it.
Next steps
- How Onam implements attack path analysis
- What is CIEM? — identity is how attackers move
- What is CNAPP?
Frequently asked questions
What is a cloud attack path?
A chain of individually low- or medium-severity findings that together create a route from an entry point such as the public internet to a high-value asset such as a database holding sensitive data. Each link is minor; the chain is critical.
What is a toxic combination in cloud security?
A set of conditions that are individually acceptable but dangerous together — for example public network exposure, plus an over-permissive IAM role, plus sensitive data, all on one resource. No single rule flags it because no single condition is a violation.
What is a choke point in attack path analysis?
A node that appears in a disproportionate number of attack paths — commonly an over-permissive role or a peered network. Remediating one choke point can eliminate hundreds of paths at once, which makes it the highest-leverage fix available.
How is attack path analysis different from vulnerability scanning?
Vulnerability scanning finds weaknesses in individual components and ranks them by CVSS. Attack path analysis determines whether those weaknesses connect to each other and to something valuable. A critical CVE with no path to anything ranks below a medium finding that completes a chain to your customer database.