Question 1

How is attack path analysis different from CSPM?

Accepted Answer

CSPM tells you which resources are misconfigured. Attack path tells you which chains of findings reach something you actually care about. A public bucket is a CSPM finding; a public bucket reachable from a lambda that can be triggered by an anonymous SNS topic is an attack path.

Question 2

What data sources feed the attack path graph?

Accepted Answer

Posture findings, IAM policies and identity analysis, network exposure and security-group rules, data-store access, and behaviour seen by threat detection. Each source adds evidence to the edges of the same graph, so no external SIEM stitching is required.

Question 3

How do you define crown jewels?

Accepted Answer

From a catalog of high-value targets: data stores such as S3 buckets, RDS and DynamoDB, encryption keys, and other resources the catalog marks as targets. Data stores that Onam's data security engine finds sensitive are flagged as crown jewels too.

Question 4

What is a choke point, and why fix it before the critical findings?

Accepted Answer

A choke point is a single resource that sits on many distinct attack paths. Severity describes a finding in isolation; a choke point describes leverage. Fixing a medium-severity role that many paths route through can remove more real risk than fixing a critical finding on a resource an attacker cannot reach — and because the graph is rebuilt on the next scan, the fix is verifiable: the paths that depended on that resource are gone.

Question 5

What does an attack path analysis tool do?

Accepted Answer

It turns a list of findings into routes. An attack path analysis tool starts from what an attacker can touch — an internet-facing service, a compromised identity — and walks the relationships that actually exist between resources until it reaches something worth protecting. The output is a route with an entry point, a set of hops and a destination, which is a thing you can fix. A severity list cannot express that, because severity describes one finding in isolation and a route is a property of the connections between them. Our Learn guide, "What is a cloud attack path?", covers the concept in more depth.

Question 6

What should I look for in attack path analysis software?

Accepted Answer

Four things. Where the edges come from — evidence from your real policies and network rules, or assumed relationships. Whether blocked routes are dropped rather than shown as risk. Whether it tells you which single fix removes the most paths, not only which path is worst. And whether a fix is verified by the tool rebuilding the graph, rather than by someone closing a ticket. Ask every vendor, including us, to show each of these on your own account.

Question 7

Is attack path mapping the same as attack path analysis?

Accepted Answer

In practice yes — the two terms are used interchangeably across the industry, and no standards body distinguishes them. Where people do draw a line, mapping tends to mean building the graph of what connects to what, and analysis means searching that graph for routes to crown jewels. Onam does both in one pass: the graph is built from scan evidence across 7 clouds, then searched breadth-first from entry points.

Question 8

What is cloud attack path management, and how is it different from finding paths?

Accepted Answer

Finding a path is a point-in-time result. Managing them is the operational loop around it: ranking the paths that matter, choosing the change that removes the most of them at once, verifying the route is actually gone on the next scan, and watching for the new ones that appear as the estate changes. Onam rebuilds the graph every scan, so a fixed route disappears rather than being marked resolved by hand.

Question 9

How do I know a path is real and not a theoretical graph traversal?

Accepted Answer

This is the right question to ask any vendor, including us. A graph will happily produce routes that cannot be walked in practice. Onam marks every edge confirmed, blocked or gap from the evidence behind it, and only confirmed edges are walked. The full method is documented in our attack-path methodology whitepaper.

Question 10

What does Onam's attack path analysis not do?

Accepted Answer

It analyses your cloud accounts and Kubernetes clusters, not on-premises Active Directory, so it is not a replacement for an AD attack-path tool. It reasons over evidence — it does not exploit anything, run breach-and-attack simulation or replace a penetration test. Paths are rebuilt on each scan, not streamed in real time. And because only confirmed edges are walked, a relationship Onam has no evidence for is left out of the paths rather than guessed at.

Question 11

Is attack path analysis the same as an on-path attack?

Accepted Answer

No. Attack path analysis maps chains of cloud risk. An "on-path attack" is the interception technique formerly called man-in-the-middle — an unrelated term that happens to share two words.

Cloud attack path analysis: see which chains of small issues actually reach your crown jewels.

A medium-severity SSRF on an EC2 instance.

The risk of not knowing

Attack Path Analysis in two minutes

The mechanism, not the marketing

Specific outputs, measurable outcomes

Attack Path Analysis in the real console.

Attack paths on one page

Questions we get a lot

Ready to see Attack Path Analysis in your cloud?