Guide
Attack paths: how findings connect
A single misconfiguration rarely tells you how exposed you are. An attack path does: it links an entry point, a weakness and the permissions in between to something you care about. Seeing the path tells you which finding to fix first, and which link to cut.
Prioritize by exposure
A medium finding on a path to your data can matter more than a critical one on no path at all.
Fix the cheapest link
Cutting one link breaks the whole path, so you can choose the change with the smallest blast radius.
Explain risk in one picture
A path is easier to share with engineering and leadership than a list of findings.
The idea
From a list to a path
Posture checks report one resource at a time. In a real environment those resources are connected: a load balancer forwards to a function, the function runs as a role, the role can read a bucket.
Attack path analysis builds a graph of those relationships. Resources are the nodes; network reach, targets, assumed roles and access grants are the edges. A path is any route through the graph from somewhere an attacker can start to something worth reaching.
Building blocks
Four parts of every path
Entry point
Where the path starts, usually something reachable from the internet.
Weakness
A misconfiguration that makes the next step possible, such as a plain-HTTP listener.
Trust link
A relationship that carries access forward: a target, an assumed role, a grant.
Target
The resource at the end, often data, and the reason the path matters.
Try it
Walk one path, then cut it
Select each step to see why it is on the path. Then show the graph after the fix.
Risk graph · example
Entry point
Internet
Anyone can reach the load balancer. This is where the path starts.
Weak point · High
Load balancer
The listener accepts plain HTTP on port 80, so traffic is unencrypted.
Resource
Function
The load balancer forwards requests to this function. Link: LB_TARGETS_FUNCTION.
Identity
Role
The function runs as this role. Link: FUNCTION_ASSUMES_ROLE.
Data · Critical
Data bucket
The role can read this bucket, and the bucket allows public access. Link: ROLE_CAN_ACCESS.
Context
Network
The network the load balancer sits in. Not on this path.
Safeguard
Key
Encryption at rest is on for this bucket. A safeguard, but it does not stop public reads.
Resource
Log bucket
Another bucket the role can write to. Private, so it is not on the attack path.
After the fix
The path is cut
The draft pull request blocks public access to the bucket. The role still works, but the internet can no longer reach the data, so the path closes and the case moves to verification.
Illustrative graph. The link names are the ones ACSE records.
Using paths well
Three habits of good path analysis
Score the path, not the node
Rank by how exposed the entry is, how serious the weakness is, what the target is and how many steps it takes.
Say what isn’t traced
A graph only knows the relationships it can read. An honest one marks a path as partial when links beyond it aren’t traced.
Show the after
Before approving a fix, show the graph with it applied, so everyone can see the path is cut.
How ACSE approaches it
The graph is built in your account
ACSE’s runtime builds the risk graph in your cloud from the same read-only scan as its checks. It follows trust links such as a load balancer targeting a function, a function assuming a role and a role that can access a bucket, and scores each path.
The control plane receives the shape of each path with counts, never resource names. Each fix shows an Impact graph with the path before and after the change, and paths whose further links aren’t traced are marked partial.
- Five link types traced today, more to come
- Paths scored on entry, weakness, reach and length
- Before and after, in the approval view
Questions
What people ask us
Is attack path analysis the same as threat detection?
No. It shows how an attacker could move given your configuration. It doesn’t watch for an attacker who is moving now.
Why is a path marked partial?
Because some relationships beyond that point aren’t traced yet. Partial means “at least this exposed,” not “only this exposed.”
Does ACSE see the names of resources on a path?
No. The graph and its names stay in your account. ACSE’s control plane sees the shape of the path and counts.
Keep reading
Related
Risk graph
ACSE links resources into a risk graph and traces the paths from the internet to your data, so your team fixes the misconfiguration that breaks the chain.
ReadLearnWhat is CSPM?
Cloud security posture management checks cloud configuration against a baseline. Learn how CSPM works, what it covers and doesn’t, and where programs stall.
ReadLearnAutomated remediation
Automated remediation closes cloud misconfigurations without a ticket queue. Learn the common approaches, why direct writes backfire and what a safe fix needs.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.