Risk graph and attack paths
See the path an attacker would take.
A single finding rarely tells the whole story. ACSE links your resources into a graph and traces each path from an internet entry point, through weak points, to your data. Then it shows which fix cuts the path.
Fix the link that matters
Instead of a long list sorted by severity, your team sees the one change that breaks a path to data.
Context for every finding
Each finding shows the paths it sits on and what reaching it would expose.
Before and after, side by side
Every fix shows the graph with and without it, so the approver can see what the change removes.
Interactive
A trust chain, step by step
This example chain runs from a plain-HTTP load balancer to a data bucket. Hover or tab through it, then switch on the fix.
Risk graph · example
Entry point
Internet
Anyone can reach the load balancer. This is where the path starts.
Weak point · High
Load balancer
The listener accepts plain HTTP on port 80, so traffic is unencrypted.
Resource
Function
The load balancer forwards requests to this function. Link: LB_TARGETS_FUNCTION.
Identity
Role
The function runs as this role. Link: FUNCTION_ASSUMES_ROLE.
Data · Critical
Data bucket
The role can read this bucket, and the bucket allows public access. Link: ROLE_CAN_ACCESS.
Context
Network
The network the load balancer sits in. Not on this path.
Safeguard
Key
Encryption at rest is on for this bucket. A safeguard, but it does not stop public reads.
Resource
Log bucket
Another bucket the role can write to. Private, so it is not on the attack path.
After the fix
The path is cut
The draft pull request blocks public access to the bucket. The role still works, but the internet can no longer reach the data, so the path closes and the case moves to verification.
Illustrative graph. The link names are the ones ACSE records.
How the graph is built
Links ACSE traces
Paths follow real relationships between resources, recorded with the link type so anyone can check them.
Load balancer targets
Which instances and functions a load balancer sends traffic to.
Assumed identities
Which role each instance or function runs as.
Access to data
Which data stores each role can read or write.
Scored and ranked
Paths ranked by how bad they are
Each path is scored on how it starts, how many steps it takes and what it reaches. The top paths lead the dashboard and the fix queue.
The graph is built in your account. What the control plane receives is the shape of each path and its counts, never resource names.
- Internet entry, weak points, safeguards and data, each named in the legend
- Drill from a path straight into the case that fixes it
- A table view for anyone who prefers lists to diagrams
Questions
What people ask us
Is this an attack simulation?
No. The graph is built from your configuration: real relationships between resources. Nothing is attacked, probed or exploited.
Does the graph show my resource names?
Inside your account, the runtime knows them. The portal shows shapes and counts by design, because identifiers never cross to ACSE’s control plane.
Keep reading
Related
Attack path reduction
ACSE connects misconfigurations into paths from the internet to your data, then proposes the fix that cuts the path, approved by a person and verified after.
ReadLearnAttack path analysis
Attack path analysis links cloud findings into a route from the internet to your data. Learn the building blocks, how to prioritize and where paths stop.
ReadPlatformFix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.