Attack path reduction
Close the paths that actually reach your data.
A single misconfiguration rarely tells you much. Three of them in a row can open a route from the internet to a data store. ACSE links findings across your configuration into paths, ranks them, and proposes the change that breaks the chain where it counts.
Work on what is reachable
Paths from an internet entry to your data rise to the top, so your team spends effort where exposure is real.
Fix one link, close the path
Often one change, such as blocking public access, breaks the whole route without touching the services along it.
See the result before and after
The impact view shows the path as it is and as it will be once the fix lands.
The risk graph
See the path, then cut it
An example path through a load balancer, a function and the role it assumes, to a data bucket. Turn on the fix to see the path close.
Risk graph · example
Entry point
Internet
Anyone can reach the load balancer. This is where the path starts.
Weak point · High
Load balancer
The listener accepts plain HTTP on port 80, so traffic is unencrypted.
Resource
Function
The load balancer forwards requests to this function. Link: LB_TARGETS_FUNCTION.
Identity
Role
The function runs as this role. Link: FUNCTION_ASSUMES_ROLE.
Data · Critical
Data bucket
The role can read this bucket, and the bucket allows public access. Link: ROLE_CAN_ACCESS.
Context
Network
The network the load balancer sits in. Not on this path.
Safeguard
Key
Encryption at rest is on for this bucket. A safeguard, but it does not stop public reads.
Resource
Log bucket
Another bucket the role can write to. Private, so it is not on the attack path.
After the fix
The path is cut
The draft pull request blocks public access to the bucket. The role still works, but the internet can no longer reach the data, so the path closes and the case moves to verification.
Illustrative graph. The link names are the ones ACSE records.
How a path is built
From findings to a ranked path
Paths are built from configuration that ACSE reads, not from network traffic. They show what is reachable, not what an attacker did.
- Read the configurationRead-only collectors gather the state of your resources and how they connect.
- Link the resourcesACSE records which load balancers reach which compute, which compute assumes which role, and what each role can access.
- Find the pathsIt follows those links from internet entry points, through weaknesses, to the resources that hold data.
- Rank and routeEach path is scored, and the findings on it move up the queue with a proposed fix.
What the graph connects
The links ACSE records
- Load balancer to instance
- Traffic from an entry point reaches a server
- Load balancer to function
- Traffic reaches a serverless function
- Instance to role
- A server runs with the permissions of a role
- Function to role
- A function runs with the permissions of a role
- Role to resource
- That role can read or change a data store
The fix
Cut the link that matters most
The proposed fix goes through the same chain as any other: written into your code, tested offline against a plan, checked against your policy and approved by a person with step-up MFA.
After the merge, ACSE re-reads the resources on the path. The path closes in the graph only when the cloud confirms it.
- Blast radius shown before approval
- Path closure verified, not assumed
- Graph completeness stated when a link type can’t be traced
Questions
What people ask us
Is this runtime threat detection?
No. ACSE’s paths come from misconfigurations in your cloud’s configuration. They show what could be reached, so you can close it. ACSE does not monitor traffic or detect attacks in progress.
Does ACSE send our resource names to its control plane to draw the graph?
No. The graph is built in the runtime in your account. What reaches ACSE’s control plane is the shape of each path and counts, never names, ARNs or ids.
What if part of the chain can’t be traced?
ACSE says so. The graph reports its completeness, and an untraced link is shown as unknown rather than assumed safe.
Keep reading
Related
Risk graph
ACSE links resources into a risk graph and traces the paths from the internet to your data, so your team fixes the misconfiguration that breaks the chain.
ReadPlatformFix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadSolutionsFix existing findings
Whoever detected the misconfiguration, ACSE turns it into a reviewed fix in your own code, verifies the cloud afterwards and keeps a signed record.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.