What Is Attack Path Analysis?

How Attack Path Analysis Works

Attack path analysis begins with building a graph representation of an environment. Nodes represent entities: IAM principals, compute instances, storage resources, network interfaces, Kubernetes pods, and service accounts. Edges represent relationships: "can assume role," "has network access to," "has read permission on," "runs with identity of." The resulting graph typically lives in a graph database like Neo4j, Amazon Neptune, or a vendor's proprietary store.

Once the graph is constructed, the analysis engine runs traversal algorithms to find paths from attacker-reachable entry points (internet-facing services, publicly exposed credentials, compromised user accounts) to high-value targets (production databases, secrets managers, domain admin equivalents, billing APIs). The output is a ranked set of attack paths ordered by exploitability and impact.

Tools like BloodHound (originally built for Active Directory, now extended to Azure via AzureHound) pioneered this approach by mapping identity relationships. Cartography, an open-source tool from Lyft, builds infrastructure graphs across AWS, GCP, Azure, and Kubernetes. Commercial platforms including Wiz, Orca, and Microsoft Defender for Cloud integrate attack path analysis directly into their CNAPP offerings.

Why It Differs from Vulnerability Scanning

Traditional vulnerability scanning evaluates individual resources against a list of known weaknesses, such as a specific CVE on an EC2 instance or a missing patch on a container image. Each finding gets a CVSS score, and teams triage by severity. The problem is that a Critical-severity vulnerability on a fully isolated, non-internet-facing workload with no access to sensitive data poses far less real risk than a Medium-severity misconfiguration on a service account that can escalate to Organization Admin.

Attack path analysis shifts the model from "how severe is this individual finding?" to "what can an attacker actually reach from here?" A public-facing Lambda function with iam:PassRole permissions, connected to a role with s3:GetObject on a bucket containing database backups, constitutes a three-hop attack path with severe blast radius, even though no single node in that chain would rank as Critical in a standalone scan.

Identity-Centric Attack Paths in Cloud

In cloud environments, the most consequential attack paths are identity-centric. Unlike on-premises networks where lateral movement often depends on network adjacency and credential reuse, cloud lateral movement primarily follows the identity graph: role assumptions, service account impersonation, cross-account trust policies, and managed identity assignments.

A 2024 analysis by Ermetic (now Tenable Cloud Security) found that 78 percent of organizations had at least one identity-based attack path leading to critical data stores. These paths frequently involve chaining multiple lower-severity permissions: an EC2 instance role with ssm:SendCommand, targeting an instance whose role has sts:AssumeRole to a cross-account role with administrative access. No single permission in that chain violates least privilege in an obvious way, but the combination creates a privilege escalation path.

Real-World Attack Paths

The breaches below show how chains of individually modest weaknesses become a single, severe path.

Capital One, 2019

An attacker chained a misconfigured web application firewall, server-side request forgery, an overpermissioned EC2 instance role, and broad S3 read access into a path that reached more than 100 million customer records. Each link looked minor in isolation. Together they formed a direct route from the internet to sensitive data, exactly the kind of chain attack path analysis is designed to surface in advance.

Uber, 2022

After social-engineering a contractor and defeating MFA through fatigue prompts, the attacker found hardcoded administrative credentials in an internal PowerShell script. That single stored secret was the edge that connected initial access to privileged access across multiple internal systems.

Microsoft AI Research SAS Token, 2023

A misconfigured Azure Storage shared access signature token, published alongside open-source AI research, granted far more access than intended and exposed roughly 38 terabytes of internal data. A single over-scoped permission created a path from a public repository to private storage, a relationship a graph-based analysis would have flagged immediately.

Building Effective Attack Path Analysis

Effective attack path analysis requires three capabilities: comprehensive asset discovery (you cannot model what you cannot see), accurate relationship mapping (especially IAM policy evaluation, which requires understanding resource-based policies, identity-based policies, permission boundaries, SCPs, and session policies simultaneously), and contextual prioritization (factoring in internet exposure, data sensitivity classification, and compensating controls like MFA and conditional access policies). Teams that lack offensive experience tend to misjudge which paths are practically exploitable versus theoretically possible.

Attack Path Analysis vs. CSPM and Vulnerability Management

CSPM tells you which resources are misconfigured. Vulnerability management tells you which software is unpatched. Attack path analysis connects those findings to answer a different question: which of them actually chain together into a route to something valuable. It does not replace CSPM or vulnerability scanning; it sits on top of them, consuming their output as nodes and edges and turning a flat list of thousands of findings into a short, ranked list of exploitable paths. This is why attack path analysis has become a core capability inside CNAPP platforms rather than a standalone category.

Common Cloud Attack Path Patterns

A handful of path shapes recur across almost every environment. Public compute to credentials: an internet-facing instance with an attached role, reached through server-side request forgery or remote code execution, hands the attacker that role's permissions through the metadata service. Leaked key to pipeline: a credential committed to a public repository grants access to a CI/CD system that can deploy infrastructure or read secrets. Guest to tenant: an over-permissioned B2B guest account in Entra ID enumerates and reaches resources across a trusted tenant. Service account impersonation: a low-privilege principal holding iam.serviceAccounts.getAccessToken or actAs can borrow a far more privileged identity. Storage to secrets: read access to one bucket exposes configuration files or backups that contain credentials for something else. Recognizing these shapes lets defenders prioritize the specific edges that turn a foothold into a full compromise, rather than treating every finding as equal.

Limitations and Blind Spots

Attack path analysis is only as good as the graph beneath it. Incomplete asset discovery hides paths entirely, and inaccurate IAM evaluation, especially when permission boundaries, service control policies, and resource-based policies interact, produces both false paths and missed ones. The graph is also a point-in-time snapshot: ephemeral compute and short-lived credentials can create and destroy edges between scans, so a path that did not exist this morning may exist this afternoon. A tool can also rank a path as reachable without knowing whether a compensating control it cannot see, such as a conditional access policy or a network restriction, actually blocks it. Human judgment, informed by offensive experience, remains essential to separate the practically exploitable from the merely possible.

Attack Path Analysis in a CTEM Program

Continuous Threat Exposure Management (CTEM), a framework popularized by Gartner, formalizes the cycle of scoping an environment, discovering exposures, validating which are exploitable, and prioritizing remediation. Attack path analysis is the engine of the validation and prioritization stages. Rather than asking teams to remediate thousands of findings by CVSS score, a CTEM program uses attack path analysis to identify the small number of choke points that, once fixed, break the largest number of paths to critical assets. Cutting one over-permissioned role can eliminate dozens of downstream paths at once, which is why path-based prioritization consistently outperforms severity-based triage.

Related Labs

The best way to internalize attack-path thinking is to traverse real paths yourself. Pwned Labs scenarios such as Intro to AWS IAM Enumeration, Pivot Through Service Accounts Using Dangerous Permissions, and Abuse Dynamic Groups in Entra ID for Privilege Escalation walk through multi-step chains from initial access to escalation. Browse the full set at pwnedlabs.io/explore.

Learn to Think in Attack Paths at Pwned Labs

Pwned Labs bootcamps are built around attack-path thinking. Instead of studying misconfigurations as isolated findings, practitioners chain them together in real cloud environments, escalating from initial access to data exfiltration across AWS (ACRTP), Azure (MCRTP and MCRTE), and GCP (GCRTP). Every lab requires identifying and traversing multi-step attack paths, building the exact mental model that makes attack path analysis tools actionable in production. Start at pwnedlabs.io/bootcamps.

Frequently Asked Questions

What is attack path analysis?

A security methodology that models a cloud environment as a graph and traverses it to find the chains of exploitable relationships an attacker could follow from an entry point to a high-value target, so teams can break those chains before they are used.

How is it different from vulnerability scanning?

Vulnerability scanning scores findings in isolation. Attack path analysis connects findings, showing how several individually low-severity issues combine into a high-impact route to sensitive data or administrative control.

Why are cloud attack paths mostly identity-based?

Because cloud lateral movement follows the identity graph rather than network adjacency. Role assumptions, service account impersonation, and cross-account trust policies are the edges attackers traverse, so most consequential paths are chains of permissions.

Which tools perform attack path analysis?

BloodHound and AzureHound for identity graphs, Cartography for open-source infrastructure graphs, and commercial CNAPP platforms such as Wiz, Orca, and Microsoft Defender for Cloud, which build the graph and rank paths automatically.

Does attack path analysis replace CSPM?

No. It sits on top of CSPM and vulnerability management, consuming their findings and turning a long flat list into a short, ranked set of paths that actually reach something valuable.