Cybersecurity glossary
What is an Attack Path?
Learn what an attack path is, how paths differ from single vulnerabilities, how graph-based path analysis works, and how defenders break chains with targeted controls.
Definition
An attack path is a sequence of steps—techniques, trust relationships, misconfigurations, and vulnerabilities—that an adversary can follow from an initial foothold to a valuable objective such as domain admin, sensitive data, or destructive impact.
Why single CVE lists miss the plot
A medium local privilege bug looks boring alone. On a path that starts with a phished laptop and ends in backup deletion, it is decisive. Attack path thinking forces teams to see combinations—identities, trusts, and flaws—as one route to harm.
Graphs beat spreadsheets for this problem.
Building and reading an attack path
Identify starting positions
Internet assets, user workstations, CI runners, or assumed-breach nodes.
Map edges of trust and abuse
Admin shares, role assumptions, VPN routes, vulns, and stored credentials.
Mark crown jewels
Domain controllers, payment systems, customer data stores, cloud orgs.
Compute reachable paths
Find chains from starts to jewels; rank by length, exposure, and ease.
Break paths at choke points
Remove edges with MFA, segmentation, least privilege, or patches.
Path ingredients beyond CVEs
Identity edges
Group nesting, privilege escalation roles, standing admin rights.
Credential edges
Reused passwords, cached tickets, secrets in repos and images.
Network edges
Flat VLANs, dual-homed hosts, management plane reachability.
Vulnerability edges
Exploitable CVEs that turn access on one node into control of another.
Defensive moves that shorten paths
| Move | Path effect |
|---|---|
| Tiered administration | Removes workstation-to-domain-admin shortcuts |
| Just-in-time privileged access | Deletes standing privilege edges |
| Segment crown jewels | Forces longer, noisier paths |
| Patch choke-point CVEs first | Breaks many graphs with one change |
| Detect lateral techniques | Interrupts paths even when an edge remains |
- Maintain identity and asset graphs—not only CVE lists—for critical environments.
- Prioritize edges that appear in many paths to high-value targets.
- Include cloud role assumption chains in SaaS and IaaS reviews.
- Validate path breaks with purple-team retests, not diagrams alone.
- Treat “assumed breach” paths as first-class, not only perimeter stories.
- Document residual paths accepted as risk with expiry dates.
- Feed path choke points into architecture standards.
- Recompute paths after M&A, major IAM changes, or flat-network migrations.
The practical takeaway
An attack path is the concrete route from foothold to objective. Find the short paths, cut the shared edges, and verify the chain no longer reaches.
If you only rank isolated CVEs, attackers will keep walking the roads you never drew.
Related security terms
Attack Vector
The initial method that often starts an attack path.
Exploit Chain
Technical vulnerability combinations that can form parts of a path.
Attack Primitive
Reusable steps that compose longer attack paths.
Privilege Escalation
Common middle segment on paths toward administrative control.
Defense in Depth
Strategy of placing multiple breaks along likely paths.
Frequently asked questions
What is an attack path in simple terms?
It is the step-by-step route an attacker could take from “outside or low access” to something valuable—like a trail of hop points through users, machines, and cloud roles.
How is it different from an attack vector?
A vector is usually the entry method. A path is the full multi-step journey after (and including) that entry.
How does this relate to the cyber kill chain?
Kill chain models high-level stages. An attack path is a concrete instance across your actual assets and identities.
What is attack path analysis?
Mapping reachable chains using inventory, identity graphs, and vulns to find shortest or highest-risk routes to crown jewels.
What is a choke point?
A shared step many paths must cross—hardening it breaks multiple scenarios at once.
Do paths always need CVEs?
No. Identity misconfigurations, excessive permissions, and trust links create paths without classic vulnerabilities.
How should teams prioritize path findings?
Favor short paths to critical assets, internet-exposed starts, and choke points with high fan-in.
References
Explore authoritative guidance and frameworks related to attack path.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.