What Is Attack Path Analysis? How It Works & Choke Points

Attack path analysis (APA) is the practice of identifying, mapping, and prioritizing the chained routes an attacker follows from an entry point to an organization's critical assets.

The analysis connects vulnerabilities, misconfigurations, identities, and permissions that look minor in isolation into the sequences that lead somewhere dangerous.

Vulnerability scanners report findings one at a time, each scored on its own. Attack path analysis asks a different question: which combination of findings lets an outsider reach a domain controller, a customer database, or a cloud tenant, and which single fix breaks that route.

How Attack Paths Form

Attack path analysis models an environment as a graph of assets and the relationships an attacker abuses to move between them.

Nodes: Hosts, applications, identities, cloud resources, data stores, and exposures such as a vulnerable service or a leaked credential.
Edges: The relationships attackers exploit to move from one node to the next, including network reachability, group membership, role assignments, trust relationships, and stored credentials.
Entry points: Nodes an outsider reaches directly, such as internet-facing services, phishable users, exposed secrets, or a compromised supplier.
Crown jewels: The targets that matter most, such as domain administrator rights, regulated data stores, source code, and production cloud accounts.
Toxic combinations: Sets of individually moderate findings that together form a complete route from an entry point to a crown jewel.

A path exists only when every edge in the chain is traversable. Removing one edge, such as an unnecessary permission, breaks every path that runs through it, and that property drives the entire prioritization logic of the discipline.

Attack Path vs Attack Vector vs Attack Surface vs Attack Graph

These four terms describe different layers of the same problem, and attack path analysis connects them.

Term	What It Is	Question It Answers
Attack vector	The method or entry point used to get in, such as phishing or an exploited service	How does an attacker get in?
Attack surface	The sum of all vectors across the environment	Where can an attacker get in?
Attack path	The chained route from an entry point to a critical asset	Where does an attacker go next?
Attack graph	The model of all possible paths across the environment	Which routes exist, and which matter most?

The external attack surface defines where an outsider starts, each attack path is one route through the environment, and an attack graph holds every route at once so analysis can rank them.

Why Attack Path Analysis Matters

Most findings never become part of a real attack. Research behind FIRST's Exploit Prediction Scoring System found that only 2% to 7% of published vulnerabilities are ever observed exploited in the wild.

Organizations remediate only a fraction of their open findings each month, so picking the right fraction decides the outcome.

Severity scores (CVSS) alone cannot resolve which fraction to pick. A critical CVE on an isolated test server matters less than a medium-severity flaw on an internet-facing host holding credentials for a privileged account, and only path context reveals the difference.

Focuses remediation: Directs effort to the findings that sit on real routes to critical assets instead of to the longest list.
Breaks attacks before execution: Identifies routes in advance, so teams close them before an operator walks them.
Exposes identity risk: Surfaces permission chains and trust relationships that vulnerability scanners never report.
Explains risk to leadership: Turns technical exposure into a visual route that ends at a named business asset.
Measures control value: Shows how many paths a given control, such as MFA or segmentation, removes from the graph.

How Attack Path Analysis Works

Attack path analysis runs through four stages: discovery, graph mapping, path identification, and prioritization, repeated as the environment changes.

Stage 1: Discover Assets and Exposures

Discovery inventories assets, identities, configurations, and data across on-premises, cloud, identity, and external environments. Each resource is then assessed for vulnerabilities, exposed secrets, misconfigurations, and excessive permissions.

Data completeness sets the ceiling on everything that follows. Unknown internet-facing assets, unmanaged identities, and third-party connections that never reach the inventory become blind spots in the graph.

Stage 2: Map Relationships as a Graph

Findings become nodes, and relationships become edges: this host reaches that service, this user belongs to that group, this role can assume that one, this server caches that credential.

Edges map to attacker techniques in the MITRE ATT&CK framework, which keeps each step grounded in observed behavior.

Stage 3: Identify Viable Attack Paths

Graph traversal finds every sequence of edges that connects an entry point to a crown jewel. Shortest-path and reachability queries answer which assets an attacker reaches from a given foothold, and how many steps each route takes.

Stage 4: Prioritize High-Risk Paths

Prioritization ranks paths by target value, number of steps, privilege gained, exploitability, and evidence of active exploitation. Exploitation evidence from threat intelligence separates a theoretical edge from one attackers use today, which is where threat analysis feeds the model.

Continuous re-analysis keeps that ranking accurate as the environment shifts. A new deployment, a permission change, or a newly exploited CVE opens paths that did not exist in last month's graph.

Choke Points in Attack Path Analysis

A choke point is a node or edge that many attack paths share on the way to critical assets. Fixing it breaks every path that runs through it.

Graph analysis finds choke points through convergence: the nodes with the most paths passing through them, measured by metrics such as betweenness centrality. Common examples include an over-permissioned service account, a server where administrators log in, and a group granting broad write rights.

Choke points repay defensive attention in two separate ways. Remediation there removes many routes with a single change, and concentrated logging there catches attacker movement that scattered monitoring misses.

Identity-Driven Attack Paths

Identity relationships create attack paths that vulnerability scanners never report, because every account, group, role, and session is a potential edge.

The joint ASD, CISA, and NSA guidance on detecting and mitigating Active Directory compromises catalogs 17 common techniques and attributes Active Directory's exposure to permissive defaults, complex permission relationships, and legacy protocol support.

Credential reuse paths: Hashes and tickets harvested with tools such as Mimikatz authenticate to every host where the same account holds rights.
Delegation and ACL abuse: Write permissions on user or group objects let an attacker add themselves to privileged groups.
Replication rights: Accounts able to request directory replication extract every password hash in the domain.
Certificate services abuse: Misconfigured certificate templates let a low-privilege user request a certificate that authenticates as an administrator.
Cloud role chaining: Service principals and IAM roles that can assume other roles create multi-step paths into production cloud accounts.

Open-source identity graph tools such as BloodHound map these relationships directly, and defenders run them for the same reason attackers do. The shortest route to domain administrator is rarely obvious from a permissions spreadsheet.

Attack Path Analysis Example

Three moderate findings in a cloud environment show how analysis surfaces a route that isolated scanning misses.

A public-facing workload: A virtual machine with a public IP address runs an unpatched, exploitable service.
An over-privileged identity: A service account attached to that machine holds far broader permissions than its function requires.
A reachable data store: A sensitive database trusts that identity for access.

Scanned individually, each finding ranks as moderate on a severity scale. Connected, they form a complete route: exploit the workload, assume the identity, read the database. The over-privileged identity is the choke point, since reducing its permissions breaks the path even before the service is patched.

Attack Path Analysis in Practice: A Real Supply Chain Route

Some of the most damaging attack paths begin outside the organization entirely. CloudSEK's investigation of the LiteLLM supply chain breach traced one such route through AI infrastructure in 2026.

Upstream compromise: The TeamPCP group compromised a widely used open-source security scanner and its automation, obtaining publishing credentials for the LiteLLM AI gateway project.
Poisoned release: Two malicious LiteLLM versions went live on the Python Package Index for roughly 40 minutes in March 2026.
Pipeline execution: CI/CD jobs that pulled the package ran the malicious code with access to environment variables, process memory, and cloud instance metadata.
Credential harvest: Cloud, Kubernetes, source-control, registry, and AI provider credentials reachable from those jobs were exposed.
Downstream access: Every harvested credential became a new entry point into the environments it unlocked, long after the package was removed.

CloudSEK reconstructed exposure across more than 2,500 organizations and about 434,000 CI/CD pipelines, while cautioning that the figures describe potential credential exposure, not confirmed compromise at each organization.

Junctions carry the path analysis lesson here. An AI gateway holding credentials for many systems acts as a choke point in AI supply chain security.

Short-lived, narrowly scoped workload credentials remove the edges that turned one poisoned package into access across thousands of software supply chains.

How Agentic AI Is Changing Attack Path Discovery

Mapping an environment used to take an intrusion team days of manual reconnaissance. AI agents now compress that work into automated loops that enumerate assets, test credentials, and pursue the next hop without waiting for a human.

MITRE ATT&CK now catalogs the first documented case as Campaign C0062. A China-nexus espionage actor used an AI coding agent to run reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and exfiltration against roughly 30 organizations.

Anthropic, whose Claude Code agent the attackers manipulated, reported that the AI executed 80% to 90% of tactical operations, with human operators approving progress at a handful of decision points. The same report noted the agent hallucinated credentials in some cases, a limit that slowed but did not stop the campaign.

Defenders now face the same graph at machine speed, with less warning. Paths that once took an operator weeks to find surface in hours, which moves the value of attack path analysis from periodic assessment to continuous discovery.

Attack Path Analysis Use Cases

Protecting sensitive data: Showing every direct and indirect route to a regulated data store before an auditor or attacker finds one.
Prioritizing remediation: Ranking findings by their position on real paths instead of by severity score.
Reducing alert noise: Filtering out findings that lead nowhere, which shortens triage for a SOC.
Hardening identity: Finding the shortest routes to domain and cloud administrator rights, then removing the permissions that create them.
Validating architecture changes: Checking whether a migration, merger, or zero trust rollout removed the paths it was meant to remove.
Supporting compliance: Documenting how controls protect regulated assets, which feeds risk assessments under an information security management system

Attack Path Analysis Tools and Techniques

Attack graph platforms: Build a consolidated graph of assets, exposures, and relationships across hybrid environments and rank routes to critical assets.
Cloud-native application protection platforms: Map workloads, identities, permissions, and configurations to find paths inside cloud accounts.
Identity graph tools: Model users, groups, sessions, and privileges to expose escalation and lateral movement routes in directory services.
Exposure management programs: Fold attack path results into continuous threat exposure management cycles for prioritization and tracking.
Breach and attack simulation and automated penetration testing: Execute attacker techniques safely to confirm whether a mapped path is exploitable.
Outside-in path analysis: Start from external exposure and threat intelligence, then trace how initial access vectors chain toward internal targets.

Attack Path Analysis vs Related Methods

Versus vulnerability scanning: Scanning lists isolated flaws, while attack path analysis shows how those flaws chain into routes.
Versus threat modeling: Threat modeling reasons about a system's design before deployment, while attack path analysis maps the routes present in the live environment.
Versus penetration testing: A penetration test proves one route at one point in time, while attack path analysis maps all known routes continuously.
Versus red teaming: Red teams emulate a specific adversary end to end, and attack path analysis tells them which routes deserve that effort.

Limits of Attack Path Analysis

Incomplete inventories: Assets missing from the data never appear in the graph, so routes that start on unknown systems never surface.
Stale snapshots: Environments change daily, and a graph built last quarter misses routes opened since.
Theoretical edges: A mapped path is not proof of exploitability until testing or threat evidence confirms each step.
Human entry points: Phishing, voice pretexting, and help desk fraud create entry points that configuration data never shows.
External blind spots: Internally built graphs start at the perimeter and miss credentials, exposures, and supplier access that exist only outside it.

Most of these limits trace back to incomplete or internal-only data. Pairing internal graphs with external exposure, credential, and adversary intelligence closes the gap where many real intrusions begin, including those run by advanced persistent threat groups.

Attack Path Analysis FAQs

How often should attack path analysis run?

Continuously, with re-analysis after significant changes such as new deployments, permission updates, acquisitions, or newly exploited vulnerabilities.

What is blast radius in attack path analysis?

Blast radius is the set of assets an attacker reaches from a single compromised node, used to estimate the impact of one foothold.

Does attack path analysis require agents?

No. Most tools build graphs from APIs, directory queries, cloud configurations, and scan data, though some add endpoint agents for session and credential data.

Can attack path analysis work without a complete CMDB?

Yes, with reduced accuracy. External discovery and cloud APIs fill gaps, and missing assets remain the largest source of blind spots.

How does an attack path differ from a kill chain?

A kill chain describes the generic stages of an intrusion. An attack path is a specific route through one organization's assets and relationships.

Who runs attack path analysis in an organization?

Vulnerability management, exposure management, identity, and cloud security teams run it, and red teams and SOC analysts consume the results.

Attack Path Analysis With CloudSEK Nexus AI

Most attack path analysis starts inside the network and works outward from the inventory. CloudSEK starts from the other end, with the initial access vectors that exist before an attacker touches internal systems.

CloudSEK Nexus AI correlates signals from digital risk, threat actor activity, the external attack surface, AI systems, and third-party ecosystems into a unified attack graph. It shows how a leaked credential, an exposed asset, or a supplier compromise chains toward critical assets, and ranks each path by exploitability and attacker behavior.

Working from external exposure changes when paths become visible. Routes surface while they are still reconnaissance targets, and the choke point that breaks the most routes gets fixed before any of them are exploited.