Guide / Attack paths, explained
Understand the connections behind the finding.
An attack path describes how connected conditions could lead to an unwanted outcome. For an assessment, its value comes from identifying which connections are supported by evidence, which require authorized testing, and which remain assumptions your team needs to resolve.
Read the path carefully
Starting point
An exposure supported by a source
Required connection
A condition linking exposure to consequence
Defined outcome
The business effect being investigated
Interruption point
A change addressing the relevant condition
A plausible connection needs its own evidence before it becomes a validated step.
01 / Guide
Describe a starting point and an outcome
A useful path has a defined beginning and a concrete consequence. The starting point might be a publicly exposed service or information that reveals an overlooked system. The outcome might concern access to an application or sensitive business data. Writing both down keeps the investigation focused and prevents a collection of unrelated observations from becoming an overstated risk narrative.
FIELD NOTES
- Identify the initial exposure with its supporting source.
- Describe the business function or information potentially affected.
- State the conditions that would need to connect the two.
02 / Guide
Mark the evidence on every connection
A path may combine confirmed observations and untested assumptions. Label each connection separately so the strength of one observation does not lend false confidence to the rest. Ownership confirmation, access checks, and business context can each change the interpretation. When a connection cannot be tested within scope, explain what is unknown and what additional evidence would resolve it.
FIELD NOTES
- Use explicit labels for observed, inferred, and untested connections.
- Distinguish asset association from confirmed ownership or access.
- Describe the missing evidence before requesting deeper validation.
03 / Guide
Use the path to choose a practical intervention
A connected view can reveal several places to reduce exposure. The team may remove an unnecessary public service, change an access boundary, or address a dependency. Compare those options with the asset owner and choose a change that interrupts the relevant condition. Then define a check that can establish whether the chosen intervention worked for that path.
FIELD NOTES
- Identify which condition each proposed change addresses.
- Consider operational dependencies before choosing the intervention.
- Retest the affected connection and record what remains outside coverage.