Home / Knowledge hub / Attack path
Knowledge hub
Attack path
A chain of small steps that together take an attacker to something valuable.
What it means
An attack path is the sequence of steps an attacker takes from a starting point to a goal, such as customer records or admin control. Each step may be small: an exposed endpoint, a leaked token, a weak permission. Taken one by one they look minor. Chained, they reach somewhere serious.
Think of it as a route rather than a door. The question is not whether one flaw is bad, but where the flaw leads. MITRE ATT&CK describes attacker behaviour as tactics and techniques, which is a common way to describe each step along the route.
Why it matters
Scoring flaws one at a time hides the real risk. A medium-rated information leak that reveals an internal ID, plus a medium-rated missing check on that ID, can add up to a full exposure of other customers' data. Neither line in a report looks urgent. Together they are.
Looking at paths also tells you where to cut. Closing one step in the middle can protect the goal even if other flaws remain. This is the idea behind defence in depth and the reason testers record chained vulnerabilities rather than a flat list.
How it shows up
Typical paths in web applications start with something visible: an unauthenticated API, a debug page, a public storage bucket. The next step uses what that gave away, then a permission that is too wide reaches the data. Cloud paths often run through a service account or an overly broad role.
Teams miss paths because each owner looks only at their own component. The fix is to test the running system end to end and to ask what each finding makes possible. Record the whole chain with its evidence, so the fixer sees which single change breaks it.
Questions people ask
Attack path, answered
What is the difference between an attack path and an attack surface?
The attack surface is everything an outsider can touch. An attack path is a specific route through it that leads to a goal.
The surface is the map. A path is one journey across it.
Why do low-severity findings matter in a path?
Because a low-severity flaw can supply the one piece the next step needs, such as an internal ID or a valid session. Alone it looks harmless.
Chains are where low and medium findings become serious.
How do you find attack paths?
By testing the running system and following each result into the next step, as an attacker would. Static lists of flaws do not show chains.
Reading the code alongside the running app helps explain why each step works.
Do attack paths only exist inside a network?
No. They exist in web applications and APIs too, where a chain might run from a public endpoint to another customer's records.
The principle is the same: small steps leading to something valuable.
How do I break an attack path?
Fix the step that is cheapest and most certain to remove the route, usually a missing check or an exposed secret. You do not need to fix every step.
Then confirm by repeating the chain against the fixed system.
Sources
Where this comes from
Related
Terms that sit next to this one
Chained vulnerabilities
Several smaller flaws combined to produce a much bigger impact than any alone.
Attack surface
Everything about your application an outsider can touch.
Lateral movement
Moving from the first thing reached to the things worth taking.
Privilege escalation
Gaining rights you were never given, sideways or upwards.
Threat model
Asking what is worth taking, who wants it, and how they would try.
Where do small flaws lead?
We check business-logic flaws and cross-account access, and when findings chain, the proof shows each step with its request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.