Definition
An attack path is the chain of steps an attacker can follow from a first point of entry to a valuable target, using one weakness after another, such as a vulnerability, a stolen credential or an overly broad permission.
What an attack path is
An attack path is the sequence of steps an attacker can take to move from a first point of entry to something valuable, such as a domain admin account, a customer database or a production system. Each step uses one weakness to reach the next: a vulnerability, a misconfiguration, a reused password or an overly broad permission.
Attackers rarely get what they want in one move. They get a foothold, look around, collect credentials and keep going. The attack path is the map of that journey.
An example attack path
A typical path through a company network might look like this:
- Initial access: an internet-facing VPN appliance has a known vulnerability that was never patched.
- Foothold: the attacker gets a session on the internal network.
- Credential access: a script on a file share contains a service account password in plain text.
- Lateral movement: the service account has local admin rights on dozens of servers.
- Privilege escalation: one of those servers has a cached domain admin session.
- Objective: with domain admin rights, the attacker can reach the customer database and the backups.
On its own, none of these issues may look critical. Together they lead from the internet to the most sensitive data in the company.
Attack path vs attack vector vs attack surface
| Term | What it means | Example |
|---|---|---|
| Attack surface | All the possible points of entry | Every exposed service, app and account |
| Attack vector | One specific way in | An unpatched VPN |
| Attack path | The chain of steps from entry to a target | VPN flaw → service account → domain admin → database |
The attack vector is where the path starts. The attack path is everything that happens after.
Why attack paths matter more than single findings
Most vulnerability reports rank issues one by one, by severity score. Attack paths show something those lists miss:
- Low-severity issues can chain into a critical risk. A medium vulnerability plus a weak permission plus a stored password can add up to full compromise.
- Not every critical finding is reachable. A high CVSS score on a system no attacker can reach may be less urgent than a medium one on the path to your crown jewels.
- Fixing one step can break the whole path. Removing a single choke point, such as an overprivileged account, can protect many targets at once.
This is why security teams increasingly prioritise by attack path and exploitability rather than by severity score alone.
Attack path analysis
Attack path analysis is the process of finding and mapping the routes an attacker could take through an environment. It usually looks at:
- Entry points: exposed services, applications, accounts and devices
- Weaknesses: vulnerabilities, misconfigurations and weak or reused credentials
- Relationships: network access, trust between systems, group memberships and permissions, especially in Active Directory and cloud identity
- Targets: the critical assets an attacker would want to reach
- Choke points: the steps that many paths have in common, where one fix has the biggest effect
Some tools build attack graphs from configuration data and show paths that could exist. Penetration testing goes further and tries to follow them, which shows which paths an attacker can actually walk.
How to break attack paths
- Identify your critical assets so you know which paths matter most.
- Map the paths that lead to them, starting from internet-facing systems.
- Fix the choke points first: overprivileged accounts, shared local admin passwords and stored credentials.
- Patch reachable vulnerabilities, starting with those on a path to a critical asset.
- Segment networks and limit trust between systems, so one compromise does not lead everywhere.
- Watch for lateral movement with monitoring that can spot unusual logins and access.
- Re-test after fixes to confirm the path is really closed and no new one has opened.
How Plainsea helps
Plainsea does not stop at a list of individual findings. AI agents try to exploit what they find within the scope you set and chain weaknesses together, the way a real attacker would, to show how far each foothold goes. Findings are confirmed exploitable and shown with the path behind them, so your team can fix the step that breaks the chain and re-test it on demand.