What is Attack Path Mapping?

A traditional vulnerability scan answers the question 'what is wrong?' and hands you a list of issues, each rated in isolation. Attack path mapping answers the far more useful question 'what can an attacker do with these together?' It models how a foothold on an internet-facing asset connects to the next hop, and the next, until the chain terminates at something a defender cares about: a customer database, an admin console, a cloud identity with broad permissions. The unit of analysis is the path, not the single finding.

The reason chaining matters is that real intrusions rarely rely on one catastrophic bug. As frameworks like Lockheed Martin's Cyber Kill Chain and MITRE ATT&CK document, adversaries progress through phases, reconnaissance, initial access, execution, credential access, lateral movement, and impact, where each technique sets up the next. A path might read: an exposed .env file leaks a database connection string; those credentials authenticate to an internet-reachable database; the database holds session tokens that unlock an admin panel. None of those three is necessarily a 'critical' on its own, yet together they form a clean route from the open internet to full compromise.

This is where the concept of a 'toxic combination' comes in. Two or three medium-severity exposures can multiply into a high-severity path because the existence of one makes exploiting the next trivial. Attack path mapping makes those multipliers visible. It also exposes choke points: a single node, such as a shared dangling DNS record or one over-permissioned credential, that appears in many paths. Fixing the choke point collapses dozens of paths at once, which is why path-aware remediation is dramatically more efficient than burning down a CVSS-sorted backlog top to bottom.

It is worth differentiating attack path mapping from neighbouring ideas. An attack surface is the full set of points where an attacker could attempt entry; attack path mapping is what happens after entry, tracing movement through that surface. An attack graph is the underlying data structure, the nodes (assets, credentials, exposures) and edges (the moves between them) that a path traverses. A kill chain or ATT&CK matrix is the behavioral vocabulary that labels each move. Attack path mapping is the applied methodology that consumes validated findings and produces concrete, prioritized routes a defender can act on. Crucially, it only works on findings that have been validated; mapping a path through a false positive produces a fictional risk, which is why proof of exploitability must come before path construction.