An attack path is a sequence of relationships, permissions, weaknesses, credentials, trust links, or configurations that may allow an attacker or tester to move from an initial position toward a target objective. Attack paths can exist in Active Directory, cloud identity systems, SaaS platforms, networks, applications, and combinations of those environments.
What Makes a Path
A path is not merely one vulnerability. It is a chain. A user may have access to a workstation, that workstation may expose credentials, those credentials may have local administrator rights elsewhere, a group may have delegated directory permissions, and those permissions may reach sensitive systems. Each link may be low or moderate risk alone, but together they can create material exposure.
In cloud environments, attack paths may involve identity roles, app registrations, OAuth permissions, service principals, stale credentials, conditional-access exceptions, storage permissions, or cross-tenant trust. In Penetration Testing Services, mapping these relationships helps explain how practical risk emerges from system design.
Attack Paths and Privilege Escalation
Many attack paths include privilege escalation, but not all are purely privilege escalation. Some paths rely on excessive read access, external sharing, weak segmentation, credential reuse, exposed secrets, or business-logic access. The common element is reachability from one condition to a more sensitive outcome.
Investigative and Defensive Uses
Attack-path analysis can support penetration testing, purple-team work, incident response, identity hardening, and control validation. It can help prioritize remediation by showing which misconfigurations combine into realistic exposure. It can also help responders understand how an attacker may have moved after initial access.
Not Tied to One Tool
Tools can help visualize and calculate attack paths, but the concept is broader than any single product. Good analysis depends on accurate data, environmental context, validation, and careful interpretation. A graph may show a possible route; testing and evidence determine whether it is actually usable in the environment.
How Findings Should Be Reported
An attack-path finding should identify the starting condition, the links in the path, the target reached or potentially reachable, evidence supporting each link, and practical remediation. Clear recommendations may include removing stale privileges, correcting group nesting, reducing local administrator rights, hardening cloud roles, rotating exposed secrets, or enforcing stronger identity controls.