How potential attack paths are detected

Attack Path Prediction uses threat detection, behavior analysis, vulnerability and misconfiguration scanning and asset relationships and profile analysis to predict potential attack paths. Generative AI helps determine the assets most likely to be used as entry points, which assets are likely targets, what specific path an attacker may take, and the steps needed to remediate the assets. All attack paths must contain:

• A potential threat source
• Vulnerable assets
• A potential path for lateral movement
• Assets likely to be targeted

To learn more, see Attack path components.

Below is an example of a potential attack path detected by Attack Path Prediction.

1. Threat source and potential lateral movement path:
   1. A server on the network is exposed to the internet and contains a known vulnerability and a misconfiguration.
   2. An "administrator" user has a relationship with the server allowing the user to sign in to the system.
   3. The "administrator" user is assigned the "global admin" role, allowing the user full system privileges.
   4. The global admin role can view and edit a highly critical user account.
2. Likely attack path:
   1. Attackers access the server from the internet and exploit the vulnerability to gain network access.
   2. The attackers use the administrator credentials to sign in and assume the "global admin" role.
   3. With full system privileges, the attackers can compromise the critical user account and potentially steal data or move deeper into the network.
3. Remediation steps:
   1. Patch the vulnerability on the server and update the system.
   2. Configure proper access controls on the server.
   3. Enable multi-factor authentication for accounts and enforce least-privilege access.
   4. Monitor user roles and permissions to prevent unauthorized escalation of privileges.