A representation of how different users, roles, and resources connect across an application workflow. It helps testers identify where one actor can reach another actor’s context, which is especially important in tenant-isolated or approval-based systems.
Expanded Definition
A multi-user attack graph is a security analysis model that maps how one user’s permissions, session state, workflow position, or shared resource access can be leveraged to reach another user’s data, actions, or approval context. In application security, it is most useful where the system design allows indirect movement across user boundaries, such as shared queues, delegated approvals, tenant-scoped objects, admin consoles, or weakly isolated collaboration features. Unlike a generic attack tree, which often focuses on a single adversary goal, a multi-user attack graph highlights relationship paths between actors and the conditions that make cross-user impact possible.
Usage in the industry is still evolving. Some teams use the term narrowly for graph-based test models, while others apply it to broader privilege propagation analysis across workflows and identities. NHI Management Group treats it as a practical abstraction for finding cross-identity exposure before an attacker, insider, or compromised account can chain access through the application. For threat-informed validation, teams often compare these paths with the MITRE ATT&CK Enterprise Matrix to understand where exploitation or lateral movement patterns may appear in real environments. The most common misapplication is treating it as a static role map, which occurs when teams ignore session changes, workflow handoffs, and shared object relationships that actually enable cross-user reach.
Examples and Use Cases
Implementing multi-user attack graph analysis rigorously often introduces modelling overhead, requiring organisations to weigh deeper coverage against the time needed to represent workflows, roles, and state transitions accurately.
- A support platform where one agent can view or edit another agent’s tickets after assignment changes, creating a path from low-privilege access to sensitive case data.
- An approval workflow where a compromised requester account can trigger actions that affect approvers, reviewers, or downstream records in a shared queue.
- A multi-tenant SaaS application where weak object scoping allows a user in one tenant to reach a resource identifier from another tenant through predictable references.
- An identity-admin console where delegated administrators can chain permissions across groups, roles, and service accounts if controls are not validated against NIST SP 800-53 Rev 5 Security and Privacy Controls.
- An AI-assisted workflow where an agent can submit or route actions on behalf of multiple users, creating a cross-user risk pattern that should also be compared with the MITRE ATLAS adversarial AI threat matrix when the workflow includes model-driven decision points.
These examples are most valuable when test teams model not just endpoints, but the whole chain of user context, authorization checks, and shared state. Where application behaviour changes by role, tenant, or approval stage, the graph helps reveal whether a single compromised identity can traverse boundaries that should remain separate.
Why It Matters for Security Teams
Multi-user attack graphs matter because many real breaches are not caused by a single broken control, but by a sequence of individually acceptable actions that become dangerous when linked together. Security teams use this lens to spot privilege escalation, cross-tenant exposure, unintended delegation, and workflow abuse before attackers do. That makes it especially relevant for applications with complex business logic, shared inboxes, approval chains, and identity-aware automation.
The identity connection is direct: the graph only becomes meaningful when users, roles, service identities, or agentic actors can influence one another’s context. In environments with NHI, API tokens, or delegated agents, the risk often lies in how non-human identities inherit or relay access across workflows, not just in whether a login is valid. Teams that rely only on perimeter checks or role lists can miss the path an attacker uses to move from one account context to another. Guidance from CISA cyber threat advisories and reporting such as Anthropic — first AI-orchestrated cyber espionage campaign report reinforces how quickly chained access and tool use can amplify impact. Organisations typically encounter the full importance of a multi-user attack graph only after a shared workflow is abused or a cross-account incident exposes how far one compromised identity could travel, at which point remediation becomes operationally unavoidable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | Identity and access control govern who can reach shared contexts in this graph. |
| NIST SP 800-53 Rev 5 | AC-2 | Account management controls define who may use or inherit access in shared workflows. |
Map graph paths to access control gaps and tighten authorization boundaries across workflows.
Related resources from NHI Mgmt Group
- How should security teams implement cloud user access reviews across SaaS and multi-cloud environments?
- Who should own tenant-level user governance in a multi-brand B2B platform?
- How should teams use multi-hop relationships in a knowledge graph for governance decisions?
- Why do multi-identity workflows expose gaps that single-user testing misses?
