Attack Path Analysis vs Attack Surface Management: What Is Exposed vs What Is Reachable

Attack surface management tells you what an outsider can see and touch, attack path analysis tells you where an intruder can go once they are in, and teams that run only one of them end up either fixing exposures that lead nowhere or modelling internal paths that start from doors nobody has inventoried. The two disciplines look at the same estate from opposite ends. Attack surface management (ASM) works outside in: it discovers internet-facing assets, services, certificates and leaked credentials, many of which the organisation did not know it owned. Attack path analysis (APA) works inside out: it builds a graph of hosts, identities, permissions and sessions and asks which chains of weaknesses connect a starting point to a critical asset. This guide compares them, with attention to non-human identity (NHI) edges, and shows how each output should feed the other. For the ASM programme itself see the Attack Surface Management Guide; for how path findings reorder a patch queue see Attack Path Management vs Vulnerability Management.

Key takeaways

• Different questions. ASM answers "what do we expose, and do we know about all of it?"; APA answers "from a realistic foothold, what can an attacker reach, and through which relationships?"
• Different data. ASM relies on outside-in sources such as DNS, certificate records, IP ranges and internet scanning; APA relies on inside data such as directory objects, group membership, ACLs, cloud role assignments, application permissions and sessions.
• Identity joins them. A leaked API key, an exposed admin console or a forgotten test tenant is an ASM finding and also the first node of an attack path; the value of either finding depends on what that identity can reach.
• Each one prioritises the other. ASM should supply APA with real entry points instead of the assumption that "any user" is the start; APA should tell ASM which exposures sit on a path to crown jewels, so they are fixed first.
• CTEM is the frame, not a third tool. In Gartner's continuous threat exposure management model, ASM does most of the scoping and discovery work and APA does much of the prioritisation and validation work, joined by one critical asset list.

The short answer

Run attack surface management to keep a complete, current inventory of everything reachable from the internet and to remove what should not be there: unmanaged hosts, exposed management interfaces, dangling DNS, expired or rogue certificates, and credentials published in code or paste sites. Run attack path analysis to understand what happens after a foothold, especially in directories and cloud tenants where permissions, group nesting, application credentials and cached sessions form routes that no scanner reports. Small, cloud-first organisations can start with ASM plus a quarterly review of admin roles and OAuth grants; larger or hybrid estates need both, joined. Neither replaces vulnerability management.

Side by side

Attack surface management in depth

Threat model. ASM assumes the attacker starts with nothing but the internet and does reconnaissance: scanning address space (ATT&CK T1595 Active Scanning, including T1595.002 Vulnerability Scanning), querying open technical databases such as DNS and certificate records (T1596 Search Open Technical Databases), and collecting network information (T1590 Gather Victim Network Information). The attacker then uses what is exposed: a vulnerable public application (T1190 Exploit Public-Facing Application), a remote access service (T1133 External Remote Services) or a valid account found in a leak (T1078 Valid Accounts).

Architecture in words. Seeds (registered domains, known IP ranges, cloud accounts, brand names) feed discovery: passive DNS, certificate records, WHOIS and registration data, cloud provider inventories and active scanning of the discovered ranges. Discovered assets are attributed to an owner or flagged as unknown, enriched with service fingerprints and known vulnerabilities, and pushed to a ticketing workflow. The NCSC's asset management guidance widens the scope beyond hosts to social media accounts, domain registrations, IP ranges and digital certificates, and recommends combining active sources such as scanning with passive ones such as DNS logs.

Cadence matters. CISA's BOD 23-01 sets a useful public benchmark for federal agencies: automated asset discovery every 7 days covering at least the agency's IPv4 space, and vulnerability enumeration across discovered assets every 14 days. An ASM programme that refreshes monthly will miss assets that exist for days.

Where identity enters ASM. A large share of high-value ASM findings are identity material rather than hosts: API keys and tokens in public repositories, exposed CI/CD consoles, login pages for SaaS tenants nobody registered with IT, and test tenants without MFA. ASM can say a credential is exposed, not what it can do. See the ASM vs Identity Attack Surface Management comparison for that boundary.

Attack path analysis in depth

Threat model. APA assumes the attacker already holds a foothold, often a valid account, and moves through relationships: enumerating domain groups (T1069.002 Domain Groups) and trusts (T1482 Domain Trust Discovery), harvesting credentials from hosts where privileged accounts are signed in, requesting password data with directory replication rights (T1003.006 DCSync), stealing or adding application credentials in a cloud tenant (T1528 Steal Application Access Token, T1098.001 Additional Cloud Credentials) and reusing tokens to move between services (T1550.001 Application Access Token). Few of these steps involve a CVE.

Architecture in words. Collectors with read access pull directory objects, ACLs, delegation settings, group nesting and local administrator membership from hosts, plus session data; cloud collectors pull role assignments, app registrations, service principal credentials and API permissions. A graph engine turns each relationship into a directed edge. BloodHound's documentation describes this model plainly: nodes are objects such as users and groups, edges are the relationships between them, and the direction of an edge shows the direction of attack or privilege. Analysts then define starting sets and targets and query for paths and the nodes most paths cross.

Entry points and targets decide the answer. Microsoft's Security Exposure Management documentation describes attack paths as end-to-end routes from an entry point to critical assets, choke points as nodes "where attack paths converge", and blast radius as how the compromise of one asset could affect others. It also warns that attack paths "might not be fully representative" if critical assets have not been fully defined. That caveat applies to every APA tool.

Non-human edges. Service accounts, service principals, managed identities, CI/CD tokens and OAuth applications are frequent path nodes because they hold standing, broad and rarely reviewed rights. A path that runs from an exposed build server, through a pipeline token, to a cloud role that can write to production is common and invisible to host scanners. See the Identity Attack Paths Guide.

How the outputs feed each other

The two disciplines are most valuable when their outputs are wired together, not compared. Four hand-offs carry most of the value:

1. ASM exposures become APA entry points. Every confirmed external exposure that grants code execution or authentication (a vulnerable gateway, a leaked key, an unprotected admin console, a tenant without MFA) is added to the graph as a starting node. Paths are then computed from real doors rather than from "all users".
2. APA reach ranks ASM findings. Each exposure gets an attribute: no known path, path to non-critical assets, or path to a critical asset with hop count. An exposed host with a path to the identity tier goes to the top of the queue; an isolated marketing site with an old library does not.
3. Exposed credentials are resolved to permissions. When ASM finds a key or token, the identity team resolves it to its principal and its effective rights before deciding urgency. A read-only key to a public dataset and a key that can create users are not the same finding, though they look identical in a repository.
4. Choke points drive exposure rules. If APA shows that a particular server class or identity sits on many paths, ASM gets a rule: any external exposure of that class is an immediate alert.

Where each one breaks

The Microsoft Midnight Blizzard Breach shows why the two must meet. The entry was a password spray (T1110.003 Password Spraying) against an account in a legacy, non-production test tenant without MFA: an asset an attack surface inventory should hold and flag. The impact came from a path: a legacy test OAuth application in that tenant held elevated access to the corporate environment, which led to mailbox access. Either discipline alone saw half of it.

Controls each discipline needs

Attack surface management

• Complete seeds: registered domains, IP allocations, cloud accounts and subscriptions, SaaS tenants, code organisations and brand names, refreshed from procurement and finance data.
• Exposure policy: management interfaces never directly reachable from the internet, in line with CISA BOD 23-02 for federal agencies; remote access only through hardened, MFA-protected gateways. See the Subdomain Takeover and Dangling DNS Guide for DNS hygiene.
• Credential monitoring: public code, packages and paste sites watched for organisational secrets, with automatic revocation where the provider supports it. See Secrets Scanning vs Secrets Management.
• Ownership: every discovered asset attributed to a named owner within a set number of days or scheduled for removal.

Attack path analysis

• Critical asset list: business-owned, including identity Tier 0 (directory controllers, federation and synchronisation servers, roles that can grant any role) and the APA platform itself.
• Edge coverage statement: which relationship types are collected for each directory, cloud and SaaS platform, and which are not.
• Least privilege at source: remove non-default ACLs on privileged objects, flatten nested privileged groups, scope service principal and managed identity roles (NIST SP 800-53 AC-6).
• NHI ownership: every service account, service principal and pipeline identity on a path has an owner and a review date. See the Service Account Security Guide.

Where CTEM ties them together

Gartner's CTEM model has five stages: scoping, discovery, prioritisation, validation and mobilisation. Gartner warns that "the volume of discovered assets and vulnerabilities is not success in and of itself" and describes validation as confirming exploitability and analysing all potential attack paths to an asset. The mapping is direct:

The Exposure Management and CTEM Guide covers the full cycle; CAASM vs CTEM covers the internal asset inventory that sits alongside ASM.

Worked scenario

A retailer with a hybrid directory synchronised to a cloud tenant, around 200 public domains after two acquisitions, and an external ASM service already running.

1. ASM output: 3,400 open external findings. Three stand out only after correlation: a build server from an acquired company exposed on a cloud IP, a staging tenant with password-only sign-in, and a cloud access key in a public repository owned by a former contractor.
2. Import as entry points: the three are added to the attack path graph as starting nodes alongside the default "all users" set.
3. Path results: the build server holds a deployment token whose service principal can assign roles in the production subscription: two hops to a critical asset. The staging tenant has a multi-tenant application consented in production with mail read permission. The leaked key resolves to a role that can read only a public bucket.
4. Prioritise: build server and staging tenant go to emergency change; the leaked key is revoked and rotated as normal hygiene, without paging anyone at night.
5. Fix: the build server is moved behind the access proxy, the deployment token is rotated and its role scoped to one resource group, the cross-tenant consent is removed, and the staging tenant gets MFA.
6. Validate and harden: re-collection shows no path from the three entry points to critical assets. ASM now alerts on any exposed build infrastructure.

The numbers are illustrative; the pattern, two findings carrying most of the risk and neither rankable alone, is common.

Decision criteria

Detection and measurement

• Log: new public DNS records and certificates for your domains, newly exposed services, secrets detected in public code, sign-ins to non-production tenants, new role assignments and application credentials for NHIs, and membership changes to choke point groups.

Framework mapping

Common failure patterns

• Buying one and calling it exposure management. An ASM feed alone reports doors without saying which lead anywhere; an APA graph alone reports routes from assumed doors.
• Treating leaked credentials as host findings. A key in a public repository is an identity incident; it needs revocation, rotation and a check of audit logs, as the Internet Archive Breach showed when unrotated keys from a code leak enabled a second intrusion weeks later.
• Ignoring non-production. Test tenants, staging environments and acquired estates fall outside both inventories and still hold rights in production.
• Using default targets. APA reports paths to generic admin groups while the payment platform has none, because nobody tagged it critical.
• No shared owner model. An exposed host holding a privileged token belongs to neither the ASM nor the identity queue.

Practitioner checklist

• Agree one critical asset list, including identity Tier 0 and the APA platform, used by both disciplines.
• Seed ASM from procurement, cloud billing, registrars and acquisitions, and refresh discovery at least weekly.
• Route every exposed credential to its identity owner with an effective-permission check before setting urgency.
• Import confirmed external exposures into the attack path graph as starting nodes.
• Add a "path to critical asset" attribute to every external finding and triage on it.
• Document which edge types the APA collectors model, including NHI, pipeline and SaaS OAuth edges.
• Bring non-production tenants and acquired environments into both inventories.
• Validate closed paths by re-collection or testing, and alert when removed edges return.

Standards and references

• CISA: BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks
• CISA: Cyber Hygiene Services
• NCSC: Asset management
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• Gartner: How to Manage Cybersecurity Threats, Not Episodes
• SpecterOps: BloodHound edges overview
• Microsoft Learn: Review attack paths in Security Exposure Management

Related NHI Mgmt Group resources: Attack Surface Management Guide, Attack Path Management vs Vulnerability Management, Identity Attack Paths Guide, Exposure Management and CTEM Guide, NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments.