Attack Path Management vs Vulnerability Management: Prioritising Fixes by Reachability

Vulnerability management tells you which software flaws exist, attack path management tells you which weaknesses an attacker can actually chain to something you care about, and most organisations run the first while assuming it covers the second. The two programmes answer different questions, use different data and fail in different ways. This guide compares them as operating disciplines rather than tools: the threat model each one assumes, how each is built, where each breaks, and how to join them so that reachability changes the order in which the vulnerability queue is worked. It is written for vulnerability management leads, identity and Active Directory owners, and security architects deciding how to fund and combine the two. For the full CTEM cycle see the Exposure Management and CTEM Guide; for edge types inside a directory see the Identity Attack Paths Guide.

Key takeaways

• Different units of work. Vulnerability management (VM) works a list of findings, mostly CVEs on assets; attack path management (APM) works a graph of relationships, most of which are identity permissions with no CVE at all.
• Severity is not reachability. The CVSS v4.0 specification says organisational factors are outside the scope of CVSS, and FIRST says EPSS "should never be treated as a risk score". Neither tells you whether a flaw sits on a route to your critical assets.
• Choke points beat long lists. Choke points are the nodes where many attack paths converge; removing one edge that many paths share often retires more risk than a month of patching low-reachability findings.
• Each programme has a blind spot the other covers. VM misses misconfigured permissions, standing privilege and leaked credentials; APM is only as good as its graph and its definition of critical assets, and it rarely models every internet-facing CVE well.
• Combine them at the prioritisation step. Keep VM's coverage, SLAs and patch pipeline, and let attack path position move findings up or down the queue, with identity fixes routed to the teams that own directory and cloud permissions.

The short answer

Run vulnerability management for coverage and hygiene: every asset scanned, every known flaw recorded, patched within agreed windows, with KEV-listed issues handled first. Add attack path management when you need to decide which of thousands of open findings and permissions matter most, and when your realistic threat is an intruder who arrives with a valid account rather than an exploit. Small organisations can approximate APM with a free directory graph tool and a well-defined critical asset list; large or hybrid estates usually need it as a standing capability with named owners. Neither replaces the other: APM without VM leaves known exploitable flaws unpatched at the edge, and VM without APM leaves the identity routes that most intrusions actually use.

Side by side

Vulnerability management: threat model and architecture

Threat model. VM assumes the attacker exploits a known flaw in software you run: a public-facing application (ATT&CK T1190 Exploit Public-Facing Application), an outdated browser on an endpoint, an unpatched library in a container. The defence is to know every asset, know every flaw on it, and remove the flaw faster than attackers weaponise it. NIST SP 800-40 Rev. 4 frames patching as "a critical component of preventive maintenance", a normal cost of running technology rather than an emergency activity.

Architecture in words. An asset inventory feeds scanners and agents; scanners produce findings keyed by asset and CVE; enrichment adds CVSS, KEV status, EPSS and asset criticality; a ticketing integration assigns findings to owners with SLA due dates; a rescan closes them; exceptions go through a risk acceptance route. The NCSC's vulnerability management guidance puts the operating principles plainly: update by default, respond to active exploitation, know your assets, triage what updates cannot fix, and treat the decision not to update as "a senior-level risk decision".

How scoring works and where it stops.

• CVSS: the CVSS v4.0 specification notes that assessment providers such as NVD "typically provide only the Base Scores enumerated as CVSS-B", and that factors such as the consumer's own environment are "outside the scope of CVSS". Using CVSS-B alone ranks technical severity, not your risk.
• KEV: CISA adds a CVE only when there is "reliable evidence that the vulnerability has been actively exploited in the wild" and a clear remediation exists, and says organisations should use the catalogue "as an input to their vulnerability management prioritization framework".
• EPSS: estimates the probability of exploitation; FIRST states that it "relates only to the threat component" of risk and suggests combining it with CVSS, with high-severity, high-probability issues first.
• SSVC: CISA's decision tree uses exploitation status, technical impact, automatability, mission prevalence and public well-being impact to reach Track, Track*, Attend or Act. Mission prevalence is the nearest VM gets to context, and it is a judgement per asset class, not a path.

None of these inputs asks whether the vulnerable asset can be reached from where an attacker is likely to start, or what it leads to. That is the gap APM fills. The Vulnerability Prioritisation Guide covers the scoring signals in depth.

Attack path management: threat model and architecture

Threat model. APM assumes the attacker already has a foothold, usually a valid account (T1078 Valid Accounts) from phishing, credential stuffing or a leaked secret, and then walks relationships: enumerating groups (T1069.002 Domain Groups) and trusts (T1482 Domain Trust Discovery), abusing permissions, harvesting credentials from hosts where privileged accounts are signed in, adding credentials to cloud applications (T1098.001 Additional Cloud Credentials) or requesting password hashes with directory replication rights (T1003.006 DCSync). None of these steps needs a CVE.

Architecture in words. Collectors read the directory (objects, group membership, ACLs, GPO links, delegation settings), hosts (local administrators, active sessions), cloud identity (roles, app registrations, service principal credentials, API permissions) and, in broader tools, network reachability and VM findings. A graph engine turns each relationship into a typed edge. Analysts define starting sets (all users, internet-facing hosts, a phished user) and targets (critical assets), then query paths between them and rank the nodes most paths cross.

Choke points and blast radius. Exposure management documentation describes choke points as nodes that create bottlenecks where attack paths converge, and blast radius as how the compromise of one asset could affect others. The operating idea is general: a help desk group with reset rights over a privileged OU, or a server where domain administrators sign in daily, may sit on thousands of paths. Removing that one edge is the highest-value fix in the graph. The BloodHound and Active Directory Attack Path Guide covers how open-source graph analysis is run against a directory.

Critical assets define the answer. Product documentation for exposure management platforms warns that attack paths may not be fully representative when critical assets are not fully defined. Typical predefined classifications cover domain controllers, privileged directory roles, databases holding sensitive data and cloud resources, with custom classifications for an organisation's own crown jewels. Every APM tool inherits this dependency: the list of targets you give it decides which paths it reports.

Where each one breaks

Two live incidents show the split. In the Change Healthcare Breach 2024, the entry was a stolen credential on a remote access portal without MFA, followed by days of movement: no CVE in the opening step, so a pure VM view would not have ranked it. In CitrixBleed 2 (CVE-2025-5777), a memory overread in an internet-facing gateway leaked live session tokens, and the vendor advised terminating active sessions after upgrading: a VM problem first, but one whose blast radius was set by which identities had sessions on the appliance.

Controls each programme needs

Vulnerability management

• Coverage: authenticated scanning or agents on every asset class, with scan coverage reported against the inventory. See the Vulnerability Management Guide.
• Exploitation-led SLAs: separate, shorter windows for KEV-listed and SSVC Act findings; standard windows for the rest; documented exceptions with an expiry.
• Edge first: internet-facing systems and remote access gateways on the fastest track; see the Attack Surface Management Guide.
• Post-patch actions: where a flaw exposes credentials or sessions, the remediation ticket includes rotation and session termination, not just the upgrade.

Attack path management

• Tier 0 definition: directory controllers, identity synchronisation and federation servers, roles that can grant any other role, and the APM platform itself.
• Edge hygiene at source: remove non-default ACL entries on privileged objects, flatten nested privileged groups, remove owners from high-privilege applications, scope managed identity roles (AC-6 Least Privilege).
• Session tiering: privileged accounts sign in only to systems of their own tier, so admin sessions stop appearing on ordinary servers; see the JIT Access Guide.
• Non-human edges: service accounts, service principals and CI tokens are frequent path nodes; inventory owners and permissions for each. See the Service Account Security Guide.
• Regression alerts: detection rules for re-added edges, for example a new member in a group that is a known choke point, or a new credential on a privileged application (T1098.001).

Combining the two programmes

The practical join is a shared prioritisation model in which every open item, whether CVE, misconfiguration or permission, carries an attack path attribute. A simple, defensible scheme:

Three rules keep the join honest. First, reachability may raise priority freely but should lower it only when the graph is known to be complete for that asset; a finding with "no path" on an asset the collectors cannot see is unknown, not safe. Second, KEV-listed edge findings never drop below band 2 on reachability grounds, because the internet is itself a starting point. Third, a path is closed only when re-collection confirms the edge is gone. The Reachability Analysis Guide covers code and network reachability; the Breach and Attack Simulation (BAS) Guide covers validating that a path is really broken.

Worked scenario

A hybrid organisation has 41,000 open findings, 1,900 of them rated critical by CVSS-B, and an Active Directory synchronised to a cloud tenant. The VM team is meeting its 30-day SLA on about 60 per cent of criticals.

1. Define targets: domain controllers, the directory synchronisation server, Global Administrator and Privileged Role Administrator, the finance database and the backup platform.
2. Collect and query: the graph shows that 87 per cent of enabled users have at least one path to Domain Admins. Two choke points account for most of them: a legacy help desk group with password reset rights over the OU that holds server administrator accounts, and three file servers where a domain administrator account has standing sessions.
3. Join with VM: of the 1,900 critical findings, 140 sit on hosts that appear on any path to a target, and 12 are KEV-listed on internet-facing systems. These 152 move to bands 1 and 2. The rest stay in the standard queue.
4. Fix the edges: the directory team scopes the help desk delegation away from privileged OUs and moves administrators to tiered admin workstations. Neither change touches a single CVE.
5. Validate: re-collection shows users with a path to Domain Admins down to a small set of named accounts; the red team confirms the help desk route is closed. A detection rule now alerts if the reset right is re-granted.

The numbers are illustrative, but the pattern is typical: the largest risk reduction came from two permission changes outside the VM queue, while VM's work became smaller and better aimed because reachability told it which criticals mattered first.

Decision criteria

Signals you need APM now: incident or red team reports where the intruder reached domain or tenant admin without exploiting a CVE; service accounts with unknown owners and broad rights; administrators who sign in to ordinary servers; and a VM backlog too large to explain to the board in risk terms.

Detection and measurement

• Log and alert on edge changes: membership changes to choke point groups, ACL changes on Tier 0 objects and AdminSDHolder, new credentials on privileged applications, new privileged role assignments, and privileged sign-ins to lower-tier hosts.
• Correlate exploitation with paths: when a KEV entry is published, query which affected hosts are on paths to critical assets, so the first patch wave is the one that matters.

Framework mapping

Common failure patterns

• Buying APM to shrink the patch backlog. Reachability reorders the queue; it does not remove the obligation to patch, and "no path" on an unmonitored asset is not evidence of safety.
• Running APM with the vendor's default targets. Paths end at generic admin groups while the payment system or backup platform has no paths reported because nobody tagged it.
• Treating permission findings as tickets for asset owners. The application owner cannot change the directory ACL, so the ticket ages out. Route by edge type.
• Measuring path counts instead of starting populations. Ten thousand paths from one service account matter less than three paths from every user; report who can reach Tier 0, not how many routes exist.
• Closing a CVE but not the credentials it exposed. As the CitrixBleed 2 case shows, sessions and tokens taken before the patch survive it.
• Leaving the graph unprotected. An export of every path to domain admin on a shared drive hands an intruder the plan.

Practitioner checklist

• Write down the critical asset list with business owners, including identity Tier 0 systems, and review it quarterly.
• Confirm VM coverage against the asset inventory for every asset class, and set KEV-first SLAs.
• Stand up graph collection for the directory and cloud identity tenant, and record which edge types each collector models.
• Identify the top choke points by number of starting principals that reach Tier 0, and assign each an owner and due date.
• Add an attack path attribute to every open VM finding and adopt banding rules that reachability can raise freely and lower only where the graph is complete.
• Route identity edge fixes to directory and cloud identity teams, not asset owners.
• Include session termination and credential rotation in remediation for flaws that expose credentials.
• Validate closures by re-collection or testing, and alert when removed edges return.
• Restrict access to APM data and tools as Tier 0.

Standards and references

• NIST: SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
• CISA: Known Exploited Vulnerabilities
• CISA: Stakeholder-Specific Vulnerability Categorization (SSVC)
• FIRST: CVSS v4.0 Specification Document
• FIRST: EPSS User Guide
• NCSC: Vulnerability Management
• Microsoft Learn: Review attack paths in Security Exposure Management
• Microsoft Learn: Critical asset management

Related NHI Mgmt Group resources: Exposure Management and CTEM Guide, Identity Attack Paths Guide, Risk-Based Vulnerability Management Guide, Vulnerability Prioritisation Guide.